CyberChef Recipe to Loop Over Values to Modify and Decode

It's common during malware analysis to find lists, or arrays, of data that you need to decode. However, the data first needs to be manipulated before it can be decoded. In this video, we'll look at a CyberChef recipe to help you do just that. We'll use a recent HTA file used to download SnakeKeylogger that hides a Powershell script in an array of numeric values. To decode this array, an arbitrary value must first be subtracted, this is where …

analysis array cyberchef data download find fork hta lists loop malware malware analysis powershell powershell script recipe script value video