De-obfuscation help.

Thread replies: 9
Thread images: 2

Dumbass who installed malware.
De-obfuscation help. 2016-12-30 04:17:29 Post No. 58236429
[Report] Image search: [Google]

File: Untitled.png (7KB, 601x119px) Image search: [Google]

7KB, 601x119px

De-obfuscation help. Dumbass who installed malware. 2016-12-30 04:17:29 Post No. 58236429 [Report]

I got some malware/pups on my windows install, after getting rid of it I realized it left behind some files, one of which appears to be an obfuscated visual basic script. Can anybody here find out what it does? I tried to simplify it as much as possible but i'm certainly no expert. (ps. can upload files if wanted)
Link to codeshare:
[spoiler]https://codeshare.io/GkVlAa[/spoiler]

Anonymous 2016-12-30 04:19:27 Post No.58236450
[Report] Image search: [Google]

Anonymous 2016-12-30 04:19:27 Post No.58236450 [Report]

File: 1422845511539.jpg (23KB, 224x220px) Image search: [Google]

23KB, 224x220px

>Can anybody here find out what it does?

Just because /g/ is 90% pajeet nowadays doesn't mean we're your workers

Dumbass who installed malware. 2016-12-30 04:20:57 Post No.58236465
[Report]

Dumbass who installed malware. 2016-12-30 04:20:57 Post No.58236465 [Report]

>>58236450
I figured someone autistic enough would do it for the hell of it.

Dumbass who installed malware. 2016-12-30 04:38:44 Post No.58236650
[Report]

Dumbass who installed malware. 2016-12-30 04:38:44 Post No.58236650 [Report]

Im just gonna delete it.

Anonymous 2016-12-30 04:45:58 Post No.58236740
[Report]

Anonymous 2016-12-30 04:45:58 Post No.58236740 [Report]

>>58236429
Upload it again, I want to see it.

Dumbass who installed malware. 2016-12-30 04:49:05 Post No.58236779
[Report]

Dumbass who installed malware. 2016-12-30 04:49:05 Post No.58236779 [Report]

>>58236740
Ok. Ill just upload the files, I THINK it may be Javascript actually.

Dumbass who installed malware. 2016-12-30 04:51:58 Post No.58236807
[Report]

Dumbass who installed malware. 2016-12-30 04:51:58 Post No.58236807 [Report]

>>58236740
Here you go:
https://www.expirebox.com/download/ef0f2587802d7b3426b387b40c2947ab.html

Dumbass who installed malware. 2016-12-30 04:54:35 Post No.58236839
[Report]

Dumbass who installed malware. 2016-12-30 04:54:35 Post No.58236839 [Report]

>>58236740
hdat2 is hex btw.

Anonymous 2016-12-30 05:58:59 Post No.58237476
[Report]

Anonymous 2016-12-30 05:58:59 Post No.58237476 [Report]

Nice spoiler tags, retard.

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible. Read more on this topic here - https://archived.moe/talk/thread/1694/

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible.
Read more on this topic here - https://archived.moe/talk/thread/1694/