Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#deobfuscation
Newest first
Encodings in Malicious Payloads: Recognising and Peeling Base64, Hex, XOR and Friends
Most "obfuscated" payloads are just encoded, sometimes three or four times over. How to recognise Base64, hex, URL encoding, UTF-16LE PowerShell and single-byte XOR at a glance, and how to peel layered encodings without guessing.
Malicious JavaScript Deobfuscation: A Practical Walkthrough
Take an obfuscated JavaScript sample from unreadable to understandable: string arrays, hex escapes, eval chains and packers, dismantled step by step with safe static techniques.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note