FLARE-FLOSS: extracting obfuscated malware strings beyond grep
Tutorial on using FLARE-FLOSS to recover hidden indicators of compromise (IOCs) from Windows PE files, walking through setup, synthesis of obfuscated test binaries, and comparison of extraction methods.
• Stack-built strings (constructed at runtime)
• Tight strings (minimal padding, harder to spot)
• XOR-decoded strings (single-byte cipher)
• Classic static string analysis limitations