DeXRAY is a private tool that turned public a few years ago. Back in a day it helped me to decrypt some Quarantine files from forensic cases I worked on. Over time I expanded it to cover more engines and file formats. Not all the decryptions work perfectly, but as usual – this is a work in progress. Also, because I add stuff ad hoc, it’s not a beautiful code either. But it works 🙂

At the moment Dexray supports quarantine files and logs from a number of AVs, and data files storing PE files in an encrypted form (XOR with a single byte key). The full list of supported or recognized file formats is listed below:

• ASquared (EQF)
• ESET (NQF)
• Kaspersky (KLQ) – based on the code by Optiv
• MalwareBytes Data files (DATA)
• MalwareBytes Quarantine files (QUAR)
• McAfee Quarantine files (BUP) – not perfect, but it should still help
• Microsoft Forefront (Magic@0=0B AD) – not handled yet; only recognized
• SUPERAntiSpyware (SDB)
• Symantec Quarantine Data files (QBD)
• Symantec Quarantine files (VBN) – not perfect, but it should still help
• Symantec Quarantine Index files (QBI)
• TrendMicro (Magic@0=A9 AC BD A7 which is ‘VSBX’ string ^ 0xFF) – based on the code by Optiv
• Any binary file (using X-RAY scanning)

Now, it is a buggy program. I know of it so please bear with me. If you find something not working, or stupid, please tell me 🙂

Also, if you have any Quarantine files that you can share, from any AV, please send them over. I will appreciate it as it will help me to add new engines and test the support for already implemented ones. Thanks!

Note: I used the code from Optiv to implement decryption of Kaspersky and Trend. This is a good stuff. Thanks to that – apart from decryption of the malware – DeXRAY now dumps additional metadata extracted from these two Quarantine file types. The metadata is stored in dedicated files with the .met extension, and is also printed to STDERR.

Here is an example for Kaspersky:

And for Trend:

The output files are saved into the following files:

• .out – the decrypted data
• .met – metadata (Trend&Kaspersky only)

In some cases you may find more than one .out file created for a given input files. This is the case with Trend Micro Quarantine files.

• The first is:
  • <filename>.TREND1.out file
    and contains a decrypted input file which includes both metadata and the file content
• The second is:
  • <filename>TREND2.out
    that contains the actual file you want to analyze.

Another case like that is if the binary blob contains more than one encrypted PE file which is decrypted using X-Rays algorithm (basically, a number of PE files encrypted using a single byte XOR key inside one blob/file).

The script can be downloaded here.