Hello to everyone in RE section!
I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via program launcher and then saved to disk.
At first glance (for my limited knowledge view atleast), it appears to be that they are encrypted is some way.
The program itself unpacks atleast 2 files with .sys and .dll extensions from said file. As I said before multiple variations of this file are nearly identical in supposed PE signature region.
First 112 bytes nearly identical, and supposed extension signature always the same (first 3-4 bytes).
Also it appears to me that sequence of chars
cfilorux repeats itself multiple times. Am I correct to assume that its XOR encryption?