How it works
1
Grab the sample
Each tutorial starts with a real-style obfuscated script.
3
Understand the payload
Learn what the malware does, how the obfuscation works, and how to detect it.
Tutorials
01
PowerShell
02
PowerShell Download Cradle
Base64-encoded download cradle that fetches and executes a remote payload. Common in phishing attacks and initial access.
VBA
03
VBA Chr() String Building
Macro that reconstructs a URL using Chr() function calls with line continuations. Standard technique in Office macro malware.
JavaScript
JavaScript Multi-Layer Obfuscation
JavaScript combining hex escapes, Unicode escapes, base64, and fromCharCode — multiple obfuscation layers in one script.
Tools used
- AI Deobfuscator — Static and LLM-powered deobfuscation for PowerShell, VBA, and JavaScript
- Cyber Cheatsheet — 800+ pentesting commands across 43 sections