In diary entry “Formbook Delivered Through Multiple Scripts<\/a>“, Xavier mentions that the following line:<\/p>\n decodes to the string POWERSHELL.<\/p>\n My tool numbers-to-hex.py<\/a> is a tool that extracts numbers from text files, and converts them to hexadecimal.<\/p>\n Like this:<\/p>\n I can then use another tool, hex-to-bin.py<\/a> to convert the hexadecimal numbers to binary, and then we see this string:<\/p>\n This string is not exactly the string POWERSHELL, but we can see parts of it.<\/p>\n The reason the decoding fails, is because of binary numeric expressions like this one: 79+1<\/p>\n My tool numbers-to-hex.py does not recognize\u00a0binary numeric expressions like 79+1, it just recognizes two numbers: 79 and 1.<\/p>\n 79 converted to hexadecimal is 4f, and 1 converted to hexadecimal is 01.<\/p>\n Those hex numbers converted to ASCII give O (4f) and a smiley (01).<\/p>\n So Xavier’s example inspired me to update my tool, so that it can also handle\u00a0binary numeric expressions (binary here means that the operator, + in our example, takes 2 operands).<\/p>\n You enable this mode with option -e:<\/p>\n So this time, 79+1 is converted to 50 hexadecimal.<\/p>\n And this properly decodes this obfuscated string:<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n Didier Stevens (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n \t\nNestlers= array(79+1,79,80+7,60+9,82,83,72,69,76,76)<\/pre>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
\nSenior handler
\nblog.DidierStevens.com<\/a><\/p>\n
\n
<\/BR><\/p>\n