The obfuscated payload of a maldoc submitted by a reader can be quickly extracted with the "strings method" I explained in diary entry "Quickie: String Analysis is Still Useful".
"p.o.w.e.r.s.h.e.l.l. .p.a.y.l.o.a.d" In this example, the payload is still easily recognizable. "pInternet_Storm_CenteroInternet_Storm_CenterwInternet_Storm_CentereInternet_Storm_CenterrInternet_Storm_CentersInternet_Storm_CenterhInternet_Storm_CentereInternet_Storm_CenterlInternet_Storm_CenterlInternet_Storm_Center Internet_Storm_CenterpInternet_Storm_CenteraInternet_Storm_CenteryInternet_Storm_CenterlInternet_Storm_CenteroInternet_Storm_CenteraInternet_Storm_Centerd" And in this example, the payload is not so easy to recognize. In this example, we can see that it finds several repeating strings for our sample, but that there’s one repeating string that results in a decoded payload starting with powersheLL:
Didier Stevens |
DidierStevens 545 Posts ISC Handler Oct 5th 2020 |
Thread locked Subscribe |
Oct 5th 2020 6 months ago |
Thank You Didier
|
Netmanzim 63 Posts |
Quote |
Oct 7th 2020 6 months ago |
Thank you very much for posting this. I literally just had one fwded to me that a client received. Looked like a phishing attempt, had a bad HTML file attached to it. The body of the email was just the date, "06 October, 202012:06:02 PM", and letters scattered between that. It's weird though because it de-obfuscated to be something like "This voice message is for $person, please ignore if wrongly received".
Anyway, thank you. This was relevant for me this AM. |
Anonymous |
Quote |
Oct 7th 2020 6 months ago |
Sign Up for Free or Log In to start participating in the conversation!