Malware Analysis - DOSfuscation Deobfuscation

How to analyze and deobfuscate Windows command-line obfuscation techniques using a Python script and a real malware sample.

Fireeye made a white paper on cmd.exe command obfuscation (DOSfuscation). We deobfuscate a malware sample that uses techniques described in their paper. Malware analysis courses: malwareanalysis-for-hedgehogs.learnworlds.com/courses Buy me a coffee: ko-fi.com/struppigel Follow me on Twitter: twitter.com/struppigel Dosfuscation white paper: fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-r… Sample VirusBay: beta.virusbay.io/sample/browse/60ae52600db539ccbf48ca18072a1… Deobfuscation script: gist.github.com/katjahahn/c8fb092622e8c5c869fd18ac5489f8e0 GData article: gdatasoftware.com/blog/2018/07/30924-g-data-analysis-discove… Notepad++: notepad-plus-plus.org/ Python: python.org/