When Strings Are Obfuscated: FLOSS

• Malware often encrypts / stacks / builds strings at runtime to hide them from strings.
• FLOSS (Mandiant) automatically:
• extracts static strings (ASCII + UTF-16),
• recovers stack strings and tight-loop strings,
• emulates decoder functions to reveal decoded strings.
• Run FLOSS when plain strings comes back suspiciously empty.