Decoding Binary Numeric Expressions, (Mon, Nov 17th)
ID: 41486b66-5db2-5a6f-8875-7f5126490bc7
STIX ID: report--41486b66-5db2-5a6f-8875-7f5126490bc7
Feed Name: SANS ISC Diary
This diary entry explains how Didier Stevens updated his numbers-to-hex tool to support binary numeric expressions (like 79+1) so that obfuscated numeric arrays can be converted correctly to hexadecimal and reveal strings (for example, variants of "POWERSHELL"); the post is a technical demonstration of the decoding process and tool usage rather than an incident report.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.