Skip to content

Commit

Permalink
added : readme instructions for web cursed deobfuscator
Browse files Browse the repository at this point in the history
  • Loading branch information
thomas-pommier-epi committed Oct 10, 2023
1 parent 3aaa6c0 commit c19d88f
Showing 1 changed file with 17 additions and 6 deletions.
23 changes: 17 additions & 6 deletions cursed/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,24 +12,35 @@ The password is : reversemalware

We distribute this for education purposes only, by demonstrating our tools for deobfuscating this malware.

## How to test the deobfuscator ?
## How to test the deobfuscators ?

There are 2 deobfuscators, one for **index.js** (deobfuscator) and the other for **index.html** (deobfuscator-html).
Here are the instructions to run them:

Go to the **bin** directory and unzip:
```sh
cd bin && unzip cursed.zip
```

\
Go to the **deobfuscator** directory:
```sh
cd ../deobfuscator
```

Install the NPM Packages (**nodejs** and **npm** should be already installed on your system):
**OR** if you want to test the **index.html deobfuscator**:
```sh
cd ../deobfuscator-html
```
\
Install the dependencies via NPM Packages (**nodejs** and **npm** should be already installed on your system):
```sh
npm i
```

Execute **ast.js**, it will output the deobfuscated version of the malware as **"./output/index_deob.js"** :
\
Execute **ast.js** to deobfuscate **index.js**, it will output the deobfuscated version of the malware as **"./output/index_deob.js"** :
```sh
node ast.js ../bin/index.js
```
**OR** for **index.html** in the **deobfuscator-html** directory:
```sh
node ast.js ../bin/index.html
```

0 comments on commit c19d88f

Please sign in to comment.