psrok1

"""
IDAPython (py2), tested on IDA 7.3.
malduck.idamem is pretty beta thing, but should work in most cases.
"""

import string
from malduck import idamem, utf16z


def decrypt_strings(addr):

psrok1

"""
Py3 version of IcedID custom steganographic loader (PNG parser & PE reconstructor)
Inspired by https://github.com/hasherezade/funky_malware_formats/tree/master/iced_id_parser
Authored by @nazywam and @psrok1.

pip3 install malduck lief
"""

import sys
import malduck

psrok1

Keybase proof

I hereby claim:

• I am psrok1 on github.
• I am psrok1 (https://keybase.io/psrok1) on keybase.
• I have a public key whose fingerprint is FBBF CC0A 2749 2E61 3563 C205 9B05 0575 6942 E53C

To claim this, I am signing this object:

psrok1

# pip install malduck
import malduck
import sys

p = malduck.procmem.from_file(sys.argv[1])

# Recover magic
p.patchp(0, b"MZ")
p.patchp(p.uint32p(0x3c), b"PE")

psrok1

"""
Needs oledump.py in the same directory (download from https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py)
and olefile (pip install olefile)

Usage: python2 emotet-doc.py [doc path]
"""

import base64
import re
import sys

psrok1

try {
    WmiObject = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
    win32ProcessList = new Enumerator(WmiObject["ExecQuery"]("Select * from Win32_Process"));
    win32OperatingSystem = new Enumerator(Wmi["ExecQuery"]("Select * from Win32_OperatingSystem"));
    while (!win32OperatingSystem["atEnd"]()) {
        if (i == 5) break;
        osInfo = osInfo + win32OperatingSystem["item"]()["Caption"] + 
                            win32OperatingSystem["item"]()["Version"];
        i++;
        win32OperatingSystem["moveNext"]();

psrok1

try {
    WmiObject = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
    win32ProcessList = new Enumerator(WmiObject["ExecQuery"]("Select * from Win32_Process"));
    win32OperatingSystem = new Enumerator(Wmi["ExecQuery"]("Select * from Win32_OperatingSystem"));
    while (!win32OperatingSystem["atEnd"]()) {
        if (i == 5) break;
        osInfo = osInfo + win32OperatingSystem["item"]()["Caption"] + 
                            win32OperatingSystem["item"]()["Version"];
        i++;
        win32OperatingSystem["moveNext"]();

psrok1

"This one is global".global_func();
(function(){
    "This one is scoped".scoped_func();
	function String.prototype.scoped_func(arg_a, arg_b) {
		String.nested_func2("This one", " is nested");
		function String.prototype.nested_func(arg_a, arg_b) {
			WScript.echo(this);
		}
		this.nested_func();
		while(0)

psrok1

box-js 1.8.2, sample f3b3a5fc30ecbab403b27dd853ad7f6b

Using a 10 seconds timeout, pass --timeout to specify another timeout in seconds
[info] Rewriting code...
[info]     Replacing `function A.prototype.B()` (use --no-rewrite-prototype to skip)...
[error] Couldn't parse with Acorn:
[error] SyntaxError: Unexpected token (1:716)
[error] 
[error] This doesn't seem to be a JavaScript/WScript file.

psrok1

Test code

from gevent import spawn
from gevent import monkey

monkey.patch_all()

from master import celery_app