Benign Download

mEOF.bas

VB declares PE image header structureVB declares PE e_lfanew header field

SHA-2560401a1ea3de46ae76d56792f79e2a2f5f94e25b4f27aaeaaa75d72c22e8c7df0

Evidence

VB declares PE image header structure lines 1–8

1Attribute VB_Name = "mEOF"
2
3Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (dest As Any, Src As Any, ByVal L As Long)
4
5Public Type IMAGE_DOS_HEADER
6    e_magic As Integer        ' Magic number
7    e_cblp As Integer         ' Bytes on last page of file
8    e_cp As Integer  …

VB declares PE e_lfanew header field lines 21–31

  e_oemid As Integer        ' OEM identifier (for e_oeminfo)
  e_oeminfo As Integer      ' OEM information; e_oemid specific
  e_res2(0 To 9) As Integer ' Reserved words
  e_lfanew As Long          ' File address of new exe header
25End Type
26Public Type IMAGE_FILE_HEADER
  Machine As Integer
  NumberOfSections As Integer
  TimeDateStamp As Long
  PointerToSymbolTable As Long
  Numb …

VB6 Unicode string to bytes lines 87–105

 Characteristics  As Long
88End Type
89
90Public Sub PatchEOF(strFile As String)
91
  Dim idh As IMAGE_DOS_HEADER
  Dim inh As IMAGE_NT_HEADERS
  Dim ish As IMAGE_SECTION_HEADER
  Dim FileData As String
  Dim ExeData() As Byte
  Dim ExeLen As Long
 
  'Get binary data to file and convert to byte array
  FileData = GetFileData(strFile)
  ExeData = StrConv(FileData, vbFromUnicode)
 
  'Copy ExeData into IMAGE_DOS_HEADER and check if it's valid
  CopyMemory idh, ExeData(0), 64
  If idh.e_magic < …

VBScript End control-flow block lines 106–111

4…      Debug.Print "Not Valid EXE!"
      Exit Sub
  End If
109
  'Copy ExeData into IMAGE_NT_HEADER and check if it's valid
  CopyMemory inh, ExeData( …

VBA Open For Output file write lines 130–155

130:41… ode)
131    SaveFileData strFile, FileData
132    
133End Sub
134
135Public Function GetFileData(strFile As String) As String
136
137Dim strData As String
138Open strFile For Binary Access Read Lock Write As #1
139    strData = String$(LOF(1), Chr$(0))
140    Get #1, , strData
141Close #1
142GetFileData = strData
143
144End Function
145
146Public Sub SaveFileData(strFile As String, strData As String)
147
148Open strFile For Output As #1
149    Print #1, strData
150Close #1
⋯5 lines