diff --git a/de4dot.code/deobfuscators/Confuser/Unpacker.cs b/de4dot.code/deobfuscators/Confuser/Unpacker.cs index 54b55c0d..387db2ff 100644 --- a/de4dot.code/deobfuscators/Confuser/Unpacker.cs +++ b/de4dot.code/deobfuscators/Confuser/Unpacker.cs @@ -83,6 +83,7 @@ namespace de4dot.code.deobfuscators.Confuser { v17_r73477, v17_r75076, v18_r75184, + v18_r75367, } public bool Detected { @@ -153,8 +154,10 @@ namespace de4dot.code.deobfuscators.Confuser { if (use7zip) { if (new LocalTypes(decyptMethod).exists("System.IO.MemoryStream")) version = ConfuserVersion.v17_r75076; - else + else if (module.Name == "Stub.exe") version = ConfuserVersion.v18_r75184; + else + version = ConfuserVersion.v18_r75367; } else if (isDecryptMethod_v17_r73404(decyptMethod)) version = ConfuserVersion.v17_r73404; @@ -448,6 +451,7 @@ namespace de4dot.code.deobfuscators.Confuser { case ConfuserVersion.v17_r73477: return decrypt_v17_r73404(data); case ConfuserVersion.v17_r75076: return decrypt_v17_r75076(data); case ConfuserVersion.v18_r75184: return decrypt_v17_r75076(data); + case ConfuserVersion.v18_r75367: return decrypt_v17_r75076(data); default: throw new ApplicationException("Unknown version"); } }