2021-01-20 Emotet CyberChef Recipe

Emotet URL Decoder
==================
1. Open the .doc file using CyberChef
2. Paste in the following CyberChef recipe:

Strings('Single byte',10000,'Alphanumeric + punctuation (A)',false)
Drop_bytes(0,144,false)
Find_/_Replace({'option':'Simple string','string':'sg yw
'},'',true,false,true,false)
Find_/_Replace({'option':'Simple
string','string':'ah'},'',true,false,true,false)
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple
string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple
string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple
string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple
string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple
string','string':'`'},'',true,false,true,false)
Split('@','\\n')
Find_/_Replace({'option':'Simple
string','string':'ah'},'http',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'!sg'},'
',true,false,true,false)
Extract_URLs(false)

I used this recipe today to extract all of the payload urls from about 25 Word documents.
It's highly likely that this will stop working at some point.
At the same time, I've been using the bottom half of this recipe for months now.
You just have to swap out some of the obfuscation characters because they change those regularly.

Thanks to the incredible Didier Stevens @DidierStevens for coming up with the original idea.
https://www.youtube.com/watch?v=pJvQgUk01k4