Suspicious ^80% Download

kaynak.bas

XOR obfuscation and download APIs

VBScript XORs a character-code sliceSource references XOR syntax

SHA-256b33e30cb825b2c2eae8c3d964a17b4ee5b80636ba7d335dadcb88a248e90f879

Evidence

VBScript Function declaration lines 1–10

1Attribute VB_Name = "kaynak"
2Public aktiftransferwar As Boolean
3Private Declare Function StrFormatByteSizeA Lib "shlwapi" (ByVal dw As Long, ByVal pszBuf As String, ByRef cchBuf As Long) As String
4Public Declare Function SendMessageA Lib "user32" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
5Public Declare Sub Sleep Lib "KERNEL32" (ByVal dwMilliseconds As Long)
6Public bWHidden As Boolean
7Public Reg As Object
8Public Fso As Object
9
10Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal sz …

VBScript Dim variable declaration lines 54–59

15… n FormatKB(ByVal Amount As Long) As String
  Dim Buffer As String
  Dim Result As String
  Buffer = Space$(255)
  Result = StrFormatByteSizeA(Amount, Buffer, Len(Buffer))
  If InStr(R …

VBScript End control-flow block lines 68–74

68:27… utes frm.hwnd, 0, SeffaflikDerecesi, LWA_ALPHA
69End If
70End Sub
71
72Public Function tasi(Form As Form)
73Call ReleaseCapture
74SendMessage Form.hwnd, WM_NCLBUTTONDOWN, HTCA …

VBScript XORs a character-code slice lines 77–96

77:29… CodeKey As String, DataIn As String) As String
78Dim lonDataPtr As Long
79Dim strDataOut As String
80Dim intXOrValue1 As Integer
81Dim intXOrValue2 As Integer
82For lonDataPtr = 1 To (Len(DataIn) / 2)
83intXOrValue1 = Val("&H" & (Mid$(DataIn, (2 * lonDataPtr) - 1, 2)))
84intXOrValue2 = Asc(Mid$(CodeKey, ((lonDataPtr Mod Len(CodeKey)) + 1), 1))
85strDataOut = strDataOut + Chr(intXOrValue1 Xor intXOrValue2)
86Next lonDataPtr
87XORSifreCoz = strDataOut
88End Function
89
90Public Function XORSifrele(CodeKey As String, DataIn As String) As String
91Dim lonDataPtr As Long
92Dim strDataOut As String
93Dim temp As Integer
94Dim tempstring As String
95Dim intXOrValue1 As Integer
96Dim intXOrValue2 As Integer
 …