Fnord - Designing Extractor For Obfuscated Code
Fnord is a designing extractor for obfuscated code Description Fnord has ii original functions: Extract byte sequences together with exercise to a greater extent than or less statistics Use these statistics, combine length, release of occurrences, similarity together with keywords to exercise a YARA rule 1. Statistics Fnord processes the file amongst a sliding window of varying size to extract all sequences of amongst a minimum length -m X (default: 4) upwards to a maximum length -x X (default: 40). For each length, Fnord volition introduce the close ofttimes occurring sequences -t X (default: 3) inward a table. Each business inward the tabular array contains: Length Number of occurrences Sequence (string) Formatted (ascii/wide/hex) Hex encoded form Entropy 2. YARA Rule Creation Fnord also generates an experimental YARA rule. During YARA dominion creation it volition calculate a marking based inward the length of the sequence together with the release of occ...