Chapter 8 – De-Obfuscating Malicious Scripts – Putting the Toothpaste Back in the Tube

1. While the information necessary could easily have been gleaned by behavioral analysis, you could have gained an understanding of the script by de-obfuscating the code through VBSEdit. Once done, it should become clear the site in question is domenuscdm[.]com.
2. Utilizing the same methodology, you should have been able to find the malware utilizing MsXmlHttp to download the secondary stages and make HTTP requests to the site.
3. This one is a bit trickier. However, with the right recipe, you will get a good start. The correct recipe is as follows:

   – From Base64

   – Remove Null Bytes

   However, as you've noticed, things seem to be out of order and splatted, as discussed in the chapter by utilizing numbers in curly braces. When put into the order specified, the following domains become clear:

   hxxp[://]missbonniejane[.]com/H/

   hxxp[://]daze[.]com[.]hk/yaeRXq/

   hxxp[://]funkystudio...