Since a day or two I’m seeing yet another trick used by malware authors in their VBA macros.
The sample I’m looking at is 26B857A0A57B89166584CBB7167CAA19.
The VBA macro downloads base64 encoded scripts from Pastebin:
The scripts are delimited by HTML-like tags like <text10>. Tags that start with stext are scripts for Windows XP systems, and tags that start with text are for Windows Vista and later. This difference is for Powershell: on XP, VBS scripts are executed, and on more recent systems, Powershell scripts are executed.
The URL of the payload comes from another Pastebin entry:
Correct: that trojan is hosted on Dropbox.
Didier Stevens 