Fished Decoding these 1 at a time. Interesting strings for sandbox checks

I think my tool got it right. (Still a work in progress) It is just like all of those document links that download the rtf's with the Shellcode I wrote about here. inquest.net/blog/2022/08/29/… There are a constant change of urls but they are abuse the "@" function.

Ok i can't help myself 🤷‍♂️

@1ZRR4H @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @James_inthe_box @pr0xylife @0xToxin @ankit_anubhav

I finally got back to messing with this and whipped up a string decder. What is this array of urls for...? 🤨 (that was the first thing I checked the decoder with. Still looking)

Oh that didn't sink in what you were talking about 🤦‍♂️

This is going to take a few minuets to understand the multiple addition and subtraction in this decode function.

I was able to get the file to download.

oops forgot the screenshot. Apparently I could not let vb. net interpret the large values "From string" automatically. I had to specify it as a ULong.