mirror of https://github.com/avast/ioc
65 lines
3.0 KiB
Python
65 lines
3.0 KiB
Python
import sys
|
|
import gzip
|
|
from pathlib import Path
|
|
from xml.dom import minidom
|
|
|
|
decrypt_key = bytes([0x5F, 0xA2, 0x06, 0x34, 0xD1, 0xC6, 0x68, 0x2A, 0x68, 0xF4, 0x81, 0x92, 0x70, 0x95, 0x4C, 0xE4, 0xE4, 0x0D,
|
|
0x23, 0x7C, 0x09, 0x2A, 0xA2, 0xFC, 0xA0, 0xA2, 0x71, 0xB6, 0xB8, 0x88, 0x33, 0x1E, 0x04, 0xAA, 0xDE, 0x3F,
|
|
0xA0, 0xAA, 0x7E, 0x4F, 0x78, 0xD0, 0x71, 0x75, 0x9C, 0x8D, 0x85, 0xB9, 0xCA, 0x81, 0xA0, 0x6C, 0xC8, 0x27,
|
|
0x2E, 0x1E, 0xA1, 0x0F, 0x3A, 0xDC, 0xCE, 0x63, 0x51, 0x89, 0xC9, 0x7D, 0x97, 0xE5, 0x03, 0xD3, 0xFB, 0x10,
|
|
0x83, 0x56, 0x9E, 0x36, 0xE1, 0x38, 0x13, 0x0D, 0x5A, 0x29, 0x1A, 0xF1, 0x46, 0x49, 0x7A, 0xBC, 0xED, 0x52,
|
|
0x3B, 0x97, 0x9D, 0xE9, 0x5A, 0x78, 0xAE, 0xB2, 0xA2, 0x1F, 0xF5, 0xCE, 0xF7, 0xC9, 0x0D, 0xD6, 0x6C, 0x1F,
|
|
0x83, 0x2F, 0x68, 0xAD, 0xA4, 0x1F, 0xBB, 0xC8, 0x8D, 0xC7, 0x56, 0x74, 0xB9, 0x18, 0xCC, 0x6E, 0xB5, 0x2C,
|
|
0x42, 0xA9, 0x06, 0xC9, 0x20, 0x80, 0x2B, 0xA6, 0xA4, 0x77, 0xC7, 0x58, 0xFC, 0xF9, 0x70, 0x6F, 0x97, 0xAD,
|
|
0xF3, 0xAD, 0x2A, 0x01, 0x11, 0xF4, 0xC9, 0x11, 0x9D, 0x36, 0xF5, 0x83, 0x72, 0xC9, 0xA6, 0x0F, 0x51, 0xA1,
|
|
0xDF, 0xDD, 0xD1, 0x70, 0x9C, 0x0E, 0x91, 0x09, 0xE7, 0xD0, 0x58, 0x5A, 0xEA, 0xAC, 0xD1, 0x4B, 0xDB, 0x45,
|
|
0x9A, 0x4D, 0x4F, 0xF2, 0xBF, 0x5D, 0x5B, 0x84, 0x88, 0xA3, 0x90, 0x8C, 0x60, 0x9F, 0x21, 0xB5, 0xDC, 0x60,
|
|
0xCA, 0x6A, 0x9A, 0x41, 0x1A, 0xBD, 0xF0, 0x6C, 0xB7, 0xED, 0x9C, 0xD3, 0x91, 0x0F, 0xA1, 0x3F, 0xCD, 0x69,
|
|
0x5E, 0x7D, 0x21, 0xD2, 0x0F, 0x55, 0x29, 0xD7, 0x1D, 0x4E, 0x18, 0x6E, 0xDA, 0xF1, 0x18, 0x62, 0xE4, 0x65,
|
|
0x2B, 0xF5, 0x00, 0xFB, 0xDD, 0x08, 0x20, 0x79, 0xF3, 0x16, 0x1A, 0xDA, 0xBC, 0x02, 0x57, 0x11, 0xB0, 0x92,
|
|
0x77, 0x90, 0x28, 0x58]
|
|
)
|
|
|
|
def decrypt(key: bytearray, data: bytes):
|
|
assert len(key) == 256
|
|
array = [0] * len(key)
|
|
array2 = [0] * len(key)
|
|
array3 = [0] * len(data)
|
|
|
|
for i in range(0, len(key)):
|
|
array[i] = key[i % len(key)]
|
|
array2[i] = i
|
|
|
|
num = 0
|
|
for i in range(0, len(key)):
|
|
num = (num + array2[i] + array[i]) % 256
|
|
num2 = array2[i]
|
|
array2[i] = array2[num]
|
|
array2[num] = num2
|
|
|
|
num3 = 0
|
|
num = 0
|
|
for i in range(0, len(data)):
|
|
num3+=1
|
|
num3 %= 256
|
|
num += array2[num3]
|
|
num %= 256
|
|
num2 = array2[num3]
|
|
array2[num3] = array2[num]
|
|
array2[num] = num2
|
|
num4 = array2[(array2[num3] + array2[num]) % 256]
|
|
array3[i] = data[i] ^ num4
|
|
return array3
|
|
|
|
|
|
# ======================================================================================================================
|
|
|
|
|
|
for fn in Path(".").glob(sys.argv[1]):
|
|
print("Processing " + fn.name)
|
|
data = bytearray(fn.read_bytes())
|
|
decrypt_data = decrypt(decrypt_key, data)
|
|
unzip_data = gzip.decompress(bytearray(decrypt_data))
|
|
xmlstr = minidom.parseString(unzip_data).toprettyxml(indent="\t")
|
|
fn.with_suffix(".xml").write_text(xmlstr, encoding='UTF-8')
|