{"push_id":1077677734,"size":8,"distinct_size":8,"ref":"refs/heads/master","head":"c7049ca3ef731cee4d06a50805f0290fcfbbd980","before":"75ac83767964541f2fcfe55a2b6ef536bed87efa","commits":[{"sha":"35ea24b1c7ee26b58303c3d353e7073dd7f32b79","author":{"email":"7cdfcbd9315be4cfd7bdf307b4ac78d3bcdb56ad@cuckoo.sh","name":"Jurriaan Bremer"},"message":".wsf analysis support from Jurriaan Bremer\n\nRecently a blogpost [1] was released covering a \"new\" technique used\nin-the-wild. Rather than embedding a Javascript .js file, the .wsf\ntechnique allows one to use the JScript.Encode feature to encode the\nactual Javascript payload further.\n\nAs part of our static analysis we provide the decoded Javascript.\nThe implementation of this work is a port of scrdec18.c [2], a\nJScript.Encode decoder implemented in C.\n\n[1]: https://medium.com/@networksecurity/ransomware-delivered-using-wsf-windows-script-file-551a6589da47\n[2]: https://gist.githubusercontent.com/bcse/1834878/raw/7483fb72abbb32aa69b853fdcc9f6f72e7568677/scrdec18.c\n\n(with extras)","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/35ea24b1c7ee26b58303c3d353e7073dd7f32b79"},{"sha":"1b3a7e0ede30709981c2a2e76e07cd28042a8910","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"Handle MSIs in zips properly","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/1b3a7e0ede30709981c2a2e76e07cd28042a8910"},{"sha":"169542c471610891888c0075bdfed7bc6008fa42","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"Add .hta support","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/169542c471610891888c0075bdfed7bc6008fa42"},{"sha":"f9545dbe0834653eba12f3c92d6ae7276f3da790","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"show .hta info in web interface","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/f9545dbe0834653eba12f3c92d6ae7276f3da790"},{"sha":"24b1f2c15ed87d5e0ef6220cc6eee7d28e1c5070","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"Add tar/tgz/gz support","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/24b1f2c15ed87d5e0ef6220cc6eee7d28e1c5070"},{"sha":"7d3ba11086be47248bd31922e891260eece0e7e1","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"fix tar/gz support","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/7d3ba11086be47248bd31922e891260eece0e7e1"},{"sha":"28f3df1d278f46a39253bdb89d9f24bbb7559377","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"add bz2 support","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/28f3df1d278f46a39253bdb89d9f24bbb7559377"},{"sha":"c7049ca3ef731cee4d06a50805f0290fcfbbd980","author":{"email":"3f1d79535c9547222659ebf69e5cb37428e45156@gmail.com","name":"Brad Spengler"},"message":"move some code around, fix a typo","distinct":true,"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/commits/c7049ca3ef731cee4d06a50805f0290fcfbbd980"}]}