# Malcarve - Obfuscated payload extractor for malware samples
# Copyright (C) 2016 Steve Henderson
# 
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

[malcarve]
# file types/content to carve from streams
payloads = url, useragent, pe, lznt1_pe, zip, ole2
# additional stream encodings to unpack/scan from inputs
streams = hex, base64, deflate, reverse, chrs
# obfuscation/encryption schemes to match on streams
deobfuscators = xor, rol, add
# only report payloads that appear to be embedded/obfuscated
# i.e. not in plaintext at offset 0x00
embedded_only = True
# how many nested iterations to seach/decode streams like hex
max_stream_depth = 4

[url]
description = URL string
module = malcarve.payloads.strings.StringScanner
deobfuscators = xor, rol, add
scan_min = 12
scan_max = 512
min_size = 8
validation = url
pattern.1 = 0,0x687474703a2f2f
pattern.2 = 0,0x68747470733a2f2f

[useragent]
description = User-Agent string
module = malcarve.payloads.strings.StringScanner
deobfuscators = xor, rol, add
scan_min = 12
scan_max = 512
min_size = 8
validation = useragent
pattern.1 = 0,0x4d6f7a696c6c612f

[ole2]
description = OLE2 Compound File
module = malcarve.payloads.ole2.OLEScanner
deobfuscators = xor, rol, add
scan_min = 1536
scan_max = 3000000
min_size = 1536
validation =
# todo: investigate why expanding pattern to 20+ bytes cause huge fp rate
# suspect something to do with long null runs with 5 byte keys
pattern.1 = 0x0,0xd0cf11e0a1b11ae1000000000000000000003e

[pe]
description = Windows Portable Executable
module = malcarve.payloads.pe.PEScanner
deobfuscators = xor, rol, add
scan_min = 5000
scan_max = 3000000
min_size = 5000
validation = pe_header, pe_size
pattern.1 = 0x40,0x0e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f74
pattern.2 = 0x40,0xba10000e1fb409cd21b8014ccd219090546869732070726f6772616d206d757374
pattern.3 = 
pattern.4 =

[lznt1_pe]
# like gameover zeus samples as documented in
# https://blog.crysys.hu/2014/02/gameover-zeus-now-uses-encryption-to-bypass-perimeter-security-enc-encryption/
description = LZNT1 Compressed Windows Portable Executable
module = malcarve.payloads.pe.LZNT1PEScanner
deobfuscators = xor, rol, add
scan_min = 5000
scan_max = 3000000
min_size = 5000
validation = pe_header, pe_size
pattern.1 = 0x21,0x0e1f00ba0e00b409cd21b800014ccd2154686973002070726f6772616d0020
pattern.2 = 
pattern.3 = 
pattern.4 =

[zip]
description = ZIP formatted file
module = malcarve.payloads.zip.ZipScanner
deobfuscators = xor, rol, add
scan_min = 1000
scan_max = 3000000
min_size = 2000
validation = 
pattern.1 = 0x00,0x504b03040000
pattern.2 = 0x00,0x504b03041400
pattern.3 = 
pattern.4 =

[flash]
# to use will need to recompile c code as currently has min 6 byte
# mtaches for performance reasons...
description = Shockwave Flash
module = malcarve.payloads.flash.FlashScanner
deobfuscators = xor, rol, add
scan_min = 1000
scan_max = 1200000
min_size = 100
validation = flash_size, keywords
# really need at least 4 bytes to match xor patterns like countups
# so just try all likely version numbers for now?
# this will slow things down until come up with a better way for
# small headers/magic patterns.
pattern.1 = 0,0x43575308
pattern.2 = 0,0x43575309
pattern.3 = 0,0x4357530a
#pattern.4 = 0,0x4357530b
#pattern.5 = 0,0x4357530c
#pattern.6 = 0,0x4357530d
#pattern.7 = 0,0x4357530e
#pattern.8 = 0,0x4357530f
#pattern.9 = 0,0x43575310
#pattern.10 = 0,0x43575311
#pattern.11 = 0,0x43575312
#pattern.12 = 0,0x43575313
#pattern.13 = 0,0x43575314
pattern.14 = 0,0x46575308
pattern.15 = 0,0x46575309
pattern.16 = 0,0x4657530a
#pattern.17 = 0,0x4657530b
#pattern.18 = 0,0x4657530c
#pattern.19 = 0,0x4657530d
#pattern.20 = 0,0x4657530e
#pattern.21 = 0,0x4657530f
#pattern.22 = 0,0x46575310
#pattern.23 = 0,0x46575311
#pattern.24 = 0,0x46575312
#pattern.25 = 0,0x46575313
#pattern.26 = 0,0x46575314

[pdf]
description = Adobe PDF
module = malcarve.payloads.pdf.PDFScanner
deobfuscators = xor, rol, add
scan_min = 1000
scan_max = 1200000
min_size = 1000
validation = pdf_size, pdf_version
pattern.1 = 0,%%PDF-1.
pattern.2 = 
pattern.3 = 
pattern.4 =

[xor]
module = malcarve.schemes.xor.XORPatternFinder
description = XOR Obfuscation
schemes = plain, xor
max_keysize = 8
modifiers = null_preserve, step

[rol]
module = malcarve.schemes.rol.ROLFinder
description = Bitwise Rotation
schemes = 
max_keysize = 1
modifiers = 

[add]
module = malcarve.schemes.add.AddFinder
description = Single byte Add/Sub
schemes = 
max_keysize = 1
modifiers = 


[hex]
module = malcarve.streams.ascii.HexDecoder

[base64]
module = malcarve.streams.ascii.B64Decoder

[deflate]
module = malcarve.streams.deflate.DeflateDecoder

[reverse]
module = malcarve.streams.reverse.Reverse

[vars]
module = malcarve.streams.ascii.VariableDecoder

[chrs]
module = malcarve.streams.ascii.ChrDecoder
