Closed cccs-kevin closed 1 year ago
I can't download the sample from VT, can you send me the JS from the file? My email is on my github profile or website
Hey hey, I'll just post them here:
Here is the HTML sample from VT (password: infected) 8593592508.zip
Here is the obfuscated JS (password: infected) 26c639091d1a960a552e130887ec4ebea8e518685db046f6ef818e9717778aac.zip
Hey @relative!
Awesome project, and thanks again for releasing v2.4.0 so quickly after I asked in https://github.com/relative/synchrony/issues/46 :)
We are noticing a possible regression in de-obfuscation in v2.4.0 from v2.3.0.
The HTML file https://www.virustotal.com/gui/file/55b67b30917c6786f9d53a39af6166ca638c797c408c8743e705680ecb807f09 has obfuscated JavaScript with the hash
26c639091d1a960a552e130887ec4ebea8e518685db046f6ef818e9717778aac
.v2.3.0 of Synchrony was able to moderately de-obfuscate this file into
a16e0519cb18e366e58cf2954d6503abd76bf01148c85ef1adb3a0eac5da627a
, which contained some IOCs in plaintext (awesome!):But v2.4.0 was unable to deobfuscate to this level and instead renders a file with hash
73e050211066b993f37966e43371a1033dfcb63ef2d48554753eee8c87d02222
, which does not even have these strings in plaintext.I've attached the two outputs from the different versions of Synchrony: v2.3.0_output.txt v2.4.0_output.txt
Let me know what you think and if you need more information let me know!