A tool for decoding IcedID arrays
' Usage: cscript decode.vbs <array> | |
' Example: | |
' cscript decode.vbs "Array(g6,u7,s8,d4,z3,u7,b6,l5,j4,e9,k7,z1,k7)" | |
' returns qMUuDMFaZ.txt | |
conST r2=27 | |
CONsT rr2=38 | |
coNSt C5=42 | |
cOnST D4=130 | |
ConST t=132 | |
coNst g2=146 | |
COnst A3=203 | |
const L9=60 | |
const S5=63 | |
consT ss5=213 | |
cONsT p5=72 | |
cOnST j3=64 | |
coNST E=228 | |
cONST T3=257 | |
cONst Tt3=295 | |
ConSt j2=191 | |
conST h6=78 | |
CONSt hH6=227 | |
CoNST i8=200 | |
cONsT l4=157 | |
CoNst G1=94 | |
cONsT gg1=261 | |
CONST f5=39 | |
cOnst D3=109 | |
ConST T4=247 | |
cOnsT N2=166 | |
COnst U7=90 | |
const M2=234 | |
conST q9=57 | |
cONST n3=235 | |
coNsT nN3=392 | |
COnSt x2=255 | |
cOnsT V5=221 | |
COnst O6=74 | |
CoNSt C6=70 | |
CONST g7=111 | |
CONsT B9=240 | |
ConST Bb9=471 | |
cONSt s8=98 | |
CONst N4=246 | |
consT w3=219 | |
CONST o7=61 | |
coNSt OO7=241 | |
consT A7=152 | |
conST z6=205 | |
conSt t5=25 | |
cOnST tT5=29 | |
cOnst a9=85 | |
CoNsT Aa9=133 | |
cOnSt p2=46 | |
cOnSt i6=131 | |
COnst D7=265 | |
ConST j8=77 | |
cOnsT F2=163 | |
CoNst V4=261 | |
COnSt vv4=417 | |
const g4=108 | |
CoNSt V=96 | |
coNST z5=187 | |
cOnst H2=122 | |
consT R4=207 | |
ConSt m3=144 | |
CoNst z=43 | |
conSt o=123 | |
CoNsT Q6=35 | |
Const Qq6=145 | |
conST J5=188 | |
conST Jj5=441 | |
conSt w7=88 | |
cOnSt Ww7=122 | |
CoNSt F8=101 | |
COnSt G=30 | |
cONsT f1=223 | |
CONst ff1=406 | |
cONSt C9=104 | |
ConST X1=67 | |
cONSt XX1=133 | |
cOnST Y6=143 | |
consT d1=22 | |
conSt O4=214 | |
ConSt q3=14 | |
CoNST A2=75 | |
ConSt n1=220 | |
CoNst V2=148 | |
coNSt vV2=171 | |
CoNSt f=227 | |
coNst u3=226 | |
CONsT a6=179 | |
CONsT k5=177 | |
COnST m6=190 | |
CoNst U=53 | |
conSt UU=109 | |
cOnSt L7=206 | |
coNst ll7=383 | |
conST p4=93 | |
CoNST a1=140 | |
CONSt t2=183 | |
cONST K7=129 | |
COnsT kK7=325 | |
ConST b2=258 | |
cOnsT K2=16 | |
CoNSt K9=233 | |
CoNst y1=58 | |
coNSt YY1=234 | |
ConSt v8=244 | |
COnST C4=263 | |
cOnsT D=161 | |
ConSt T9=139 | |
coNsT s7=216 | |
cONsT M8=114 | |
ConSt H=50 | |
conST hh=248 | |
CoNSt S=13 | |
conSt c7=106 | |
consT Cc7=328 | |
cONST l=15 | |
cOnST G9=196 | |
const h4=262 | |
Const F3=44 | |
COnSt a8=164 | |
cOnsT x=151 | |
COnsT y7=230 | |
cOnsT i3=245 | |
consT n6=125 | |
coNst i9=86 | |
cOnsT l5=110 | |
Const C8=38 | |
ConsT S3=66 | |
CoNst S6=160 | |
cONst S4=185 | |
COnST D9=17 | |
ConsT X4=134 | |
coNsT W8=267 | |
cOnST y3=170 | |
COnSt h3=33 | |
ConST hh3=162 | |
coNSt s1=116 | |
ConsT b1=167 | |
cONSt BB1=400 | |
Const E7=194 | |
cONST v1=21 | |
CONSt I4=91 | |
Const II4=327 | |
COnSt M4=197 | |
COnST e8=264 | |
CONST U4=84 | |
CoNST R1=256 | |
CONSt R7=250 | |
CoNst RR7=403 | |
ConSt J7=76 | |
cOnst j4=103 | |
cOnsT b5=184 | |
COnsT p3=171 | |
consT L2=224 | |
CoNst B3=20 | |
ConsT N7=213 | |
cOnsT z9=73 | |
const zz9=123 | |
conST a=182 | |
CONsT F6=249 | |
CoNsT U6=19 | |
ConSt e3=242 | |
cONSt x8=172 | |
Const Z3=81 | |
COnST k1=173 | |
CoNst F9=239 | |
cONst H1=89 | |
conST m5=232 | |
COnST X6=45 | |
coNst z8=48 | |
cOnSt H8=169 | |
coNsT z4=69 | |
CoNst i1=113 | |
coNst C2=80 | |
coNsT I=229 | |
coNsT E2=193 | |
const V7=55 | |
conST s2=127 | |
CONst E4=222 | |
CONsT A5=202 | |
CoNst p1=54 | |
const i2=145 | |
cOnST B=210 | |
ConsT C=248 | |
const cc=317 | |
cONST Q7=105 | |
CoNst r6=141 | |
COnST Q2=201 | |
CONsT N8=217 | |
cOnsT u5=238 | |
CoNst m=243 | |
cONst i5=211 | |
CoNST K3=142 | |
CoNsT c1=100 | |
CONST l1=115 | |
ConST y9=251 | |
Const l6=62 | |
ConsT f4=178 | |
cOnst x3=236 | |
cONST Y2=147 | |
cOnSt l8=266 | |
CoNsT b8=215 | |
ConSt bb8=397 | |
const I7=37 | |
cONST H9=99 | |
conST HH9=297 | |
ConST o5=128 | |
coNST V6=92 | |
cONST U1=107 | |
coNSt m9=204 | |
COnsT o1=149 | |
COnST oO1=355 | |
ConST s9=31 | |
CONsT r=241 | |
conSt N=208 | |
coNST nn=368 | |
cONsT y5=41 | |
cONST E5=218 | |
coNSt Ee5=251 | |
cONST Q5=18 | |
const b7=65 | |
CoNst x9=252 | |
CoNST j=181 | |
coNst y4=32 | |
consT V3=136 | |
CONST e9=59 | |
conSt j6=212 | |
ConST U2=79 | |
COnSt M1=97 | |
coNsT Q4=118 | |
CoNST r9=209 | |
COnSt o9=176 | |
CONsT x7=189 | |
const a4=28 | |
COnst v9=195 | |
cONSt E1=254 | |
cONst u9=117 | |
CONst K6=154 | |
ConsT j9=51 | |
cOnsT W4=47 | |
CONsT u8=95 | |
coNsT o8=155 | |
CoNST y=268 | |
cOnsT yY=435 | |
CONsT z1=133 | |
COnst q8=162 | |
cOnsT QQ8=349 | |
CONsT y8=119 | |
cOnSt YY8=336 | |
CONsT B6=83 | |
coNSt T6=52 | |
CoNSt t8=56 | |
CoNsT w2=68 | |
CoNsT K=159 | |
COnsT Kk=310 | |
coNST R8=87 | |
CoNsT k4=165 | |
coNsT Kk4=408 | |
CoNsT o3=174 | |
conST Q1=120 | |
cOnST G8=26 | |
COnSt T7=71 | |
conST Tt7=309 | |
CoNsT n9=180 | |
COnST k8=23 | |
CONsT t1=225 | |
conST w5=192 | |
CoNsT O2=112 | |
consT d2=231 | |
ConsT g6=126 | |
ConsT p=40 | |
cONsT c3=102 | |
ConsT R5=24 | |
coNST G5=124 | |
coNSt gg5=142 | |
CoNSt f7=138 | |
cOnsT X5=199 | |
cOnst W1=168 | |
coNST B4=237 | |
coNST h5=259 | |
ConSt e6=150 | |
cONsT ee6=189 | |
COnSt D6=49 | |
ConST r3=137 | |
ConSt RR3=236 | |
COnst w9=260 | |
coNST z7=156 | |
consT g3=36 | |
cOnST GG3=235 | |
COnst n5=153 | |
CONSt d5=253 | |
const z2=29 | |
conST q=34 | |
conSt qQ=122 | |
CoNsT D8=186 | |
cOnst w6=158 | |
cONSt h7=82 | |
cOnST L3=135 | |
conST J1=198 | |
conSt M7=175 | |
coNsT w=121 | |
CONsT Ww=274 | |
' Decode array -> str (val - 13) | |
Function GeRSvfK(ins) | |
idx=0 | |
outs="" | |
do while idx <= ubound(ins) | |
outs=outs+ChrW(ins(idx)-13) | |
idx=idx+1 | |
loop | |
GeRSvfK = outs | |
End Function | |
Set objStdOut = WScript.StdOut | |
Function Base64Encode(sText) | |
Set oNode = CreateObject("Msxml2.DOMDocument.3.0").CreateElement("base64") | |
oNode.dataType = "bin.base64" | |
oNode.nodeTypedValue =sText | |
Base64Encode = oNode.text | |
Set oNode = Nothing | |
End Function | |
objStdOut.Write(GeRSvfK(Eval(WScript.Arguments.Item(0)))) | |
' Useful for binary: | |
' objStdOut.Write(Base64Encode(GeRSvfK(Eval(WScript.Arguments.Item(0))))) | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment