Forum Discussion
Solved
DFIR CTF: PCAP Challenge - Question 7
For the question What is the XOR key used to encrypt the malware payload? I am wondering about what I should be looking for in the WireShark, as I can't seem to find any indications of a specific ...
The notes from when I did this say:
"First look at the silverlight file to work out what a normal exe file looks like and where the nulls are…
Then look at the two encrypted Bfl files - and see what text repeats…"
Followed by a screenshot that I can't share, as it will just give you the answer... ;-)
Basically, the issue is that when you XOR a file containing null values with a static key, the key ends up being repeated verbatim in the cipher text...
As per the screenshot I have also been scrolling for any abnormal scripts as well. but did not find any leads.
