Jurriaan Bremer fc58dffa15 .wsf analysis support ...

Recently a blogpost [1] was released covering a "new" technique used
in-the-wild. Rather than embedding a Javascript .js file, the .wsf
technique allows one to use the JScript.Encode feature to encode the
actual Javascript payload further.

As part of our static analysis we provide the decoded Javascript.
The implementation of this work is a port of scrdec18.c [2], a
JScript.Encode decoder implemented in C.

[1]: https://medium.com/@networksecurity/ransomware-delivered-using-wsf-windows-script-file-551a6589da47
[2]: https://gist.githubusercontent.com/bcse/1834878/raw/7483fb72abbb32aa69b853fdcc9f6f72e7568677/scrdec18.c

2016-02-12 00:15:24 +01:00

..

android

Updated copyright notice

2016-02-03 14:59:18 +01:00

darwin

Updated copyright notice

2016-02-03 14:59:18 +01:00

linux

Updated copyright notice

2016-02-03 14:59:18 +01:00

windows

.wsf analysis support

2016-02-12 00:15:24 +01:00

__init__.py

Turn the analyzer into a module

2015-05-06 21:51:47 +06:00