Suspicious ^80% Download

mXOR.bas

XOR obfuscation logic

VBScript XORs a character-code sliceSource references XOR syntax

SHA-2564e417802ce0b0a9be91fedf79b702c37fc36779c937965cb9ef5d995d5770c4a

Evidence

Source references XOR syntax lines 1–13

1Attribute VB_Name = "mXOR"
2Public Function XORDecryption(CodeKey As String, DataIn As String) As String
  
  Dim lonDataPtr As Long
  Dim strDataOut As String
  Dim intXOrValue1 As Integer
  Dim intXOrValue2 As Integer
  
9
  For lonDataPtr = 1 To (Len(DataIn) / 2)
      'The first value to be XOr-ed comes from the data to be encrypted
      intXOrValue1 = Val("&H" & (Mid$(DataIn, (2 * lonDataPtr) - 1, 2)))
      'Th …

VBScript XORs a character-code slice lines 13–32

42… code key
      intXOrValue2 = Asc(Mid$(CodeKey, ((lonDataPtr Mod Len(CodeKey)) + 1), 1))
      
      strDataOut = strDataOut + Chr(intXOrValue1 Xor intXOrValue2)
  Next lonDataPtr
 XORDecryption = strDataOut
19End Function
20
21
22Public Function XOREncryption(CodeKey As String, DataIn As String) As String
  
  Dim lonDataPtr As Long
  Dim strDataOut As String
  Dim temp As Integer
  Dim tempstring As String
  Dim intXOrValue1 As Integer
  Dim intXOrValue2 As Integer
  
31
  For lo …