Neonprimetime

Suspicious VBA mgming.rs/87yte55/6t45eyv.exe

Nov 10th, 2015
302
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Suspicious VBA Macro
  2. Reported by neonprimetime security
  3. http://neonprimetime.blogspot.com
  4.  
  5. *****
  6. Obfuscated Version: http://pastebin.com/xAxZUF1H
  7. *****
  8. Payload: hxxp://mgming.rs/87yte55/6t45eyv.exe
  9. *****
  10.     Dim oldLen As Integer
  11.     oldLen = 35
  12.     Dim decodeURLFunction As String
  13.     Dim encodedUrl() As Variant
  14.     encodedUrl = Array(4828, 4840, 4840, 4836, 4782, 4771, 4771, 4833, 4827, 4833, 4829, 4834, 4827, 4770, 4838, 4839, 4771, 4780, 4779, 4845, 4840, 4825, 4777, 4777, 4771, 4778, 4840, 4776, 4777, 4825, 4845, 4842, 4770, 4825, 4844, 4825)
  15.     Dim n As Integer
  16.     For n = LBound(encodedUrl) To UBound(encodedUrl)
  17.         decodeURLFunction = decodeURLFunction & Chr(encodedUrl(n) - 8 * oldLen - 4444)
  18.     Next n
  19.     MsgBox decodeURLFunction
RAW Paste Data