CC-emotet-CMD-URL-extract

in each case below (except PDF), vary the drop_bytes_length value to frameshift through input until URL appear


---------
basic version to extract URL from raw CMD string

https://gchq.github.io/CyberChef/#recipe=Comment('put%20the%20raw%20%23emotet%20CMD%20string%20(inc%20%5E)%20into%20input,%20decrease%20drop_bytes_length%20one%20at%20a%20time%20until%20url%20appear')Drop_bytes(0,-10,false)Find_/_Replace(%7B'option':'Simple%20string','string':'%5E'%7D,'',true,false,true,false)Reverse('Character')Register('%5C%5C)%5B%20,;%5D*(%5C%5Cd)',true,false,false)Regular_expression('User%20defined','(.%7B1%7D).%7B$R0%7D',true,true,false,false,false,false,'List%20capture%20groups')Remove_whitespace(true,true,true,true,true,false)Split('@','%5C%5Cn')Split('%5C'','%5C%5Cn')Extract_URLs(false)