This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| """ | |
| RC4 Decryption Utility for Malicious Payload Extraction | |
| """ | |
| import sys | |
| import pathlib | |
| import binascii | |
| from Cryptodome.Cipher import ARC4 | |
| def main(): | |
| if len(sys.argv) != 3: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import struct | |
| import magic | |
| from PIL import Image | |
| import sys | |
| img = Image.open(open(sys.argv[1], "rb")) | |
| img_data = b"" | |
| for x in range(img.width): | |
| if len(img_data) >= 2 and not img_data.startswith(b"MZ"): | |
| print("Not a valid PE file") |
NewerOlder