Didier Stevens

Wednesday 27 February 2019

Update: translate.py Version 2.5.5

Filed under: My Software,Update — Didier Stevens @ 0:00

I added function ZlibRawD to translate.py to decompress Zlib compression without header (ZlibD already exists, and is for Zlib compression with header).

This compression is sometimes used in malicious PowerShell scripts:

translate_v2_5_5.zip (https)
MD5: 0BBB0E7E569BCB08D5A9278C974A3EE6
SHA256: 78E0BAC87DF47D06BB9C351FBF3CA623EE10B3993E071E7C9A0C9C4DB0FFF1D4

Blog at WordPress.com.