2

I'm trying to figure out this encoding in malware.. All I have are the static strings..

I was able to figure one out so there is plaintext on one:

e-snAetgrU$

translates to

$User-Agent

Here are some other strings from the same malware if it helps. I've tried 16/32 byte swaps and tried looking at the delta between the plaintext character index and the encoded one..

rdcTNIOemr$
MyNonASUo
uCoDL
MaNOza$
.eiCeShdPH$
ETSOHD$
RRNIootP$
2
  • A code snippet would help. Do you know where the "swap decoding" function is? Can you edit your question and add the code for that?
    – NirIzr
    Sep 3 '16 at 13:03
  • The function is VB from a malicious macro. I was unable to decompile source
    – Chris Hall
    Sep 3 '16 at 15:16
1

googling for e-snAetgrU yields the VBA Macros
just copy paste the macros into a VBA module in word/excel/
insert a few Msgbox() and you can decrypt all the strings

the unobfuscation is as follows

obf_str       = "e-snAetgrU"
obf_str_len   = len(obf-str)   == 10
redherr       = 1
i = 0

d(69, 43, obf_str)

rand = arg1  == 69

REPEAT:

Char_Choice_num = ( arg1 - (obf_str_len * (arg1 \ obf_str_len) )) ==
(69,52 - (10 * (69,52\10 == 6,5) == 60,50) ==) {9,2,5,8}

unobf_str[i++] = obf_str[Char_Choice_num+redherr] == obf_str[10,3,6,9] = 'U,s,e,r'

rand = Char_Choice_num+arg2  ==  52,45,48,51

goto REPEAT Until Len (obfxx) == len(unobfyy)

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.