FLARE Obfuscated String Solver (FLOSS)

FLARE Obfuscated String Solver (FLOSS) is a static analysis tool designed to automatically extract and deobfuscate strings from malware binaries. The tool addresses the common evasion technique where malware authors obfuscate key portions of executables, particularly strings and resources used to configure domains, files, and other infection artifacts. FLOSS extracts multiple types of strings that traditional tools like strings.exe cannot detect: - Static strings: Regular ASCII and UTF-16LE strings - Stack strings: Strings constructed on the stack at runtime - Tight strings: A specialized form of stack strings decoded on the stack - Decoded strings: Strings decoded within functions The tool uses advanced static analysis techniques to identify and recover obfuscated strings without requiring dynamic execution of the malware sample. This capability enhances basic static analysis workflows by revealing hidden configuration data, command and control information, and other critical artifacts that would otherwise remain concealed through obfuscation techniques.