2

I'm trying to figure out this encoding in malware.. All I have are the static strings..

I was able to figure one out so there is plaintext on one:

e-snAetgrU$

translates to

$User-Agent

Here are some other strings from the same malware if it helps. I've tried 16/32 byte swaps and tried looking at the delta between the plaintext character index and the encoded one..

rdcTNIOemr$
MyNonASUo
uCoDL
MaNOza$
.eiCeShdPH$
ETSOHD$
RRNIootP$
2
  • A code snippet would help. Do you know where the "swap decoding" function is? Can you edit your question and add the code for that?
    – NirIzr
    Sep 3, 2016 at 13:03
  • The function is VB from a malicious macro. I was unable to decompile source
    – Chris Hall
    Sep 3, 2016 at 15:16

1 Answer 1

1

googling for e-snAetgrU yields the VBA Macros
just copy paste the macros into a VBA module in word/excel/
insert a few Msgbox() and you can decrypt all the strings

the unobfuscation is as follows

obf_str       = "e-snAetgrU"
obf_str_len   = len(obf-str)   == 10
redherr       = 1
i = 0

d(69, 43, obf_str)

rand = arg1  == 69

REPEAT:

Char_Choice_num = ( arg1 - (obf_str_len * (arg1 \ obf_str_len) )) ==
(69,52 - (10 * (69,52\10 == 6,5) == 60,50) ==) {9,2,5,8}

unobf_str[i++] = obf_str[Char_Choice_num+redherr] == obf_str[10,3,6,9] = 'U,s,e,r'

rand = Char_Choice_num+arg2  ==  52,45,48,51

goto REPEAT Until Len (obfxx) == len(unobfyy)

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.