import pefile
from arc4 import ARC4

def main():
	pe = pefile.PE(r"C:\Users\User\Desktop\Analysis\Zero2Auto\Lesson 3\Loaders\new_iced_dump.bin")
	section_addr = None

	for section in pe.sections:
		if(".data" in section.Name.decode()):
			section_addr = section
			break


	print("Virtual Location:", hex(section_addr.VirtualAddress))
	keys = section_addr.get_data()[0:8]
	cipher_text = section_addr.get_data()[8:585]

	print("Key:", keys)
	print("Decrypting RC4 Encrypted configuration!")


	arc4_key = ARC4(keys)

	string_decrypt = arc4_key.decrypt(cipher_text)

	print(string_decrypt)

if __name__ == "__main__":
	main()

1bdeacb43a5fea03c99c615dee2bf2902ffd012d
<mask token>

<mask token>


def main():
    pe = pefile.PE(
        'C:\\Users\\User\\Desktop\\Analysis\\Zero2Auto\\Lesson 3\\Loaders\\new_iced_dump.bin'
        )
    section_addr = None
    for section in pe.sections:
        if '.data' in section.Name.decode():
            section_addr = section
            break
    print('Virtual Location:', hex(section_addr.VirtualAddress))
    keys = section_addr.get_data()[0:8]
    cipher_text = section_addr.get_data()[8:585]
    print('Key:', keys)
    print('Decrypting RC4 Encrypted configuration!')
    arc4_key = ARC4(keys)
    string_decrypt = arc4_key.decrypt(cipher_text)
    print(string_decrypt)


<mask token>

<mask token>


def main():
    pe = pefile.PE(
        'C:\\Users\\User\\Desktop\\Analysis\\Zero2Auto\\Lesson 3\\Loaders\\new_iced_dump.bin'
        )
    section_addr = None
    for section in pe.sections:
        if '.data' in section.Name.decode():
            section_addr = section
            break
    print('Virtual Location:', hex(section_addr.VirtualAddress))
    keys = section_addr.get_data()[0:8]
    cipher_text = section_addr.get_data()[8:585]
    print('Key:', keys)
    print('Decrypting RC4 Encrypted configuration!')
    arc4_key = ARC4(keys)
    string_decrypt = arc4_key.decrypt(cipher_text)
    print(string_decrypt)


if __name__ == '__main__':
    main()

import pefile
from arc4 import ARC4


def main():
    pe = pefile.PE(
        'C:\\Users\\User\\Desktop\\Analysis\\Zero2Auto\\Lesson 3\\Loaders\\new_iced_dump.bin'
        )
    section_addr = None
    for section in pe.sections:
        if '.data' in section.Name.decode():
            section_addr = section
            break
    print('Virtual Location:', hex(section_addr.VirtualAddress))
    keys = section_addr.get_data()[0:8]
    cipher_text = section_addr.get_data()[8:585]
    print('Key:', keys)
    print('Decrypting RC4 Encrypted configuration!')
    arc4_key = ARC4(keys)
    string_decrypt = arc4_key.decrypt(cipher_text)
    print(string_decrypt)


if __name__ == '__main__':
    main()

import pefile
from arc4 import ARC4

def main():
	pe = pefile.PE(r"C:\Users\User\Desktop\Analysis\Zero2Auto\Lesson 3\Loaders\new_iced_dump.bin")
	section_addr = None

	for section in pe.sections:
		if(".data" in section.Name.decode()):
			section_addr = section
			break


	print("Virtual Location:", hex(section_addr.VirtualAddress))
	keys = section_addr.get_data()[0:8]
	cipher_text = section_addr.get_data()[8:585]

	print("Key:", keys)
	print("Decrypting RC4 Encrypted configuration!")


	arc4_key = ARC4(keys)

	string_decrypt = arc4_key.decrypt(cipher_text)

	print(string_decrypt)

if __name__ == "__main__":
	main()
