# This script is responsible for decoding falsified SVG files encountered
# in a malicious JavaScript file that was attributed to a North Korean
# threat actor identified by Volexity as 'InkySquid'.
#
# Reference:
# Author: threatintel@volexity.com
svgs = [
'',
'',
''
]
def decode(instr):
out = ""
for obj in instr.split(" "):
try:
f = float(obj)
i = int(f)
if i > 30:
out += (chr(i-17))
except:
pass
return out
def main():
for index0, svg in enumerate(svgs):
print("Parsing SVG #{0}".format(index0))
for index1, o in enumerate(svg.split("M43.2")):
print("Index #{0: <1} : {1}".format(index1, decode(o)))
print()
if __name__ == "__main__":
main()