Matryoshka
EasyMalware Reverse Engineering
Overview
Our forensics team found the source file for a malware attack that occurred. Can you help us extract the C2 server IP address?
flag format: flag{ip_address}
Lab Details
Prerequisites & Requirements
- Web Technologies: Familiarity with JavaScript, HTML Application (HTA) structures, and URL encoding.
- PowerShell Scripting: Basic understanding of execution policies and the Invoke-Expression (IEX) cmdlet.
- Windows Scripting Host: Awareness of how VBScript/JScript interact with the
WScript.Shellobject.
What will you learn?
- Recursive Deobfuscation: Iteratively decoding nested payloads hidden within legacy web formats.
- Data Normalization: Cleaning obfuscated code by identifying and removing noise (regex-based whitespace/tab removal).
- Behavioral Analysis: Identifying common malware behaviors, such as the use of
urlmon.dllfor remote file downloads. - IOC Identification: Extracting Command and Control (C2) infrastructure from finalized stage-payloads.
Tools
- Primary Tool: CyberChef (Operations: URL Decode , Find/Replace , Regex ).
- Identification: Unicode Character Inspecting tools.
Job Positions
Malware Analyst
Tags
Malware AnalysisStatic AnalysisC2 CommunicationIocsObfuscation