CyberChef

CyberChef Cheatsheet

What It Is

Web-based data transformation tool (the "Cyber Swiss Army Knife"). Drag-and-drop operations for encoding, decoding, encryption, and data analysis.

Access

• Online: gchq.github.io/CyberChef
• Offline: Download from GitHub for air-gapped analysis

Most Common Recipes for Malware Analysis

Base64 Decode

Input: cG93ZXJzaGVsbCAtZW5jIFc...
Recipe: From Base64

XOR Brute Force

Recipe: XOR Brute Force
  Key length: 1
  Sample length: 100
Look for: readable strings in output

XOR with Known Key

Recipe: XOR
  Key: 0x41 (or multi-byte key)
  Scheme: Standard

Hex Decode

Input: 4d5a9000...
Recipe: From Hex → delimiter: Auto

URL Decode

Input: %68%74%74%70%3a%2f%2f...
Recipe: URL Decode

ROT13

Recipe: ROT13
  (or ROT47 for full ASCII rotation)

Multi-Layer Decode

Chain operations for multi-layer obfuscation:

Recipe: From Base64 → XOR (key: 0x55) → Gunzip

Extract URLs/IPs

Recipe: Extract URLs
  (or: Extract IP addresses)

Strings Extraction

Recipe: Strings
  Minimum length: 6
  Display total: checked

RC4 Decrypt

Recipe: RC4
  Passphrase: [key from analysis]
  Input format: Hex

AES Decrypt

Recipe: AES Decrypt
  Key: [hex key]
  IV: [hex IV]
  Mode: CBC
  Input: Hex

Pro Tips

• Save recipes — click the save icon to preserve complex chains
• Magic button — auto-detects encoding and suggests operations
• Fork — split input and process each part independently
• Regular Expression — extract specific patterns from decoded output
• Render Image — view extracted image data (screenshots, icons)

Common Malware Patterns