Suspicious 80% Download

mHWID.bas

HWID obfuscation logic

Shifts each character by a fixed offsetVBScript extracts one character with Mid
SHA-25658df5aab93fefc5dc267d40c97e8674e5d9314b7332e6a2c7bfce7a1dc3720a5
MaleculeO(As)H(Db)

Evidence

VBScript Function declaration lines 1–2
1Attribute VB_Name = "mHWID"
2Private Declare Function GetVolumeInformation Lib "kernel32" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, ByVal pVolumeName …
VBScript Dim variable declaration lines 2–8
2:334… ystemNameSize As Long) As Long
3Private Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
4Public Function GetVolumeID() As String
5 Dim No As Long, szBuff As String * 256
6
7 Call GetSystemDirectory(szBuff, 256)
8 Call GetVol …
Shifts each character by a fixed offset lines 9–22
9:15… D = CStr(No)
10 GetVolumeID = encrypt(encrypt(GetVolumeID)) + "00000000"
11
12
13End Function
14
15Public Function encrypt(strInput As String)
16 Dim n As Integer, i As Integer
17 n = 13
18 For i = 1 To Len(strInput)
19 Mid(strInput, i, 1) = Chr(Asc(Mid(strInput, i, 1)) + n)
20 Next i
21 encrypt = strInput
22End Function

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.