# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


import pefile
import yara
import struct
from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable



rule_source = '''
rule opcodes {
  meta:
    description = "Netwire instruction sequences"
    author = "David Cannings"

  strings:
    $opcodes01 = { 31 C0 88 44 01 08 40 3D 00 01 00 00 75 F4 }
    $opcodes02 = { 8A 5C 06 08 88 9C 05 F4 FE FF FF 40 3D 00 01 00 00 75 ED }
    $opcodes03 = { 53 81 EC ?? ?? 00 00 C7 ?? ?? ?? ?? 00 00 00 C7 ?? ?? ?? ?? ?? ?? 00 8D ?? ?? ?? FF FF 89 ?? ?? E8 ?? ?? ?? 00 }
    $opcodes04 = { E8 ?? ?? 00 00 C7 44 ?? ?? ?? ?? 00 00 C7 44 ?? ?? ?? ?? ?? 00 89 ?? ?? E8 ?? ?? ?? 00 }
    $opcodes05 = { 53 81 EC ?? ?? 00 00 ?? ?? ?? ?? C7 ?? ?? ?? ?? 00 00 00 C7 ?? ?? ?? ?? ?? ?? 00 8? ?? ?? E8 ?? ?? ?? 00 }
    $opcodes06 = { E8 ?? ?? 00 00 ?? ?? ?? C7 44 ?? ?? ?? ?? 00 00 C7 44 ?? ?? ?? ?? ?? 00 E8 ?? ?? ?? 00 }

  condition:
    2 of them
}
'''


# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/netwire.py
import pefile
import yara
import struct
from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable




rule_source = '''
rule opcodes {
  meta:
    description = "Netwire instruction sequences"
    author = "David Cannings"

  strings:
    $opcodes01 = { 31 C0 88 44 01 08 40 3D 00 01 00 00 75 F4 }
    $opcodes02 = { 8A 5C 06 08 88 9C 05 F4 FE FF FF 40 3D 00 01 00 00 75 ED }
    $opcodes03 = { 53 81 EC ?? ?? 00 00 C7 ?? ?? ?? ?? 00 00 00 C7 ?? ?? ?? ?? ?? ?? 00 8D ?? ?? ?? FF FF 89 ?? ?? E8 ?? ?? ?? 00 }
    $opcodes04 = { E8 ?? ?? 00 00 C7 44 ?? ?? ?? ?? 00 00 C7 44 ?? ?? ?? ?? ?? 00 89 ?? ?? E8 ?? ?? ?? 00 }
    $opcodes05 = { 53 81 EC ?? ?? 00 00 ?? ?? ?? ?? C7 ?? ?? ?? ?? 00 00 00 C7 ?? ?? ?? ?? ?? ?? 00 8? ?? ?? E8 ?? ?? ?? 00 }
    $opcodes06 = { E8 ?? ?? 00 00 ?? ?? ?? C7 44 ?? ?? ?? ?? 00 00 C7 44 ?? ?? ?? ?? ?? 00 E8 ?? ?? ?? 00 }

  condition:
    2 of them
}
'''


class NetWire(Decoder):