Suspicious ^80% Download

Form1.frm

obfuscated decryption logic

Shifts each character by a fixed offsetVBScript extracts one character with Mid

SHA-25681ff7fe9566033b9b3203e278de8e068cf3b9318e56e26ef62fee8259aa8ba24

Evidence

VB6 form designer block lines 1–5

1VERSION 5.00
2Begin VB.Form Form1 
3   Caption         =   "HWID Decrypter - SpK"
4   ClientHeight    =   600
5   ClientLeft     …

VB6 attribute module name lines 24–31

24:29… 0
25      Width           =   3855
26   End
27End
28Attribute VB_Name = "Form1"
29Attribute VB_GlobalNameSpace = False
30Attribute VB_Creatable = False
31Attribute VB_Pre …

Shifts each character by a fixed offset lines 31–50

31:26… d = True
32Attribute VB_Exposed = False
33Private Sub Command1_Click()
34If Text1.Text = "" Then
35Else
36Text1.Text = decrypt(decrypt(Text1.Text))
37
38Text1.Text = Left(Text1.Text, Len(Text1.Text) - 8)
39
40
41End If
42End Sub
43Public Function decrypt(strInput As String)
44    Dim n As Integer, i As Integer
45    n = 13
46    For i = 1 To Len(strInput)
47        Mid(strInput, i, 1) = Chr(Asc(Mid(strInput, i, 1)) - n)
48    Next i
49    decrypt = strInput
50End Function