CyberChef for mal doc analysis

Recipe for Cyberchef

Strings('Single byte',258,'All printable chars (A)',false,false,false)

Find_/_Replace({'option':'Regex','string':'[\\[\\]\\n_]'},'',true,false,true,false)

Drop_bytes(0,124,false)

From_Base64('A-Za-z0-9+/=',true,false)

Decode_text('UTF-16LE (1200)')

Find_/_Replace({'option':'Regex','string':'[\'()+\'"`]'},'',true,false,true,false)

Find_/_Replace({'option':'Simple string','string':']b2H_'},'http',true,false,true,false)

Extract_URLs(false,false,false)

Split('@','\\n')

Defang_URL(true,true,true,'Valid domains and full URLs')


Beliebte Posts aus diesem Blog

Shutdown / Lastlogon Analyse

Wer hat das System heruntergefahren: Get-EventLog - LogName system - Source user32 - Newest 1 | fl * Logons der letzten 7 Tage: $filter = @ {     LogName       = 'System'     ProviderName = 'Microsoft-Windows-Winlogon'     StartTime     = ( Get-Date ). AddDays ( -7 ) } $logs = Get-WinEvent - FilterHashtable $filter $res = @ () ForEach ( $log in $logs ) {     if ( $log . Id -eq 7001 ) { $type = "Logon" }     elseif ( $log . Id -eq 7002 ) { $type = "Logoff" }     else { Continue }     # Check if Properties[1] exists before accessing     if ( $log . Properties . Count -gt 1 ) {         try {             $user = ( New-Object System.Security.Principal.SecurityIdentifier $log . Properties [ 1 ]. Value ). Translate ([ System.Security.Principal.NTAccount ])         } catch { ...
Mehr anzeigen