Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > alt.comp.hardware.pc-homebuilt > #40080
| From | "Apd" <not@all.invalid> |
|---|---|
| Newsgroups | alt.comp.hardware.pc-homebuilt, alt.comp.anti-virus, alt.computer.security |
| Subject | Re: Kaspersky Rescue Disk Report - can't see full paths |
| Date | 2019-06-06 10:46 +0100 |
| Organization | Aioe.org NNTP Server |
| Message-ID | <qdankg$11kc$1@gioia.aioe.org> (permalink) |
| References | <nejffe97aurtm817oikhrshavi00cfgkuo@4ax.com> <qd9c1h$lh$1@dont-email.me> <qd9mah$iig$1@gioia.aioe.org> <crvgfe5ja2g8c1sktvdp0vvfkmtcd4pnj9@4ax.com> |
Cross-posted to 3 groups.
"Shadow" wrote: > On Thu, 6 Jun 2019 01:19:56 +0100, "Apd" wrote: >>XOR the base64 with 0xEF and you have plain text with a single >>linefeed terminating each line. It's an XML report. Here's a line from >>your second example, krdeicar.txt (wrapped for ease of reading): >> >><Event1 Action="Detect" Time="132042218823887019" >> Object="@Filesystem[65ba0377-31a7-52e4-8e5b-5415b3a73f12]/Downloads/EICARAntiVirusTestFile.com" >> Info="EICAR-Test-File" /> > > Thanks for that. You must dream in hex, as I did 2 decades > ago. Alas, all I dream about now is staying alive. I know what you mean. > Simple XORing. Who would have guessed? A few years of malware analysis (and hex dreaming!) has got me used to seeing those kind of patterns. > Too hard for me to figure out without your help. I will now > write a little program in free Pascal or maybe 16 bit assembler to > automate the process, unless you can recommend freeware (no online > datamining stuff) that does it automatically ? McAfee made a Windows GUI tool called FileInsight which could do base64 and XOR decode among other things but I can't find it on their website now. I see Paul has posted some C code which does the job and is similar to one of the several utilities I wrote myself for such things.
Back to alt.comp.hardware.pc-homebuilt | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 12:21 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-05 17:26 -0400
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 20:28 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 01:19 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-06 00:06 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:46 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths "wasbit" <wasbitREMOVE@hotmail.com> - 2019-06-07 09:53 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-07 10:43 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-08 16:13 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "David B." <BDonTJ@REMOVE.gmail.com> - 2019-06-07 08:11 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-06 02:15 -0400
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:48 +0100
csiph-web