You are being exposed to malicious scripts in one form or another every day, whether it be in email, malicious documents, or malicious websites. Many malicious scripts at first glance appear to be impossible to understand. However, with a few tips and some simple utility scripts, you can deobfuscate them in just a few minutes.
SANS Instructor Evan Dygert conducted a webcast on October 3rd, 2018. This webcast teaches you how to cut through the obfuscation techniques the script authors use and not spend a lot of time doing it. Evan also demonstrates how to quickly deobfuscate a variety of malicious scripts.
The samples of the scripts he provided during the webcast can be downloaded here: https://dfir.to/MaliciousScripts. Please note the password for the samples.zip folder is: "infected"
New CheatSheets you might be interested in:
Tips for Reverse-Engineering Malicious Code - This cheat sheet outlines tips for reversing malicious Windows executables via static and dynamic code analysis with the help of a debugger and a disassembler. Download Here
REMnux Usage Tips for Malware Analysis on Linux - This cheat sheet outlines the tools and commands for analyzing malicious software on the REMnux Linux distribution Download Here
Cheat Sheet for Analyzing Malicious Documents - This cheat sheet presents tips for analyzing and reverse-engineering malware. It outlines the steps for performing behavioral and code-level analysis of malicious software. Download Here
Malware Analysis and Reverse-Engineering Cheat Sheet - This cheat sheet outlines tips and tools for analyzing malicious documents, such as Microsoft Office, RTF and Adobe Acrobat (PDF) files Download Here
For opportunities to take the FOR610 course, consider upcoming runs and modalities:
US & International live training : Live events offered throughout the US, EMEA & APAC regions.
DFIR Summits : Two days of industry expert talks plus DFIR training events
Simulcast : Live events from anywhere in the world.
OnDemand : Learn at your own pace, anytime, anywhere.
DFIR Resources: Digital Forensic Blog | Twitter | Facebook | Google+ | Community Listservice | DFIR Newsletter