#can you decompile an application?

192 messages · Page 1 of 1 (latest)

paper spoke
#

trying to decompile an application file my friend sent me haha

cosmic marsh
#

You can, but you'll first have to figure out what kind of an application it is

#

PEiD or Detect-It-Easy for analysis to start off

#

@paper spoke And for the love of god, don't download the executable on a system it can run on

paper spoke
cosmic marsh
#

Don't download it on a Windows machine, if it's a Windows executable

#

That is how you get viruses and accounts stolen

paper spoke
#

What should i download it on?

cosmic marsh
#

Linux VM for example

paper spoke
cosmic marsh
#

That works

paper spoke
cosmic marsh
#

Analyze it using PEiD or Detect-It-Easy

#

And, no need to ping me every single time

paper spoke
#

oops sorry

#

i'll do that right now

cosmic marsh
paper spoke
#

how do i unzip that on kali linux?

#

it's so strange.

cosmic marsh
#

Which one did you download?

paper spoke
#

i pressed the code and downloaded the ZIP file

#

was that wrong

cosmic marsh
#

You're gonna have to build it yourself in that case

paper spoke
#

what should i do now that i'm on that page?

cosmic marsh
#

Kali is based on Debian

#

So follow the Debian instructions

paper spoke
#

the "how to build on linux based on debian"?

cosmic marsh
#

Is there anything else on that page that mentions Debian?

paper spoke
#

haha no

#

i'll do the instructions right now thank you

#

how do i fix this? if possible

cosmic marsh
#

Maybe try running the actual command that comes after the :?

paper spoke
cosmic marsh
#

bash -x build_dpkg.sh

paper spoke
#

there we go!

#

how did you fix that?

cosmic marsh
#

Fix what?

paper spoke
#

i'm so confused, lol.

cosmic marsh
#

You copypasted WAY more than the command that you needed to

paper spoke
#

oh i just pasted in the exact command it said

cosmic marsh
#

What you tried to use as a command: Run build script: bash -x build_dpkg.sh

What the actual command is: bash -x build_dpkg.sh

paper spoke
#

OH!

#

i'm an idiot hahahah

#

no wonder it didnt work!

cosmic marsh
#

Also

#

Wanted to ask

#

Your friend just randomly sent you an executable file?

#

With no message along with it?

paper spoke
#

He wanted to show me something lol.

#

Online friend so obviously it was weird

cosmic marsh
#

Yeah, that's a virus 100%

paper spoke
#

I opened the file in notebook++ and it was weird as hell

cosmic marsh
#

Yeah, Notepad++ can not read binary

paper spoke
#

Oh

cosmic marsh
#

You can't open any executable with NP++

paper spoke
#

let me get a screenshot

#

it was WEIRd

cosmic marsh
#

It shows every single executable as a garbled mess of random characters

paper spoke
cosmic marsh
#

Yeah, that's entirely normal for an executable

#

Notepad++ is a text editor

paper spoke
#

Oh I thought it was weird

cosmic marsh
#

You can't use it to view any data

paper spoke
#

So it’s useless?

cosmic marsh
#

Try to open literally any executable with Notepad and you'll have that same thing

paper spoke
#

I see

#

I’ll be back in a few minutes thank you for helping

cosmic marsh
#

It's like trying to open an image with a text editor

#

It's not going to work

paper spoke
#

Yeah

cosmic marsh
#

Also

Did the "friend" send a message like

"Test out my game" with the random executable?

paper spoke
cosmic marsh
#

Yeah, you don' goofed up when you downloaded it on Windows

#

That is a token stealer KEKW

#

It's a virus from your "friend" who got their account grabbed by similar virus

paper spoke
#

windows virus protection gave me a warning

#

and it didn't open

cosmic marsh
#

Yeah, cause it is a literal virus

paper spoke
#

yes

cosmic marsh
#

I've seen dozens of those

#

They're all packed token stealers

#

No point in trying to disassemble it

paper spoke
#

i just wanna see what's inside for my curiosity

cosmic marsh
#

I'm gonna be brutally honest here, then

#

I feel like you don't have the skillset or patience to do that

paper spoke
paper spoke
cosmic marsh
#

They're packed using UPX or similar packers

#

Those require serious reverse engineering skills, and there are no tools that can do it with a press of a button

#

You have to manually analyze and reverse engineer the files

#

Replace the [Version] with the filename you got after the other steps

#

Or the die_[Version].deb

#

Should be in the folder release

paper spoke
cosmic marsh
#

Name of the Detect-It-Easy deb file you just created using the other steps

paper spoke
#

ah

cosmic marsh
#

As I said, that should be in the release folder you have

#

That folder should be in another folder named DIE-engine

paper spoke
#

"sudo dpkg -i release/die_[die_3.08_Kali_2022.4_amd64].deb"?

#

or should i get rid of the []

cosmic marsh
#

What is the filename you have?

#

Is it: die_[die_3.08_Kali_2022.4_amd64].deb

paper spoke
#

oops

cosmic marsh
#

Or die_die_3.08_Kali_2022.4_amd64.deb?

paper spoke
#

die_3.08_Kali_2022.4_amd64.deb

cosmic marsh
#

Then you replace the die_[Version].deb with that

paper spoke
#

okay, it ran the command

cosmic marsh
#

Now you find the executable file

#

And hit "scan" after that

paper spoke
#

the executable is a .rar (i needed to extract it to turn it into an executable)

cosmic marsh
#

Then you extract it and find the .exe file

paper spoke
#

kali linux just pops up saying this when i try

#

"could not open"

#

"archive type not supported"

#

okay, i have it as an exe

#

i just used an online converter, lol.

cosmic marsh
#

"converter"?

#

So you didn't extract the file?

#

Dude, I'm gonna be honest

paper spoke
#

no..?

#

am i just an idiot

cosmic marsh
#

If simple things like this are causing you this much trouble

#

You will not be able to reverse engineer the executable

#

No way

#

And I'm not paid enough, or have enough time to walk you through that entire process

paper spoke
#

you're paid here?

cosmic marsh
#

I'm not

paper spoke
#

okay

#

i'm just extracting it online now

cosmic marsh
#

I feel like this would go much easier if you gave me the link to the executable

paper spoke
#

okay

#

link? or file

cosmic marsh
#

You'd have to copy the download link for the file from the original message

paper spoke
#

okay i'll find it now

cosmic marsh
#

Right-click the file in the messages, and press "Copy Link" button

#

Paste that here

#

I'll nuke the message once I got it copied

paper spoke
#

that?

cosmic marsh
#

Yup

paper spoke
#

okay

cosmic marsh
#

Whoops

#

Could you paste that here again?

#

Was too quick with the link

#

Didn't get it into my VM

paper spoke
#

Yeah

#

@cosmic marsh !

#

sorry for the ping haha

cosmic marsh
#

Thanks

paper spoke
#

Be right back

paper spoke
#

That was longer than expected

paper spoke
cosmic marsh
#

Building Detect It Easy rn

paper spoke
cosmic marsh
#

Decompiling atm

cosmic marsh
#

It's a fancy cookie grabber

#

Lol, well

#

It's a pasta token stealer from github

#

"woooo"

#

Not gonna link the source here

#

@paper spoke Gonna decompile and nuke the webhook from that stealer

paper spoke
#

Just woke up haha

cosmic marsh
#

I'm not gonna give you the source code

cosmic marsh
paper spoke
paper spoke
cosmic marsh
#

It's a token stealer

#

A malware

paper spoke
#

For discord?

cosmic marsh
#

It rips your browser passwords/cookies/tokens, and Discord tokens

#

And sends them to a Discord server, using a webhook

paper spoke
#

Oh

cosmic marsh
#

And, there's no way I'm giving someone the source codes for a malware

#

I have zero idea how you're going to use them, no matter what you tell me about it, so I'm not gonna do it

#

I don't know your motives, but wanting to disassemble a virus this desperately to "see what's inside it" very heavily implies that you want to use the code yourself to create your own malware

paper spoke
#

Ohhh

#

I didn’t even know it was malware lol

#

Okie dokie

cosmic marsh
#

What did you think it was after I literally told you it was malware multiple times?

paper spoke
#

Before I created this thread I mean

cosmic marsh
#

Ain't nobody gonna send you random executables with a "Hey I made this, check it out" message along with them if it isn't a virus

#

That is literally one of the most known ways to spread malware on Discord

paper spoke
#

True ig

cosmic marsh
#

I'm not sure what you expected it to be other than malware

#

Especially after your Windows Defender blocked it?

#

I mean, if you want all your accounts stolen, feel free to download the file again, make an exception for it through your antivirus, and run it if you don't think it's malware Shrug

#

Or toss it into any.run or VirusTotal, or any other sandboxing service to see that it's a malware

#

You wouldn't click suspicious links either, yeah?
Why would you download suspicious executables that randomly get sent to you with literally zero information?