JSFiddle - React, Tailwind, and code Playground
HTML
<span>
<b>Trickbot Macro DOC Payload URL extraction</b><br><br>Use the following command to extract the Decode Strings: <br><br>$ python oledump.py invoice.doc -v -s 15<br><br>
Put the DecodeString arguments into the following fields and by clicking on the "getURLs" button you should get the payload URL's..<br><br>
<table>
<tr><td style="width: 150px">DecodeString 1</td><td><input type="text" name="dec1" id='dec1' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 2</td><td><input type="text" name="dec2" id='dec2' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 3</td><td><input type="text" name="dec3" id='dec3' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 4</td><td><input type="text" name="dec4" id='dec4' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 5</td><td><input type="text" name="dec5" id='dec5' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 6</td><td><input type="text" name="dec6" id='dec6' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 7</td><td><input type="text" name="dec7" id='dec7' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 8</td><td><input type="text" name="dec8" id='dec8' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 9</td><td><input type="text" name="dec9" id='dec9' value="" class="value_field"/></td></tr>
<tr><td>DecodeString 10</td><td><input type="text" name="dec10" id='dec10' value="" class="value_field"/></td></tr>
<tr><td></td><td align="right"><input type="button" name="getURLs" value="getURLs" onclick="getURLs();"></td></tr>
<tr><td>Result String:</td><td></td></tr>
<tr><td colspan="2"><textarea rows="10" cols="70" id="result_string"></textarea></td></tr>
<tr><td colspan="2"><input type="text" name="first_url" id="first_url" class="value_field"></td></tr>
<tr><td colspan="2"><input type="text" name="second_url" id="second_url" class="value_field"></td></tr>
</table>
</span>
CSS
.value_field {
width:95%;
}
JavaScript
var global_text = "qwertyuiopasdfghjklzxcvbnm/\"'()[]${.},\;-%_:|1234567890";
function gnkruhl() {
var leng = 6 * Math.random() + 4;
var name1 = "";
for (var i = 1; i <= leng; i++) {
num = 24 * Math.random() + 97;
name1 = name1 + String.fromCharCode(num);
}
return name1;
}
function DecodeString(text) {
var decode = "";
for (var i = 1; i <= text.length; i++) {
decode = decode + GetAlphabetSymbol(SearchNum(text.substr(i, 1)), 5);
}
return decode;
}
function GetAlphabetSymbol(num, key) {
if (num - key < 1) {
return global_text.substr(global_text.length + num - key, 1);
} else {
return global_text.substr(num - key, 1);
}
}
function SearchNum(symbol) {
for (var i = 1; i <= global_text.length; i++) {
if (symbol == global_text.substr(i, 1)) {
return i;
}
}
}
function test2 (text, dec, name){
return text + dec + name;
}
window.getURLs = function getURLs(){
var name1 = gnkruhl();
var name2 = gnkruhl();
var name3 = gnkruhl();
var name4 = gnkruhl();
var dec1 = DecodeString(document.getElementById("dec1").value);
var dec2 = DecodeString(document.getElementById("dec2").value);
var dec3 = DecodeString(document.getElementById("dec3").value);
var dec4 = DecodeString(document.getElementById("dec4").value);
var dec5 = DecodeString(document.getElementById("dec5").value);
var dec6 = DecodeString(document.getElementById("dec6").value);
var dec7 = DecodeString(document.getElementById("dec7").value);
var dec8 = DecodeString(document.getElementById("dec8").value);
var dec9 = DecodeString(document.getElementById("dec9").value);
var dec10 = DecodeString(document.getElementById("dec10").value);
var text = "";
text = test2(text, dec1, name1);
text = test2( text, dec2, name2);
text = test2( text, dec3, name2);
text = test2( text, dec4, name3);
text = test2( text, dec5, name3);
text = test2( text, dec6, name1);
text = test2( text,...