Forum Discussion
DFIR CTF: PCAP Challenge - Question 7
For the question
What is the XOR key used to encrypt the malware payload?
I am wondering about what I should be looking for in the WireShark, as I can't seem to find any indications of a specific key being used in the pcap file.
From the files extracted, I also did not notice any indications from the XML file as well.
Summary: I am basically super lost in where I should be digging deeper from.
The notes from when I did this say:
"First look at the silverlight file to work out what a normal exe file looks like and where the nulls are…
Then look at the two encrypted Bfl files - and see what text repeats…"
Followed by a screenshot that I can't share, as it will just give you the answer... ;-)
Basically, the issue is that when you XOR a file containing null values with a static key, the key ends up being repeated verbatim in the cipher text...
2 Replies
As per the screenshot I have also been scrolling for any abnormal scripts as well. but did not find any leads.
- autom8on
Ambassador
The notes from when I did this say:
"First look at the silverlight file to work out what a normal exe file looks like and where the nulls are…
Then look at the two encrypted Bfl files - and see what text repeats…"
Followed by a screenshot that I can't share, as it will just give you the answer... ;-)
Basically, the issue is that when you XOR a file containing null values with a static key, the key ends up being repeated verbatim in the cipher text...
