Phase 3: Decrypt strings

Dec 7, 2012 at 5:01 PM


I am using version  0.3.1 beta and when trying to de-obfuscate a binary I get the following :

Performing routine:

Phase 1: Clean Control Flow (de4dot)
227 methods cleaned...

Performing routine: String decryption

Phase 1: Locate string decryption method
Located decryption method at ArgsAddress::Send...

Phase 2: Construct decryption entries
Constructed 245 decryption entries...

Phase 3: Decrypt strings
Contact author!

At Phase 3: Decrypt strings, NETDeod0 tries to connect through https to an unknown address which I block with the firewall and then just stops functioning and displays the message Contact author!
Of course since it stopped functioning it does not produce any de-obfuscated binary

what is actually happening ?