Closed GraxCode closed 4 years ago
Stumbled across a jar file with this string obfuscation (static initializer code):
byte var10000 = 15; var10000 = 14; boolean var7 = true; int var0 = -1716149230; var0 &= 1576531202; byte[] var8 = Base64.getDecoder().decode("4AAAAB4gAAAAAAAePiAAAADiwuAeIOL+Pj4gHiAA4sLCwuAAHiAAHiDi4ALciJxYNILa+mACbJzs9ihGYBoAJBYEoGAaQP6cWKDkHlp4jlyYKF7q8KRownBeEmK4QAioekxids6WIBSg8lB2GoS4Dp6KjBo2AGB4UobM+gACaMJsTgIEuEAIqHpi7l6OsoDsXPikRmaaGAx+XDzy7ABoIBgomv72KEZUfqIg9KAA5lxKhAakGLq+ogJqYkjGWPAgAKwu6mjCcmzw+AAQFOZ2uBqOXuSaWuj4UCLy+pZk8PACAHb2ZhIUFAoKmu7s7AKeUGJUTJgeru7CaPDQaAACSlbK/r72RCLyEvxOou5cZhxQ1rCiagL2wsQYNoJadihY5nb+gniQ8vAEjHikJJ4U/ORq6FSIeDhq/oB8KkbsBIhUYAiaeBqqAgLOlu7uFhiSYPz4XpgSrJx2LmyW+mDsQgAS6viwvHiMGKwGXORq6FSIeDhq/oB8KkbsBIhUYAiaYAaonnQatJpkeqhK6M6W7u4WGJJg/PhemBKsnHYubJb6ZB6g/vwA/ORq6FSIeDhqGsJ2JvBIxL4GBFakJIhiFrwCBADkMGAMsgAOppie2kaqFm5O5GoAXGIQOmiGYIwMBopIoG5kwBgiAJKcKkKoCAyE2MIA/ARg+FrykDAaMgBc2mSG1uwYktR8OLqgomoC7sAAECDqYOQwYAyyFuAQqALo3Hy4iN4YEljoXooAFu5oxpwChnQcPNxKZJBk2iSynGyGnopgYO7e7HSYGrq8YOxq5lwGmnakuozqQnr8ShIIXooAFu5o2DJg5nQcKkbsBJBk2sQYnPp2KFjmdv58dKBapvqsiFCY6Bjmdv5mFgKu8Bpi7v78TO5KcgZwrPrc6vrmGP6QAgqcUhqi/OJyOFyQGqoGYAJ2hk7uBIhYcCAKFKQQcoLsmnaUfOCqTmKiHihc9ihOYtwYwvxcmp7+SNhC5lr6BKBaeDwI/EgGpAiI6KBu9mQc0KQm8vz0YA4KhvpSAmx4GOIUinzodiYEAl4YitzqXid996OTlXo="); int var10001 = var8.length; byte[] var3; int var5; int var10002; if(var8.length != 0) { int var4 = var10001; var3 = new byte[var10001]; var5 = var10001; do { var0 &= 536202998; var5 += -1; byte var9 = var8[var5]; if(var5 + 6 + -var4 >= 0) { var10002 = var0 & '\u8000'; var0 &= -646058490; var10001 = var9 + 6; } else { var10001 = var9 + var3[var5 + 6]; } var10002 = var0 & 1024; var0 &= 502635791; var3[var5] = (byte)var10001; } while(var5 != 0); var8 = var3; var10001 = -6929 & 6928; } var10002 = var0 & 128; var10002 = var0 & 262144; var0 &= -46297094; byte[] var2 = var8; var10001 = var8.length + -1; if(var8.length + -1 != 0) { var3 = new byte[var10001]; var5 = var10001; while(true) { var0 &= -1078080002; var5 += -1; var3[var5] = (byte)((var8[var5] << 3) + (var2[var5 + (20528 ^ 20529)] >> 5 & (20486 ^ 20481))); if(var5 == 0) { var8 = var3; var10001 = 13638 & -16247; break; } } } var10002 = var0 & 8; var10002 = var0 & 8; var0 &= -616704874; var10001 = var8.length; if(var8.length != 0) { var3 = new byte[var10001]; var5 = var10001; while(true) { var0 &= -574763918; var5 += -1; var3[var5] = (byte)(((var8[var5] ^ 25) << (1316 & 204) & -16 | (var8[var5] ^ 25) >> (262 & 3620) & 15) + 18); if(var5 == 0) { var8 = var3; var10001 = -9181 & 8924; break; } } } var10002 = var0 & 2; var10002 = var0 & '\u8000'; var0 &= 503307910; var3 = var8; String var6 = new String(var3, StandardCharsets.UTF_8); String[] var10 = new String[2384 ^ 2380]; String[] var11 = new String[4363 ^ 4375]; var11[18435 ^ 18436] = var6.substring(17994 & -18283, 4167 & 2063); var11[280 & 6348] = var6.substring(4201 ^ 4206, 93 ^ 83); var11[-31470 ^ -31461] = var6.substring(-27583 ^ -27569, 1584 ^ 1573); var11[-32219 ^ -32209] = var6.substring(4117 & 18581, 14396 & 1118); var11[24637 & 2893] = var6.substring(30524 & 221, 80 ^ 115); var11[-30713 ^ -30708] = var6.substring(11 ^ 40, 2628 ^ 2670); var11[16423 ^ 16427] = var6.substring(1043 ^ 1081, 17841 & 12337); var11[16768 ^ 16791] = var6.substring(396 ^ 445, 4174 & 106); var11[20274 & 155] = var6.substring(4680 ^ 4610, 4161 ^ 4150); var11[4441 & 17469] = var6.substring(10538 ^ 10589, 6654 & 159); var11[3101 & 12437] = var6.substring(8638 & 20638, 4164 ^ 4262); var11[245 & 8705] = var6.substring(21479 & 2290, 4351 & 18926); var11[2305 ^ 2307] = var6.substring(8513 ^ 8623, 17444 ^ 17628); var11[29709 & 2085] = var6.substring(19704 & 12536, 318 & 6027); var11[2326 ^ 2317] = var6.substring(16698 & 14158, 433 & 21816); var11[4111 & 18399] = var6.substring(16429 ^ 16669, 4477 & 1004); var11[8229 ^ 8245] = var6.substring(321 ^ 45, 4496 ^ 4152); var11[-32109 ^ -32126] = var6.substring(-31616 ^ -31448, 8307 ^ 8615); var11[1310 & 4187] = var6.substring(17742 ^ 17562, 1260 ^ 1773); var11[1135 ^ 1145] = var6.substring(-32533 ^ -32022, 6339 ^ 6881); var11[1046 & 18694] = var6.substring(554 & 695, 3202 ^ 3752); var11[678 ^ 690] = var6.substring(6403 ^ 6953, 624 & 6755); var11[556 ^ 575] = var6.substring(4187 ^ 4667, 444 ^ 826); var11[1052 ^ 1048] = var6.substring(-27880 ^ -28258, 93 ^ 719); var11[835 & 16423] = var6.substring(2710 & 979, -24153 ^ -23803); var11[16398 & 10782] = var6.substring(2234 ^ 2584, -32250 ^ -32563); var11[278 ^ 270] = var6.substring(4811 & 763, 6911 & 767); var11[-2782 & 2265] = var6.substring(767 & 1791, 29212 ^ 28928);
Closed for now, as it doesn't seem to be appearing in many files. Could be a private obfuscator.
This is Sigma client's obfuscation, so it's probably a private one.
Stumbled across a jar file with this string obfuscation (static initializer code):