Video: De-DOSfuscation Example, (Sat, Dec 29th)

Read Full Article

I created a video showing how to de-obfuscate a DOSfuscated PowerShell command obtained from a maldoc I analyzed in diary entry "De-DOSfuscation Example":

This is the obfuscated command:

In the video, I rely mainly on my tool numbers-to-string to do the de-obfuscation.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. http://bit.ly/2ruEGKc Creative Commons Attribution-Noncommercial 3.0 United States License.

Read Full Article