Defeating The Latest Advances in Script Obfuscation

Presented at DerbyCon 6.0 Recharge (2016), Sept. 23, 2016, 7 p.m. (50 minutes).

In this age of increasingly sophisticated and devastating malware, adversaries still rely on a multitude of scripting languages and frameworks (e.g. JavaScript, VBA, PowerShell, VBScript) as key components of an attack scenario. These scripts tend to employ obfuscation techniques in order to obscure their true intent and avoid detection by endpoint protection products. Though significant advances have been made in recent years in packing and obfuscating compiled binaries, script obfuscation can still be defeated with time and a determined analyst. This talk will cover some of the most recently seen advanced obfuscation techniques employed by APTs, exploit kits, and other malware authors along with proven methods for circumventing and decoding these techniques. I will then apply these methods to guide the audience through the deobfuscation of a fully obfuscated script. Audience members will walk away with a solid understanding of how common obfuscation techniques are employed in scripting languages along with how they can be defeated.

Presenters:

• Mark Mager

Similar Presentations:

• DEF CON 25 (2017) / Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• BSidesDC 2017 / Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• ToorCon San Diego 20 (2018) / Following a Trail of Confusion: Identifying and Defeating Modern Malware Code Obfuscation