new icedid photoloader decoder

decoder.py

import sys
import pefile
import struct

def decode(data):
	out = ""
	for i in range(len(data)/2):
		t1 = data[i*2]
		t2 = data[(i*2)+1]
		t1 &= 0xf0
		t2 = t2 >> 4
		t1 |= t2
		t1 ^= (i & 0xff)
		out += chr(t1&0xff)
	return out

def parse_domains(data):
	fakes = []
	real = []
	t = data[4:]
	(next, f) = struct.unpack_from('<BB', t)
	while next != 0 and next < 100:
		if f == 0:
			real.append(t[2:].split('\x00')[0])
		else:
			fakes.append(t[2:].split('\00')[0])
		t = t[next:]
		(next, f) = struct.unpack_from('<BB', t)
	return((fakes,real))
		

def decoder(data):
	pe = pefile.PE(data=data)
	config = {}

	sects = [bytearray(x.get_data()) for x in pe.sections if '.rdata' in x.Name]

	cfg = None

	for blob in sects:
		for i in range(min(500,len(blob))):
			temp = decode(blob[i:i+100])
			if '.com' in temp:
				cfg = decode(blob[i:])
				break
		if cfg != None:
			break

	(f,r) = parse_domains(cfg)
	config['C2'] = r
	config['FAKE_C2'] = f
	return config


if __name__ == "__main__":
	data = open(sys.argv[1], 'rb').read()
	t = decoder(data)
	print(t)