Finding solution for obfuscated SWF(flash) files.

[Manish Sardiwal]

Hello

I am a analyst working on SWF files. I want to analyse some samples of swf files which is obfuscated with the popular Doswf obfuscator.

I have no idea how to deobfuscate that kind of files and find actual file out of them.

I want to know about this obfuscation detection and analysis.

Thank you.

[Emiliano Martinez]

Hello,

There seems to be quite a couple of tools and documentation out there...

http://blog.codestage.ru/2013/05/06/decrypting-doswf/

Decompilers & editors:
Action Script Viewer (ASV) - most powerful and useful decompiler for both as2 and as3, especially useful against protected swfs
Registered users get powerful SWF dumping tool for ASV - SWF Revealer - it allows to reveal and dump packed and protected SWFs placed inside of the another SWF (Like DoSWF does).

https://gist.github.com/1509527/d3dca7ed75d090b68e4a3d84d1129923a9800390

https://github.com/patraulea/doswf-unpack

Regards.

--
--
Choose a file, check it with more than 40 antivirus, fast and easy: http://www.virustotal.com

---
You received this message because you are subscribed to the Google Groups "VirusTotal" group.
To unsubscribe from this group and stop receiving emails from it, send an email to virustotal+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Manish Sardiwal]

Hello

Thank you for your suggestions and help, but all these tools support for only old version of swf file as well as old DoSwf packer.

I have some samples with latest DoSwf obfuscation which is not supported by these tools.

Regards,