A small Powershell script leads to a longer #CyberChef recipe.
(1/6): Let's extract the obfuscated section with a regular expression: a regex lookahead/lookbehind.
(1/6): Let's extract the obfuscated section with a regular expression: a regex lookahead/lookbehind.
(2/6) We're going to convert the obfuscated text into Character Codes.
(3/6) Now, following the script we have to subtract 1 from each of the Character Code values and convert it back again. So we put a 1 next to each value with a Find/Replace...
(4/6) and then 'Fork' (i.e treat each line separately), 'Subtract', then 'Merge' back together
(5/6) Convert back from CharCode and voila...our script.
(6/6) If you made it this far then a dirty Firefox secret is that they don't support Regex Look Behinds, so Chrome only....
