FLOSS strings

floss <sample>

Extract strings from a binary with Mandiant's FLOSS, including obfuscated ones (stack strings, XOR) that normal strings miss.

Run it when static analysis needs the binary's strings: FLOSS (Faster Lightweight Obfuscated String Extractor) extracts normal strings plus obfuscated ones — stack strings (built character by character), XOR-decoded ones, and function argument strings. It's the malware analyst's strings: C2 URLs, paths, pipe names, and commands the malware hides from classic strings. In IR, FLOSS is the step that pulls IOCs from the sample: the C2 URL the payload hid, the dump path, the registry key.

Don't use it as a full analysis: FLOSS extracts strings, not capabilities or behavior — context (what the string does) requires a layer or manual analysis. Extracted strings include noise (binary data, library text): filtering by relevance (URLs, paths, commands) is part of the flow. And note: FLOSS works on the binary on disk — packed samples need unpacking first for obfuscated strings to come out complete. For strings from a memory dump, FLOSS supports the format (with the Volatility plugin).