The BOSS#

Challenge Context#

The challenge provided invoice.exe, a suspicious .NET attachment. Dynamic analysis was misleading because of anti-debug and anti-sandbox checks.

Reconnaissance#

Static analysis showed:

1
anti-debug: Debugger.IsAttached
2
anti-sandbox: Thread.Sleep timing check
3
embedded resource: enc_payload.bin
4
crypto: AES-256-CBC, PaddingMode.None

The key was built by string concatenation:

1
"Sphynx" + "MalwareKey" + "1234567890123456"
2
= SphynxMalwareKey1234567890123456

The IV was:

1
InitialVector123

Attack Chain#

1
invoice.exe
2
  -> recover AES key/IV from IL
3
  -> decrypt enc_payload.bin
4
  -> Payload.dll
5
  -> inspect Execute()
6
  -> rolling XOR decode static byte array

Exploitation#

The decrypted DLL built the flag but never printed it. Execute() initialized a 38-byte static array, then decoded it with a rolling XOR key:

1
key starts at 90 (0x5a)
2
for each byte:
3
    char = encoded[i] ^ key
4
    key = (key + 7) mod 256

Encoded bytes:

1
36040d1b0d13b7ffcdeb93c1c286dfb7fbe1b6808bd9988c367b23486c165a00483279213120

Python extraction:

1
data = bytes.fromhex("36040d1b0d13b7ffcdeb93c1c286dfb7fbe1b6808bd9988c367b23486c165a00483279213120")
2
key = 90
3
out = []
4
for b in data:
5
    out.append(b ^ key)
6
    key = (key + 7) % 256
7
print(bytes(out).decode())

Flag#

1
leet{n3t_r3fl3ct10n_m4lw4r3_r3v3rs1ng}

Lesson Learned#

The payload’s runtime output was decoy text. In malware-style CTFs, the flag often exists only as a constructed string in memory; static IL analysis can be cleaner than executing the sample.

Cover: Wallhaven 7j38je.

If this article helped you, please share it with others!