FLOSS (FireEye Labs Obfuscated String Solver)

FLOSS Cheatsheet

What It Is

Automatically extracts obfuscated strings from malware using static analysis, stack string decoding, and emulation.

Usage

floss suspicious.exe                    # Full analysis
floss -n 8 suspicious.exe              # Minimum string length 8
floss --only decoded suspicious.exe     # Only decoded strings
floss --json suspicious.exe             # JSON output

String Types Found

• Static strings: Normal embedded strings
• Stack strings: Built character-by-character on the stack
• Decoded strings: XOR, Base64, or custom decoded strings
• Tight strings: Short strings built in tight loops

When to Use

• Always run FLOSS instead of plain strings for malware
• Especially useful for packed or obfuscated samples
• Reveals C2 addresses, file paths, and commands hidden by encoding