Suspicious ^80% Download

AnonScanner.vb

Obfuscated HTTP upload logic

Heavy VBA string obfuscationRepeated Chr fragment concatenation

SHA-2568cd1a06d00666fe4ae0a0d8705e3010581c51b350a7a395842d164128ace2776

Evidence

VBScript End control-flow block lines 10–17

17…  AnonScanner
      ' Methods
      Public Sub New(ByVal _api As String, ByVal id As String)
          AnonScanner.apiKey = _api
          AnonScanner.uid = id
      End Sub
16
      Public Shared Function HttpUploadFile(ByVal url As String, ByVal file As String, ByVal paramName As String, ByVal contentType As Stri …

Repeated Chr fragment concatenation lines 17–25

155…  As NameValueCollection) As String
          Dim enumerator As IEnumerator
          Dim str As String = ("---------------------------" & DateTime.Now.Ticks.ToString("x"))
          Dim bytes As Byte() = Encoding.ASCII.GetBytes((ChrW(13) & ChrW(10) & "--" & str & ChrW(13) & ChrW(10)))
          Dim request As HttpWebRequest = DirectCast(WebRequest.Create(url), HttpWebRequest)
          request.ContentType = ("multipart/form-data; boundary=" & str)
          request.Method = "POST"
          request.KeepAlive = True
          request.Credentials  …

VBScript Dim variable declaration lines 25–27

35… CredentialCache.DefaultCredentials
          Dim requestStream As Stream = request.GetRequestStream
          Dim format As String = "Content-Disposition: form-data; name=""{0}""" & ChrW(13) & ChrW(10) & ChrW(13) & C …

References an HTTP Content-Type header lines 43–44

43:60… -data; name=""{0}""; filename=""{1}""" & ChrW(13) & ChrW(10) & "Content-Type: {2}" & ChrW(13) & ChrW(10) & ChrW(13) & ChrW(10)
44            Dim s As String = String.Format(str4, paramName, file, contentTyp …