Finding and Decoding Malicious Scripts- Digital Forensics Series

Показать описание

You are being exposed to malicious scripts in one form or other every day, whether it be in email, documents, or websites. Many malicious scripts at first glance appear to be impossible to understand. However, with a few tips and some simple utility scripts, you can deobfuscate them in just a few minutes. In this series you will learn how you can break the shell of obfuscation techniques the script authors use and not spend a lot of time doing it.

Malicious JavaScripts are becoming the tool of choice for attackers. Although sometimes referred to as “fileless malware”, they can leave behind forensic artifacts for examiners to find.

Tools you might be needing:

3. Didier Stevens Suit
5. Jscompress(javascript compression tool)

If you need the custom scripts and samples(for practice) that we have used in this series, please drop us an email, and we will be happy to supply them for you.

If you liked the content please give us a thumbs up and if you have any query, please post them in the comment section below.

Also, don't forget to subscribe to BlackPerl to getting update about our new topics on DFIR.

Stay CyberAware!!
--------------------------------------------------------------------------------------------------------------------------
Chapters:
Background- 0:00
Theory Discussion- 1:02
Goals- 1:13
Techniques- 2:23
Tools we will be using- 6:47
Demo- 11:58
Sample1- 15:44
Sample2- 19:48
Sample3- 27:31
Sample4- 34:02
Sample5- 49:06
Sample6- 56:43
Sample7- 01:00:18
Sample8- 01:05:22

-~-~~-~~~-~~-~-
Please watch: "The Next Big Event You Need to Prepare For"
-~-~~-~~~-~~-~-

Рекомендации по теме

Комментарии

Menu:
Background- 0:01
Theory Discussion- 1:02
Goals- 1:13
Techniques- 2:23
Tools we will be using- 6:47
Demo- 11:58
Sample1- 15:44
Sample2- 19:48
Sample3- 27:31
Sample4- 34:02
Sample5- 49:06
Sample6- 56:43
Sample7- 01:00:18
Sample8- 01:05:22

BlackPerl

Thank You for the Session. Can you please dump the inhouse scripts ?

saiprem

can you please provide the link for the malware samples

ravigadhesariya

Thank you, very informative.
Also, I get a webpage error upon clicking on a few of those links. Just letting you know.

thomasmoser

Hello BlackPerl,
Can you Please Share The Malwares? You Are Unvisible in Linkedin I cant reach you

sagibersodsky

Finding and Decoding Malicious Scripts- Digital Forensics Series

Finding and Decoding Malicious Powershell Scripts - SANS DFIR Summit 2018

Finding and Decoding Malicious Scripts- Digital Forensics Series

Decoding Malicious PowerShell Activity

Shortcuts for Understanding Malicious Scripts

Viewer Submission - Decoding Malicious .vbs Scripts

MALWARE ANALYSIS - VBScript Decoding & Deobfuscating

Deobfuscating malicious PowerShell scripts

Malware Analysis - DOSfuscation Deobfuscation

Fileless Malware Analysis & PowerShell Deobfuscation

everything is open source if you can reverse engineer (try it RIGHT NOW!)

Deciphering Obfuscated JavaScript Malware

Incident Response Training, Decoding Powershell- Day 18

Splunk .Conf 2016 - Powershell Power Hell: Hunting for Malicious use of Powershell

Hacker's Gave me a Game and I Found a Virus

How I Debug DLL Malware (Emotet)

DECODING EVERYTHING (Cyberchef and OLE) | TryHackMe's AoC 3 (Day 22)

Normal people vs programmer vs hackers compression #coding

Malware beats Windows Defender: How you get hacked

How To Extract Plaintext Google Chrome Passwords

Malware Analysis - Decoding JS obfucation

Using CyberChef To Automatically Extract Shellcode from PowerShell Loader [Twitch Clip]

How to DECRYPT HTTPS Traffic with Wireshark

How Law Enforcement Breaks into iPhones

SANS DFIR Webcast - Closing the Door on Web Shells