Beyond Context Windows: When Malware Stops Fitting into Naive Automated Analysis
João Pedro Dias
Another fun ride with a malware sample from out there in the wild. As is often the case, it all starts with yet another fake overdue bill reminder. This one contains a VBS script that uses string-splitting, Chr() arithmetic, and multi-variable Base64 encoding to deliver a 111 MB Delphi PE...