<commit_before>"""

Nemucod File Recovery

Coded by Antelox
Twitter: @Antelox
UIC R.E. Academy - quequero.org
Version: 0.2 - 05/22/2016

Released under MIT License

This script is able to recover encrypted files by Nemucod Ransomware (the last 2 variants)

For more informations about this variant you can take a look at:

https://glot.io/snippets/ee7hiif87k

and here:

http://www.bleepingcomputer.com/forums/t/608045/crypted-ransomware-nemucod-decrypttxt-support-and-help-topic/page-11#entry4005316

DISCLAIMER
Use this script at your own risk. I'm not responsible for any data loss!
Anyway the script doesn't overwrite and/or delete any files.

"""

import sys
import glob
import os

def decrypt(file, key, hsize, ksize):
	try:
		fencrypted = open(file, 'rb')
		
		content_encrypted = fencrypted.read()
		filesize = len(content_encrypted)
		
		recovered = ''
		full_recovered = ''
		
		if filesize <= hsize:
			for i in range(0,filesize):
				recovered = recovered + chr(ord(content_encrypted[i])^ord(key[i%ksize]))
			full_recovered = recovered
		else:
			for i in range(0,hsize):
				recovered = recovered + chr(ord(content_encrypted[i])^ord(key[i%ksize]))
			full_recovered = recovered + content_encrypted[hsize:]
		
		open(file[:-8], 'wb').write(full_recovered)
		fencrypted.close()
		print "[+]File %s recovered succesfully!\n" % file[:-8]
		return 0
	except:
		print "An error has occured!"
	
#main
print "\n*Nemucod File Recovery*\n"

if len(sys.argv) == 5:
	os.chdir(sys.argv[1])
	for file in glob.glob("*.crypted"):
		decrypt(file,sys.argv[2],sys.argv[3],sys.argv[4])
else:
	print "*ERROR: Incorrect number of arguments passed to the script!\n"
	print "Example: python NemucodFR.py folder key header_size key_size\n"
	print "folder: a folder which contains encrypted files by Nemucod with .crypted extension;\n"
	print "key: the key recovered with the NemucodKE.py script;\n"
	print "header_size: size, from beginning of the file, which it was encrypted - provided by NemucodKE.py script;\n"
	print "key_size: size of the key - provided by NemucodKE.py script."<commit_msg>Bug fix<commit_after>"""

Nemucod File Recovery

Coded by Antelox
Twitter: @Antelox
UIC R.E. Academy - quequero.org
Version: 0.2 - 05/22/2016

Released under MIT License

This script is able to recover encrypted files by Nemucod Ransomware (the last 2 variants)

For more informations about this variant you can take a look at:

https://glot.io/snippets/ee7hiif87k

and here:

http://www.bleepingcomputer.com/forums/t/608045/crypted-ransomware-nemucod-decrypttxt-support-and-help-topic/page-11#entry4005316

DISCLAIMER
Use this script at your own risk. I'm not responsible for any data loss!
Anyway the script doesn't overwrite and/or delete any files.

"""

import sys
import glob
import os

def decrypt(file, key, hsize, ksize):
	try:
		fencrypted = open(file, 'rb')
		
		content_encrypted = fencrypted.read()
		filesize = len(content_encrypted)
		
		recovered = ''
		full_recovered = ''
		
		if filesize <= hsize:
			for i in range(0,filesize):
				recovered = recovered + chr(ord(content_encrypted[i])^ord(key[i%ksize]))
			full_recovered = recovered
		else:
			for i in range(0,hsize):
				recovered = recovered + chr(ord(content_encrypted[i])^ord(key[i%ksize]))
			full_recovered = recovered + content_encrypted[hsize:]
		
		open(file[:-8], 'wb').write(full_recovered)
		fencrypted.close()
		print "[+]File %s recovered succesfully!\n" % file[:-8]
		return 0
	except:
		print "An error has occured!"
	
#main
print "\n*Nemucod File Recovery*\n"

if len(sys.argv) == 5:
	os.chdir(sys.argv[1])
	for file in glob.glob("*.crypted"):
		decrypt(file,sys.argv[2],int(sys.argv[3]),int(sys.argv[4]))
else:
	print "*ERROR: Incorrect number of arguments passed to the script!\n"
	print "Example: python NemucodFR.py folder key header_size key_size\n"
	print "folder: a folder which contains encrypted files by Nemucod with .crypted extension;\n"
	print "key: the key recovered with the NemucodKE.py script;\n"
	print "header_size: size, from beginning of the file, which it was encrypted - provided by NemucodKE.py script;\n"
	print "key_size: size of the key - provided by NemucodKE.py script."
{'fraction_non_alphanumeric': 0.11547676090081456, 'fraction_numerical': 0.018687110685194058, 'mean_word_length': 4.436197916666667, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3566975', 'n_tokens_mistral': 1587, 'n_tokens_neox': 1433, 'n_words': 434}