This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/python3 | |
| import struct | |
| from PIL import Image | |
| from sys import argv, exit | |
| HEADER_FORMAT = ">4sIIBB" | |
| HEADER_SIZE = 14 | |
| TAG_FORMAT = ">B" |
omerk2511
/ netwalker_import_resolver.py
Created
June 4, 2020 13:13
Resolves all the NetWalker ransomware imports and shows the actual function names when they are called
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import zlib | |
| import idc | |
| import idautils | |
| import idaapi | |
| RESOLVE_IMPORTS = 0x00C512A6 | |
| GET_IMPORT_TABLE = 0x00C52400 | |
| rainbow_table = {} | |
| imports = [] |