<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Deobfuscation &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/deobfuscation/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Tue, 21 Apr 2026 11:39:52 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Deobfuscation &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>VBA Beautifier Package</title>
		<link>https://blog.cerbero.io/vba-beautifier-package/</link>
					<comments>https://blog.cerbero.io/vba-beautifier-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 21 Apr 2026 11:38:34 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[VBA]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3392</guid>

					<description><![CDATA[We are happy to announce the beta release for commercial licenses of the VBA Beautifier package. It provides automated beautification and deobfuscation for VBA (Visual Basic for Applications) and VBS (VBScript) code, the most common macro language found in malicious Office documents. VBA macros remain one of the primary initial access vectors in the threat &#8230; <a href="https://blog.cerbero.io/vba-beautifier-package/" class="more-link">Continue reading<span class="screen-reader-text"> "VBA Beautifier Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/vba-beautifier-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3392</post-id>	</item>
		<item>
		<title>PowerShell Beautifier 4.0 Package</title>
		<link>https://blog.cerbero.io/powershell-beautifier-4-0-package/</link>
					<comments>https://blog.cerbero.io/powershell-beautifier-4-0-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 02 Apr 2026 12:36:06 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3351</guid>

					<description><![CDATA[We are happy to announce version 4.0 of the PowerShell Beautifier package. This is a major release. Previous versions relied on a custom tokenizer which, lacking knowledge of the language grammar, could not always correctly classify tokens. This required extensive workaround code and inevitably led to edge cases where deobfuscation would fail. Version 4.0 replaces &#8230; <a href="https://blog.cerbero.io/powershell-beautifier-4-0-package/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Beautifier 4.0 Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-beautifier-4-0-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3351</post-id>	</item>
		<item>
		<title>Extreme PowerShell Obfuscation</title>
		<link>https://blog.cerbero.io/extreme-powershell-obfuscation/</link>
					<comments>https://blog.cerbero.io/extreme-powershell-obfuscation/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 17 May 2023 07:41:37 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2709</guid>

					<description><![CDATA[We recently stumbled upon an old article by Daisuke Mutaguchi explaining an extreme technique for PowerShell obfuscation. The article is in Japanese, so you may have to use Google translate. Here&#8217;s the final example provided by the author of the article: ${;}=+$();${=}=${;};${+}=++${;};${@}=++${;};${.}=++${;};${[}=++${;}; ${]}=++${;};${(}=++${;};${)}=++${;};${&#38;}=++${;};${&#124;}=++${;}; ${&#34;}=&#34;[&#34;+&#34;$(@{})&#34;[${)}]+&#34;$(@{})&#34;[&#34;${+}${&#124;}&#34;]+&#34;$(@{})&#34;[&#34;${@}${=}&#34;]+&#34;$?&#34;[${+}]+&#34;]&#34;; ${;}=&#34;&#34;.(&#34;$(@{})&#34;[&#34;${+}${[}&#34;]+&#34;$(@{})&#34;[&#34;${+}${(}&#34;]+&#34;$(@{})&#34;[${=}]+&#34;$(@{})&#34;[${[}]+&#34;$?&#34;[${+}]+&#34;$(@{})&#34;[${.}]); ${;}=&#34;$(@{})&#34;[&#34;${+}${[}&#34;]+&#34;$(@{})&#34;[${[}]+&#34;${;}&#34;[&#34;${@}${)}&#34;]; &#34;${&#34;}${.}${[}+${&#34;}${)}${@}+${&#34;}${+}${=}${+}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${+}${+}+${&#34;}${[}${[}+${&#34;}${.}${@}+${&#34;}${+}${+}${&#124;}+${&#34;}${+}${+}${+}+${&#34;}${+}${+}${[}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${=}${=}+${&#34;}${.}${.}+${&#34;}${.}${[}&#124;${;}&#34;&#124;&#38;${;}; Yes, this is valid PowerShell. Although there are &#8230; <a href="https://blog.cerbero.io/extreme-powershell-obfuscation/" class="more-link">Continue reading<span class="screen-reader-text"> "Extreme PowerShell Obfuscation"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/extreme-powershell-obfuscation/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2709</post-id>	</item>
		<item>
		<title>PowerShell Beautifier 2.0 Package</title>
		<link>https://blog.cerbero.io/powershell-beautifier-2-0/</link>
					<comments>https://blog.cerbero.io/powershell-beautifier-2-0/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 20 Mar 2023 13:42:32 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2606</guid>

					<description><![CDATA[We have released version 2.0 of our commercial PowerShell Beautifier package. The new release adds the option to remove unused variables. For example, this is a snippet of a malicious script: $T = &#039;Get&#039; $M = $T + &#039;Method&#039; $I = &#039;Invoke&#039; $T = $T + &#039;Type&#039; $L = &#039;Load&#039; $Q0 = [Reflection.Assembly] $B = &#8230; <a href="https://blog.cerbero.io/powershell-beautifier-2-0/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Beautifier 2.0 Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-beautifier-2-0/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2606</post-id>	</item>
		<item>
		<title>PowerShell Beautifier Package</title>
		<link>https://blog.cerbero.io/powershell-beautifier-package/</link>
					<comments>https://blog.cerbero.io/powershell-beautifier-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 02 Mar 2023 11:35:41 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[beautifier]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2533</guid>

					<description><![CDATA[PowerShell code is often seen in malware. To help the analysis of such code we have just released the &#8220;PowerShell Beautifier&#8221; package. The package is available to all commercial licenses of Cerbero Suite Advanced. The package features a complete parser for the PowerShell language and has many deobfuscation capabilities. If your organization is interested in &#8230; <a href="https://blog.cerbero.io/powershell-beautifier-package/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Beautifier Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-beautifier-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2533</post-id>	</item>
		<item>
		<title>Video: In-Depth Obfuscated VBA Analysis</title>
		<link>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/</link>
					<comments>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 11 Nov 2020 08:44:24 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1946</guid>

					<description><![CDATA[This script concatenates strings such as &#8220;a&#8221; + &#8220;b&#8221;: from Pro.UI import * import re ctx = proContext() v = ctx.getCurrentView() if v.isValid() and v.hasSelection(): s = v.getSelectedText().replace('" &#038;', '" +') s = eval(s) v.setSelectedText('"' + s + '"') This second script decrypts strings the same way as the &#8220;NobosMeik&#8221; function: from Pro.UI import * &#8230; <a href="https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: In-Depth Obfuscated VBA Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1946</post-id>	</item>
	</channel>
</rss>
