ADVANCED CYBERCHEF TECHNIQUES - DEFEATING NANOCORE OBFUSCATION WITH MATH AND FLOW CONTROL

Summary from the TLDR InfoSec newsletter

This article walks through the process of deobfuscating a .vbs loader for Nanocore malware. The deobfuscation begins by using a regex to filter out comments in the obfuscated loader. It involves alternatively adding or dividing long decimal numbers with hexadecimal numbers to obtain char codes that are concatenated to form the code. The CyberChef script utilizes reflexes and capture groups to isolate the various components of the obfuscated code followed by Subsections to handle the alternating mathematical operations.