In my previous post we used VBA and Excel to decode the URL and the PE file.
In this post we will use Python. I translated the VBA decoding function IpkfHKQ2Sd to Python:
Now we can decode the URL using Python:
And also decode the downloaded file with my translate program and the IpkfHKQ2Sd function:
Didier Stevens 
[…] a quick and dirty analysis and a “slow and clean” analysis of a malicious document, we can integrate the Python decoder function into a plugin: the […]
Pingback by Stats for Analysis Of An Office Maldoc With Encrypted Payload: oledump plugin | Didier Stevens — Saturday 7 November 2015 @ 0:00
[…] used this in my “Analysis Of An Office Maldoc With Encrypted Payload (Slow And Clean)” […]
Pingback by Update: translate.py V2.1.0 | Didier Stevens — Sunday 8 November 2015 @ 0:01
[…] Analysis Of An Office Maldoc With Encrypted Payload (Slow And Clean) […]
Pingback by Overview of Content Published In November | Didier Stevens — Friday 11 December 2015 @ 0:00