# Deobfuscation

## CyberChef

Decode and otherwise analyze data using this browser app.

**Website**: <https://github.com/gchq/CyberChef/>\
**Author**: GCHQ\
**License**: Apache License 2.0: <https://github.com/gchq/CyberChef/blob/master/LICENSE>\
**Notes**: cyberchef\
**State File**: [remnux.tools.cyberchef](https://github.com/REMnux/salt-states/blob/master/remnux/tools/cyberchef.sls)

## Malchive

Perform static analysis of various aspects of malicious code.

**Website**: <https://github.com/MITRECND/malchive>\
**Author**: The MITRE Corporation, <https://github.com/MITRECND/malchive/graphs/contributors>\
**License**: Apache License 2.0: <https://github.com/MITRECND/malchive/blob/main/LICENSE>\
**Notes**: Malchive command-line tools start with the prefix `malutil-`. See [utilities documentation](https://github.com/MITRECND/malchive/wiki/Utilities) for details.\
**State File**: [remnux.python3-packages.malchive](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/malchive.sls)

## Cobalt Strike Configuration Extractor (CSCE) and Parser <a href="#csce" id="csce"></a>

Analyze Cobalt Strike beacons.

**Website**: <https://github.com/strozfriedberg/cobaltstrike-config-extractor>\
**Author**: Aon / Stroz Friedberg\
**License**: Apache License 2.0: <https://github.com/strozfriedberg/cobaltstrike-config-extractor/blob/master/LICENSE>\
**Notes**: csce, list-cs-settings\
**State File**: [remnux.python3-packages.csce](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/csce.sls)

## xortool

Analyze XOR-encoded data.

**Website**: <https://github.com/hellman/xortool>\
**Author**: Aleksei Hellman\
**License**: MIT License: <https://github.com/hellman/xortool/blob/master/LICENSE>\
**State File**: [remnux.python3-packages.xortool](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/xortool.sls)

## DC3-MWCP

Parsing configuration information from malware.

**Website**: <https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp>\
**Author**: Defense Cyber Crime Center - United States Government\
**License**: Some parts Public Domain, some MIT License: <https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp/blob/master/LICENSE.txt>\
**Notes**: mwcp\
**State File**: [remnux.python3-packages.dc3-mwcp](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dc3-mwcp.sls)

## unicode

Display Unicode character properties.

**Website**: <https://github.com/garabik/unicode>\
**Author**: Radovan Garabik\
**License**: GNU General Public License (GPL) v3: <https://github.com/garabik/unicode/blob/master/COPYING>\
**State File**: [remnux.python3-packages.unicode](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/unicode.sls)

## Chepy

Decode and otherwise analyze data using this command-line tool and Python library.

**Website**: <https://github.com/securisec/chepy>\
**Author**: securisec: <https://x.com/securisec>\
**License**: GNU General Public License (GPL) v3: <https://github.com/securisec/chepy/blob/master/LICENSE>\
**Notes**: chepy\
**State File**: [remnux.python3-packages.chepy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/chepy.sls)

## Balbuzard

Extract and deobfuscate patterns from suspicious files.

**Website**: <https://github.com/digitalsleuth/balbuzard>\
**Author**: Philippe Lagadec / Corey Forman (digitalsleuth)\
**License**: Free, custom license: <https://github.com/digitalsleuth/balbuzard>\
**Notes**: balbuzard, bbcrack, bbharvest, bbtrans\
**State File**: [remnux.python3-packages.balbuzard](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/balbuzard.sls)

## NoMoreXOR.py

Help guess a file's 256-byte XOR by using frequency analysis.

**Website**: <https://github.com/digitalsleuth/NoMoreXOR>\
**Author**: Glenn P. Edwards Jr.\
**License**: Free, unknown license\
**State File**: [remnux.scripts.nomorexor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/nomorexor.sls)

## unXOR

Deobfuscate XOR'ed files.

**Website**: <https://github.com/tomchop/unxor/>\
**Author**: Thomas Chopitea\
**License**: Apache License 2.0: <https://github.com/tomchop/unxor/blob/master/LICENSE>\
**State File**: [remnux.scripts.unxor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/unxor.sls)

## brxor.py

Bruteforce XOR'ed strings to find those that are English words.

**Website**: <https://github.com/REMnux/distro/blob/master/files/brxor.py>\
**Author**: Alexander Hanel, Trenton Tait\
**License**: Free, unknown license\
**State File**: [remnux.scripts.brxor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/brxor.sls)

## xorBruteForcer.py

Bruteforce an XOR-encoded file.

**Website**: <https://eternal-todo.com/category/bruteforcer>\
**Author**: Jose Miguel Esparza\
**License**: Free, unknown license\
**State File**: [remnux.scripts.xorbruteforcer](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/xorbruteforcer.sls)

## strdeob.pl

Locate and decode stack strings in executable files.

**Website**: <https://github.com/REMnux/distro/blob/master/files/strdeob.pl>\
**Author**: TotalHash\
**License**: Free, unknown license\
**State File**: [remnux.scripts.strdeob](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/strdeob.sls)

## XORStrings

Search for XOR encoded strings in a file.

**Website**: <https://blog.didierstevens.com/2013/04/15/new-tool-xorstrings/>\
**Author**: Didier Stevens\
**License**: Free, unknown license\
**State File**: [remnux.packages.xorstrings](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorstrings.sls)

## XORSearch

Locate and decode strings obfuscated using common techniques.

**Website**: <https://blog.didierstevens.com/programs/xorsearch/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Notes**: xorsearch\
**State File**: [remnux.packages.xorsearch](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorsearch.sls)

## FLOSS

Extract and deobfuscate strings from PE executables.

**Website**: <https://github.com/mandiant/flare-floss>\
**Author**: Mandiant, Willi Ballenthin: <https://x.com/williballenthin>, Moritz Raabe\
**License**: Apache License 2.0: <https://github.com/mandiant/flare-floss/blob/master/LICENSE.txt>\
**Notes**: floss\
**State File**: [remnux.packages.flare-floss](https://github.com/REMnux/salt-states/blob/master/remnux/packages/flare-floss.sls)

## ex\_pe\_xor.py

Search an XOR'ed file for indications of executable binaries.

**Website**: <https://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html>\
**Author**: Alexander Hanel\
**License**: Free, unknown license\
**State File**: [remnux.scripts.ex-pe-xor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/ex-pe-xor.sls)

## cs-decrypt-metadata.py

Decrypt Cobalt Strike metadata.

**Website**: <https://blog.didierstevens.com/2021/11/12/update-cs-decrypt-metadata-py-version-0-0-2/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## base64dump.py

Locate and decode strings encoded in Base64 and other common encodings.

**Website**: <https://blog.didierstevens.com/2020/07/03/update-base64dump-py-version-0-0-12/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## xor-kpa.py

Implement a XOR known plaintext attack.

**Website**: <https://blog.didierstevens.com/2017/06/06/update-xor-kpa-py-version-0-0-5/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cut-bytes.py

Cut out a part of a data stream.

**Website**: <https://blog.didierstevens.com/2015/10/14/cut-bytes-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## format-bytes.py

Decompose structured binary data with format strings.

**Website**: <https://blog.didierstevens.com/2020/02/17/update-format-bytes-py-version-0-0-13/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## translate.py

Translate bytes according to a Python expression.

**Website**: <https://blog.didierstevens.com/programs/translate/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## sets.py

Perform set operations on lines or bytes in text files.

**Website**: <https://blog.didierstevens.com/2017/03/05/new-tool-sets-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## 1768.py

Analyze Cobalt Strike beacons.

**Website**: <https://blog.didierstevens.com/2021/05/22/update-1768-py-version-0-0-6/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## xorsearch.py

Search for XOR, ROL, ROT, and SHIFT encoded strings with YARA and regex support.

**Website**: <https://blog.didierstevens.com/2020/08/23/new-tool-xorsearch-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## re-search.py

Search files using regular expressions from a built-in library or custom patterns.

**Website**: <https://blog.didierstevens.com/2023/04/03/update-re-search-py-version-0-0-22/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## hex-to-bin.py

Convert hexadecimal text dumps to binary data.

**Website**: <https://blog.didierstevens.com/2020/04/19/update-hex-to-bin-py-version-0-0-5/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## numbers-to-string.py

Translate number sequences into ASCII characters.

**Website**: <https://blog.didierstevens.com/2020/12/12/update-numbers-to-string-py-version-0-0-11/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cs-analyze-processdump.py

Analyze Cobalt Strike beacon process dumps to detect sleep mask encoding.

**Website**: <https://blog.didierstevens.com/2021/11/25/new-tool-cs-analyze-processdump-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cs-extract-key.py

Extract AES and HMAC keys from Cobalt Strike beacon process memory.

**Website**: <https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.remnux.org/discover-the-tools/examine+static+properties/deobfuscation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.