encodings_reference.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Pattern Recognition for Malware Analysts & Threat Hunters\n",
    "\n",
    "This reference page is intended to highlight a few common payload file headers when they are obfuscated with some typical encoding and encryption mechanisms. My hope is to show a comparison of them inline using identical data to help ingrain the patterns.\n",
    "\n",
    "This is inspired by c3rb3ru5d3d53c's [Deobfuscating Scripts](https://c3rb3ru5d3d53c.github.io/documents/deobfuscating-scripts/) and Florian's [base64 cheat sheet](https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639)\n",
    "\n",
    "If you can think of any other headers or encodings/encryptions one should train their eye to, submit a PR! \n",
    "\n",
    "## Executable Files\n",
    "\n",
    "### Clear Text\n",
    "```\n",
    "000000: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00  MZ..................\n",
    "000014: 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ....@...............\n",
    "000028: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ....................\n",
    "00003C: E8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68  ............!..L.!Th\n",
    "000050: 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65  is.program.cannot.be\n",
    "000064: 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A  .run.in.DOS.mode....\n",
    "000078: 24 00 00 00 00 00 00 00 79 E4 E5 17 3D 85 8B 44 3D 85 8B 44  $.......y...=..D=..D\n",
    "00008C: 3D 85 8B 44 34 FD 18 44 43 85 8B 44 3D 85 8A 44 75 83 8B 44  =..D4..DC..D=..Du..D\n",
    "0000A0: 89 19 64 44 1E 85 8B 44 89 19 78 44 37 85 8B 44 89 19 79 44  ..dD...D..xD7..D..yD\n",
    "0000B4: 2B 85 8B 44 89 19 7A 44 3A 85 8B 44 89 19 70 44 B5 84 8B 44  +..D..zD:..D..pD...D\n",
    "```\n",
    "\n",
    "### Base64\n",
    "```\n",
    "000000: 54 56 71 51 41 41 4D 41 41 41 41 45 41 41 41 41 2F 2F 38 41  TVqQAAMAAAAEAAAA//8A\n",
    "000014: 41 4C 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41  ALgAAAAAAAAAQAAAAAAA\n",
    "000028: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAAAAAA\n",
    "00003C: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAAAAAA\n",
    "000050: 36 41 41 41 41 41 34 66 75 67 34 41 74 41 6E 4E 49 62 67 42  6AAAAA4fug4AtAnNIbgB\n",
    "000064: 54 4D 30 68 56 47 68 70 63 79 42 77 63 6D 39 6E 63 6D 46 74  TM0hVGhpcyBwcm9ncmFt\n",
    "000078: 49 47 4E 68 62 6D 35 76 64 43 42 69 5A 53 42 79 64 57 34 67  IGNhbm5vdCBiZSBydW4g\n",
    "00008C: 61 57 34 67 52 45 39 54 49 47 31 76 5A 47 55 75 44 51 30 4B  aW4gRE9TIG1vZGUuDQ0K\n",
    "0000A0: 4A 41 41 41 41 41 41 41 41 41 42 35 35 4F 55 58 50 59 57 4C  JAAAAAAAAAB55OUXPYWL\n",
    "0000B4: 52 44 32 46 69 30 51 39 68 59 74 45 4E 50 30 59 52 45 4F 46  RD2Fi0Q9hYtENP0YREOF\n",
    "```\n",
    "### Double Base64'd \n",
    "```\n",
    "000000: 56 46 5A 78 55 55 46 42 54 55 46 42 51 55 46 46 51 55 46 42  VFZxUUFBTUFBQUFFQUFB\n",
    "000014: 51 53 38 76 4F 45 46 42 54 47 64 42 51 55 46 42 51 55 46 42  QS8vOEFBTGdBQUFBQUFB\n",
    "000028: 51 55 46 52 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42  QUFRQUFBQUFBQUFBQUFB\n",
    "00003C: 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42  QUFBQUFBQUFBQUFBQUFB\n",
    "000050: 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42  QUFBQUFBQUFBQUFBQUFB\n",
    "000064: 51 55 46 42 51 55 45 32 51 55 46 42 51 55 45 30 5A 6E 56 6E  QUFBQUE2QUFBQUE0ZnVn\n",
    "000078: 4E 45 46 30 51 57 35 4F 53 57 4A 6E 51 6C 52 4E 4D 47 68 57  NEF0QW5OSWJnQlRNMGhW\n",
    "00008C: 52 32 68 77 59 33 6C 43 64 32 4E 74 4F 57 35 6A 62 55 5A 30  R2hwY3lCd2NtOW5jbUZ0\n",
    "0000A0: 53 55 64 4F 61 47 4A 74 4E 58 5A 6B 51 30 4A 70 57 6C 4E 43  SUdOaGJtNXZkQ0JpWlNC\n",
    "0000B4: 65 57 52 58 4E 47 64 68 56 7A 52 6E 55 6B 55 35 56 45 6C 48  eWRXNGdhVzRnUkU5VElH\n",
    "```\n",
    "\n",
    "### XOR with 1 Byte\n",
    "```\n",
    "000000: 57 40 8A 1A 19 1A 1A 1A 1E 1A 1A 1A E5 E5 1A 1A A2 1A 1A 1A  W@..................\n",
    "000014: 1A 1A 1A 1A 5A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A  ....Z...............\n",
    "000028: 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A  ....................\n",
    "00003C: F2 1A 1A 1A 14 05 A0 14 1A AE 13 D7 3B A2 1B 56 D7 3B 4E 72  ............;..V.;Nr\n",
    "000050: 73 69 3A 6A 68 75 7D 68 7B 77 3A 79 7B 74 74 75 6E 3A 78 7F  si:jhu}h{w:y{ttun:x.\n",
    "000064: 3A 68 6F 74 3A 73 74 3A 5E 55 49 3A 77 75 7E 7F 34 17 17 10  :hot:st:^UI:wu~.4...\n",
    "000078: 3E 1A 1A 1A 1A 1A 1A 1A 63 FE FF 0D 27 9F 91 5E 27 9F 91 5E  >.......c...'..^'..^\n",
    "00008C: 27 9F 91 5E 2E E7 02 5E 59 9F 91 5E 27 9F 90 5E 6F 99 91 5E  '..^...^Y..^'..^o..^\n",
    "0000A0: 93 03 7E 5E 04 9F 91 5E 93 03 62 5E 2D 9F 91 5E 93 03 63 5E  ..~^...^..b^-..^..c^\n",
    "0000B4: 31 9F 91 5E 93 03 60 5E 20 9F 91 5E 93 03 6A 5E AF 9E 91 5E  1..^..`^...^..j^...^\n",
    "```\n",
    "### XOR with Different Byte\n",
    "Notice the byte repetition! \n",
    "```\n",
    "000000: F6 E1 2B BB B8 BB BB BB BF BB BB BB 44 44 BB BB 03 BB BB BB  ..+.........DD......\n",
    "000014: BB BB BB BB FB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB  ....................\n",
    "000028: BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB BB  ....................\n",
    "00003C: 53 BB BB BB B5 A4 01 B5 BB 0F B2 76 9A 03 BA F7 76 9A EF D3  S..........v....v...\n",
    "000050: D2 C8 9B CB C9 D4 DC C9 DA D6 9B D8 DA D5 D5 D4 CF 9B D9 DE  ....................\n",
    "000064: 9B C9 CE D5 9B D2 D5 9B FF F4 E8 9B D6 D4 DF DE 95 B6 B6 B1  ....................\n",
    "000078: 9F BB BB BB BB BB BB BB C2 5F 5E AC 86 3E 30 FF 86 3E 30 FF  ........._^..>0..>0.\n",
    "00008C: 86 3E 30 FF 8F 46 A3 FF F8 3E 30 FF 86 3E 31 FF CE 38 30 FF  .>0..F...>0..>1..80.\n",
    "0000A0: 32 A2 DF FF A5 3E 30 FF 32 A2 C3 FF 8C 3E 30 FF 32 A2 C2 FF  2....>0.2....>0.2...\n",
    "0000B4: 90 3E 30 FF 32 A2 C1 FF 81 3E 30 FF 32 A2 CB FF 0E 3F 30 FF  .>0.2....>0.2....?0.\n",
    "```\n",
    "### 2 Byte XOR (0xABCD)\n",
    "```\n",
    "0000000: E6 97 3B CD A8 CD AB CD AF CD AB CD 54 32 AB CD 13 CD AB CD  ..;.........T2......\n",
    "0000014: AB CD AB CD EB CD AB CD AB CD AB CD AB CD AB CD AB CD AB CD  ....................\n",
    "0000028: AB CD AB CD AB CD AB CD AB CD AB CD AB CD AB CD AB CD AB CD  ....................\n",
    "000003C: 43 CD AB CD A5 D2 11 C3 AB 79 A2 00 8A 75 AA 81 66 EC FF A5  C........y...u..f...\n",
    "0000050: C2 BE 8B BD D9 A2 CC BF CA A0 8B AE CA A3 C5 A2 DF ED C9 A8  ....................\n",
    "0000064: 8B BF DE A3 8B A4 C5 ED EF 82 F8 ED C6 A2 CF A8 85 C0 A6 C7  ....................\n",
    "0000078: 8F CD AB CD AB CD AB CD D2 29 4E DA 96 48 20 89 96 48 20 89  .........)N..H...H..\n",
    "000008C: 96 48 20 89 9F 30 B3 89 E8 48 20 89 96 48 21 89 DE 4E 20 89  .H...0...H...H!..N..\n",
    "00000A0: 22 D4 CF 89 B5 48 20 89 22 D4 D3 89 9C 48 20 89 22 D4 D2 89  \"....H..\"....H..\"...\n",
    "00000B4: 80 48 20 89 22 D4 D1 89 91 48 20 89 22 D4 DB 89 1E 49 20 89  .H..\"....H..\"....I..\n",
    "```\n",
    "### XOR with Key 'YARA'\n",
    "```\n",
    "000000: 14 1B C2 41 5A 41 52 41 5D 41 52 41 A6 BE 52 41 E1 41 52 41  ...AZARA]ARA..RA.ARA\n",
    "000014: 59 41 52 41 19 41 52 41 59 41 52 41 59 41 52 41 59 41 52 41  YARA.ARAYARAYARAYARA\n",
    "000028: 59 41 52 41 59 41 52 41 59 41 52 41 59 41 52 41 59 41 52 41  YARAYARAYARAYARAYARA\n",
    "00003C: B1 41 52 41 57 5E E8 4F 59 F5 5B 8C 78 F9 53 0D 94 60 06 29  .ARAW^.OY.[.x.S..`.)\n",
    "000050: 30 32 72 31 2B 2E 35 33 38 2C 72 22 38 2F 3C 2E 2D 61 30 24  02r1+.538,r\"8/<.-a0$\n",
    "000064: 79 33 27 2F 79 28 3C 61 1D 0E 01 61 34 2E 36 24 77 4C 5F 4B  y3'/y(<a...a4.6$wL_K\n",
    "000078: 7D 41 52 41 59 41 52 41 20 A5 B7 56 64 C4 D9 05 64 C4 D9 05  }ARAYARA...Vd...d...\n",
    "00008C: 64 C4 D9 05 6D BC 4A 05 1A C4 D9 05 64 C4 D8 05 2C C2 D9 05  d...m.J.....d...,...\n",
    "0000A0: D0 58 36 05 47 C4 D9 05 D0 58 2A 05 6E C4 D9 05 D0 58 2B 05  .X6.G....X*.n....X+.\n",
    "0000B4: 72 C4 D9 05 D0 58 28 05 63 C4 D9 05 D0 58 22 05 EC C5 D9 05  r....X(.c....X\".....\n",
    "```\n",
    "\n",
    "### Hex Encoded\n",
    "```\n",
    "000000: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30  4D5A9000030000000400\n",
    "000014: 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30  0000FFFF0000B8000000\n",
    "000028: 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30  00000000400000000000\n",
    "00003C: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30  00000000000000000000\n",
    "000050: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30  00000000000000000000\n",
    "000064: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30  00000000000000000000\n",
    "000078: 45 38 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34  E80000000E1FBA0E00B4\n",
    "00008C: 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38  09CD21B8014CCD215468\n",
    "0000A0: 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44  69732070726F6772616D\n",
    "0000B4: 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35  2063616E6E6F74206265\n",
    "\n",
    "```\n",
    "### ROT13\n",
    "```\n",
    "000000: 5A 4D 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00  ZM..................\n",
    "000014: 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ....@...............\n",
    "000028: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ....................\n",
    "00003C: E8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 59 CD 21 47 75  ............!..Y.!Gu\n",
    "000050: 76 66 20 63 65 62 74 65 6E 7A 20 70 6E 61 61 62 67 20 6F 72  vf.cebtenz.pnaabg.or\n",
    "000064: 20 65 68 61 20 76 61 20 51 42 46 20 7A 62 71 72 2E 0D 0D 0A  .eha.va.QBF.zbqr....\n",
    "000078: 24 00 00 00 00 00 00 00 6C E4 E5 17 3D 85 8B 51 3D 85 8B 51  $.......l...=..Q=..Q\n",
    "00008C: 3D 85 8B 51 34 FD 18 51 50 85 8B 51 3D 85 8A 51 68 83 8B 51  =..Q4..QP..Q=..Qh..Q\n",
    "0000A0: 89 19 71 51 1E 85 8B 51 89 19 6B 51 37 85 8B 51 89 19 6C 51  ..qQ...Q..kQ7..Q..lQ\n",
    "0000B4: 2B 85 8B 51 89 19 6D 51 3A 85 8B 51 89 19 63 51 B5 84 8B 51  +..Q..mQ:..Q..cQ...Q\n",
    "```\n",
    "\n",
    "### Encrypted with RC4 (key == 0x1) No noticable pattern!\n",
    "```\n",
    "000000: 49 2E B7 88 AA 23 C1 85 86 E2 4E 36 DC 4D 9C E9 6E BE D8 84  I....#....N6.M..n...\n",
    "000014: 80 98 EF 5E 7C FA 59 AC 1B EE 58 62 C4 BA 05 9E AD A3 5F 8E  ...^|.Y...Xb......_.\n",
    "000028: 8B 94 0F DC B3 FB D0 B9 A0 60 85 15 CD 47 B8 DE 4C 1D CB AF  .........`...G..L...\n",
    "00003C: A3 70 A3 43 D3 B5 B8 72 1B 46 08 14 77 B7 C5 87 C4 EE 8F 0C  .p.C...r.F..w.......\n",
    "000050: 53 57 09 4F 43 E5 11 CE 7D D0 73 49 26 01 14 9D 33 31 62 F9  SW.OC...}.sI&...31b.\n",
    "000064: 82 CB 2F 15 13 63 B4 5E F1 92 79 8B BE 98 A9 E1 E8 64 25 D3  ../..c.^..y......d%.\n",
    "000078: 96 6D 96 A9 4A 7C 03 54 50 91 E3 1A B5 06 FE 35 F6 68 24 FC  .m..J|.TP......5.h$.\n",
    "00008C: 0B 95 4D 0F B9 B6 B1 1F 24 95 8C CA C4 0B F6 94 FF 14 60 38  ..M.....$.........`8\n",
    "0000A0: 52 43 E7 75 1C 7F 59 E3 9F 73 1C FA 6C 59 27 9B A0 66 30 12  RC.u..Y..s..lY'..f0.\n",
    "0000B4: BA 57 10 6E 67 73 27 88 25 81 1C 95 B2 BE 57 88 A9 C2 5C E9  .W.ngs'.%.....W...\\.\n",
    "```\n",
    "### Encrypted with RC4 (key == a) Again; no noticable pattern!\n",
    "```\n",
    "000000: 5D E6 08 1E 41 D9 85 4B 2A 6D AD 27 A3 E3 C5 CB E4 6E 89 D7  ]...A..K*m.'.....n..\n",
    "000014: 51 C2 4C 7C 27 35 A4 29 7A B8 BC B8 F2 32 EA 94 C0 51 77 14  Q.L|'5.)z....2...Qw.\n",
    "000028: 8D BD 2E AD 87 52 25 7D D5 79 1F 8D 3D D1 01 BD 59 D3 CA D7  .....R%}.y..=...Y...\n",
    "00003C: E5 87 7E 7B E8 91 F5 04 F6 03 E3 A6 AF F4 E3 88 E4 23 F5 73  ..~{.............#.s\n",
    "000050: 82 EE 4D AA DA 8D 72 F2 E9 CF 23 BB 02 75 CE D7 92 56 07 21  ..M...r...#..u...V.!\n",
    "000064: B8 19 EE 01 50 3D 85 91 2C 12 73 0A 3E FD CF 01 52 AC A3 A8  ....P=..,.s.>...R...\n",
    "000078: DC 6F 7E 3D 43 ED 01 D6 1E CD FC 2C 32 3D FE FD 90 38 A6 8B  .o~=C......,2=...8..\n",
    "00008C: CA D6 60 C4 6D 2C 88 FA E7 68 B6 61 B2 67 20 FC EE 61 97 26  ..`.m,...h.a.g...a.&\n",
    "0000A0: 81 88 94 40 F3 03 35 CF A8 FD 29 93 51 8B F7 9F 2C 85 C6 8F  ...@..5...).Q...,...\n",
    "0000B4: 6E 7C 16 72 01 E7 00 B1 FC 66 47 A0 5E 4F FA 0D 3C EA A3 59  n|.r.....fG.^O..<..Y\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Shellcode\n",
    "\n",
    "via [nviso](https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/)\n",
    "\n",
    "note the FC E8 starting bytes (e8 is used in assembly to call a relative address )\n",
    "\n",
    "\n",
    "### Clear Text\n",
    "```\n",
    "000: FC E8 82 00 00 00 60 89 E5 31 C0 64 8B 50 30 8B 52 0C 8B 52  ......`..1.d.P0.R..R\n",
    "014: 14 8B 72 28 0F B7 4A 26 31 FF AC 3C 61 7C 02 2C 20 C1 CF 0D  ..r(..J&1..<a|.,....\n",
    "028: 01 C7 E2 F2 52 57 8B 52 10 8B 4A 3C 8B 4C 11 78 E3 48 01 D1  ....RW.R..J<.L.x.H..\n",
    "03C: 51 8B 59 20 01 D3 8B 49 18 E3 3A 49 8B 34 8B 01 D6 31 FF AC  Q.Y....I..:I.4...1..\n",
    "050: C1 CF 0D 01 C7 38 E0 75 F6 03 7D F8 3B 7D 24 75 E4 58 8B 58  .....8.u..}.;}$u.X.X\n",
    "064: 24 01 D3 66 8B 0C 4B 8B 58 1C 01 D3 8B 04 8B 01 D0 89 44 24  $..f..K.X.........D$\n",
    "078: 24 5B 5B 61 59 5A 51 FF E0 5F 5F 5A 8B 12 EB 8D 5D 68 33 32  $[[aYZQ..__Z....]h32\n",
    "08C: 00 00 68 77 73 32 5F 54 68 4C 77 26 07 FF D5 B8 90 01 00 00  ..hws2_ThLw&........\n",
    "0A0: 29 C4 54 50 68 29 80 6B 00 FF D5 50 50 50 50 40 50 40 50 68  ).TPh).k...PPPP@P@Ph\n",
    "0B4: EA 0F DF E0 FF D5 97 6A 05 68 C0 A8 01 CA 68 02 00 11 5C 89  .......j.h....h...\\.\n",
    "```\n",
    "\n",
    "### Base64\n",
    "```\n",
    "000: 2F 4F 69 43 41 41 41 41 59 49 6E 6C 4D 63 42 6B 69 31 41 77  /OiCAAAAYInlMcBki1Aw\n",
    "014: 69 31 49 4D 69 31 49 55 69 33 49 6F 44 37 64 4B 4A 6A 48 2F  i1IMi1IUi3IoD7dKJjH/\n",
    "028: 72 44 78 68 66 41 49 73 49 4D 48 50 44 51 48 48 34 76 4A 53  rDxhfAIsIMHPDQHH4vJS\n",
    "03C: 56 34 74 53 45 49 74 4B 50 49 74 4D 45 58 6A 6A 53 41 48 52  V4tSEItKPItMEXjjSAHR\n",
    "050: 55 59 74 5A 49 41 48 54 69 30 6B 59 34 7A 70 4A 69 7A 53 4C  UYtZIAHTi0kY4zpJizSL\n",
    "064: 41 64 59 78 2F 36 7A 42 7A 77 30 42 78 7A 6A 67 64 66 59 44  AdYx/6zBzw0BxzjgdfYD\n",
    "078: 66 66 67 37 66 53 52 31 35 46 69 4C 57 43 51 42 30 32 61 4C  ffg7fSR15FiLWCQB02aL\n",
    "08C: 44 45 75 4C 57 42 77 42 30 34 73 45 69 77 48 51 69 55 51 6B  DEuLWBwB04sEiwHQiUQk\n",
    "0A0: 4A 46 74 62 59 56 6C 61 55 66 2F 67 58 31 39 61 69 78 4C 72  JFtbYVlaUf/gX19aixLr\n",
    "0B4: 6A 56 31 6F 4D 7A 49 41 41 47 68 33 63 7A 4A 66 56 47 68 4D  jV1oMzIAAGh3czJfVGhM\n",
    "```\n",
    "\n",
    "### XOR with 1 Byte (0xDD)\n",
    "```\n",
    "000: 21 35 5F DD DD DD BD 54 38 EC 1D B9 56 8D ED 56 8F D1 56 8F  !5_....T8...V..V..V.\n",
    "014: C9 56 AF F5 D2 6A 97 FB EC 22 71 E1 BC A1 DF F1 FD 1C 12 D0  .V...j...\"q.........\n",
    "028: DC 1A 3F 2F 8F 8A 56 8F CD 56 97 E1 56 91 CC A5 3E 95 DC 0C  ..?/..V..V..V...>...\n",
    "03C: 8C 56 84 FD DC 0E 56 94 C5 3E E7 94 56 E9 56 DC 0B EC 22 71  .V....V..>..V.V...\"q\n",
    "050: 1C 12 D0 DC 1A E5 3D A8 2B DE A0 25 E6 A0 F9 A8 39 85 56 85  ......=.+..%....9.V.\n",
    "064: F9 DC 0E BB 56 D1 96 56 85 C1 DC 0E 56 D9 56 DC 0D 54 99 F9  ....V..V....V.V..T..\n",
    "078: F9 86 86 BC 84 87 8C 22 3D 82 82 87 56 CF 36 50 80 B5 EE EF  .......\"=...V.6P....\n",
    "08C: DD DD B5 AA AE EF 82 89 B5 91 AA FB DA 22 08 65 4D DC DD DD  .............\".eM...\n",
    "0A0: F4 19 89 8D B5 F4 5D B6 DD 22 08 8D 8D 8D 8D 9D 8D 9D 8D B5  ......]..\"..........\n",
    "0B4: 37 D2 02 3D 22 08 4A B7 D8 B5 1D 75 DC 17 B5 DF DD CC 81 54  7..=\".J....u.......T\n",
    "```\n",
    "### XOR with Key 'GREG'\n",
    "```\n",
    "000: BB BA C7 47 47 52 25 CE A2 63 85 23 CC 02 75 CC 15 5E CE 15  ...GGR%..c.#..u..^..\n",
    "014: 53 D9 37 6F 48 E5 0F 61 76 AD E9 7B 26 2E 47 6B 67 93 8A 4A  S.7oH..av..{&.Gkg..J\n",
    "028: 46 95 A7 B5 15 05 CE 15 57 D9 0F 7B CC 1E 54 3F A4 1A 44 96  F.......W..{..T?..D.\n",
    "03C: 16 D9 1C 67 46 81 CE 0E 5F B1 7F 0E CC 66 CE 46 91 63 BA EB  ...gF..._....f.F.c..\n",
    "050: 86 9D 48 46 80 6A A5 32 B1 51 38 BF 7C 2F 61 32 A3 0A CE 1F  ..HF.j.2.Q8.|/a2....\n",
    "064: 63 53 96 21 CC 5E 0E CC 1F 4E 44 94 CC 56 CE 46 97 DB 01 63  cS.!.^...ND..V.F...c\n",
    "078: 63 09 1E 26 1E 08 14 B8 A7 0D 1A 1D CC 40 AE CA 1A 3A 76 75  c..&.........@...:vu\n",
    "08C: 47 52 2D 30 34 60 1A 13 2F 1E 32 61 40 AD 90 FF D7 53 45 47  GR-04`../.2a@....SEG\n",
    "0A0: 6E 96 11 17 2F 7B C5 2C 47 AD 90 17 17 02 15 07 17 12 15 2F  n.../{.,G........../\n",
    "0B4: AD 5D 9A A7 B8 87 D2 2D 42 3A 85 EF 46 98 2D 45 47 43 19 CE  .].....-B:..F.-EGC..\n",
    "```\n",
    "\n",
    "### Hex Encoded\n",
    "```\n",
    "000: 46 43 45 38 38 32 30 30 30 30 30 30 36 30 38 39 45 35 33 31  FCE8820000006089E531\n",
    "014: 43 30 36 34 38 42 35 30 33 30 38 42 35 32 30 43 38 42 35 32  C0648B50308B520C8B52\n",
    "028: 31 34 38 42 37 32 32 38 30 46 42 37 34 41 32 36 33 31 46 46  148B72280FB74A2631FF\n",
    "03C: 41 43 33 43 36 31 37 43 30 32 32 43 32 30 43 31 43 46 30 44  AC3C617C022C20C1CF0D\n",
    "050: 30 31 43 37 45 32 46 32 35 32 35 37 38 42 35 32 31 30 38 42  01C7E2F252578B52108B\n",
    "064: 34 41 33 43 38 42 34 43 31 31 37 38 45 33 34 38 30 31 44 31  4A3C8B4C1178E34801D1\n",
    "078: 35 31 38 42 35 39 32 30 30 31 44 33 38 42 34 39 31 38 45 33  518B592001D38B4918E3\n",
    "08C: 33 41 34 39 38 42 33 34 38 42 30 31 44 36 33 31 46 46 41 43  3A498B348B01D631FFAC\n",
    "0A0: 43 31 43 46 30 44 30 31 43 37 33 38 45 30 37 35 46 36 30 33  C1CF0D01C738E075F603\n",
    "0B4: 37 44 46 38 33 42 37 44 32 34 37 35 45 34 35 38 38 42 35 38  7DF83B7D2475E4588B58\n",
    "```\n",
    "\n",
    "### ROT13\n",
    "```\n",
    "000: FC E8 82 00 00 00 60 89 E5 31 C0 71 8B 43 30 8B 45 0C 8B 45  ......`..1.q.C0.E..E\n",
    "014: 14 8B 65 28 0F B7 57 26 31 FF AC 3C 6E 7C 02 2C 20 C1 CF 0D  ..e(..W&1..<n|.,....\n",
    "028: 01 C7 E2 F2 45 4A 8B 45 10 8B 57 3C 8B 59 11 6B E3 55 01 D1  ....EJ.E..W<.Y.k.U..\n",
    "03C: 44 8B 4C 20 01 D3 8B 56 18 E3 3A 56 8B 34 8B 01 D6 31 FF AC  D.L....V..:V.4...1..\n",
    "050: C1 CF 0D 01 C7 38 E0 68 F6 03 7D F8 3B 7D 24 68 E4 4B 8B 4B  .....8.h..}.;}$h.K.K\n",
    "064: 24 01 D3 73 8B 0C 58 8B 4B 1C 01 D3 8B 04 8B 01 D0 89 51 24  $..s..X.K.........Q$\n",
    "078: 24 5B 5B 6E 4C 4D 44 FF E0 5F 5F 4D 8B 12 EB 8D 5D 75 33 32  $[[nLMD..__M....]u32\n",
    "08C: 00 00 75 6A 66 32 5F 47 75 59 6A 26 07 FF D5 B8 90 01 00 00  ..ujf2_GuYj&........\n",
    "0A0: 29 C4 47 43 75 29 80 78 00 FF D5 43 43 43 43 40 43 40 43 75  ).GCu).x...CCCC@C@Cu\n",
    "0B4: EA 0F DF E0 FF D5 97 77 05 75 C0 A8 01 CA 75 02 00 11 5C 89  .......w.u....u...\\.\n",
    "```\n",
    "\n",
    "### Encrypted with RC4 (key == msf)\n",
    "```\n",
    "000: 19 25 3D 84 12 49 BB 71 88 FD C7 E1 F2 4B 33 BA A1 DA C4 52  .%=..I.q.....K3....R\n",
    "014: 7E C1 18 3E E2 C1 D2 FB 4E 8B B9 71 C1 EE 7E 5F 2F 33 8A 4A  ~..>....N..q..~_/3.J\n",
    "028: 0D 03 76 91 3A 7B 52 BA 8C 7C 20 49 D4 9B 80 9D 37 50 E9 DB  ..v.:{R..|.I....7P..\n",
    "03C: 5D D6 1B F8 87 B1 1C FB 8C 63 CE 67 AC 15 32 75 3D 95 83 F5  ]........c.g..2u=...\n",
    "050: 7C 97 7F F0 07 E8 46 D8 7C 6B 2D D8 3B D4 3B A7 A9 76 53 5A  |.....F.|k-.;.;..vSZ\n",
    "064: 35 D9 B6 08 16 25 45 54 E3 FE E8 49 38 7F 9A 77 E9 68 43 39  5....%ET...I8..w.hC9\n",
    "078: 12 44 01 05 59 97 4A 69 91 E2 28 B5 31 96 D4 79 1F 17 81 8F  .D..Y.Ji..(.1..y....\n",
    "08C: 66 FB A9 71 75 5F FA E8 35 11 72 9D A8 A9 EA 6F EF 37 C2 11  f..qu_..5.r....o.7..\n",
    "0A0: 5D 58 D5 D1 FB 32 EA B7 62 2A 0E 9E D1 55 7A 33 7D 74 E3 54  ]X...2..b*...Uz3}t.T\n",
    "0B4: 20 1F 3D 54 0E 4D 79 46 17 FC E5 97 27 C2 9A 23 60 AB C1 EC  ..=T.MyF....'..#`...\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": []
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "31f2aee4e71d21fbe5cf8b01ff0e069b9275f58929596ceb00d14d90e3e16cd6"
  },
  "kernelspec": {
   "display_name": "Python 3.8.9 64-bit",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.9"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}