FLOSS (FLARE Obfuscated String Solver, by Mandiant) automatically extracts obfuscated strings from malware. Authors routinely hide URLs, registry keys, and commands so that the classic strings utility finds nothing useful. FLOSS goes further: it identifies decoding routines inside the binary, emulates them, and recovers the plaintext — surfacing stack strings, tight strings, and decoded strings that static extraction misses. It is a first-step triage tool for any Windows malware sample.
Analyze malware only in an isolated VM/sandbox. FLOSS emulates code from the sample.
Installation
| Method | Command |
|---|
| Standalone binary | Download from GitHub Releases (Windows/Linux/macOS) |
| pip | pip install flare-floss |
| Verify | floss --version |
Basic Usage
| Command | Description |
|---|
floss malware.exe | Extract all string types |
floss -j malware.exe | JSON output |
floss --no static malware.exe | Skip plain static strings |
floss -n 6 malware.exe | Minimum string length 6 |
floss --help | Full option list |
String Types FLOSS Recovers
| Type | What it is |
|---|
| Static | Ordinary strings (what strings finds) |
| Stack | Built character-by-character on the stack at runtime |
| Tight | Constructed in tight loops, never fully in memory at once |
| Decoded | Produced by a decoding routine (XOR, RC4, custom) |
The last three are the value-add — they are invisible to strings because they never exist as contiguous bytes in the file.
Selecting Analysis Types
| Flag | Effect |
|---|
--only static | Only plain strings (fast) |
--only stack | Only stack strings |
--only tight | Only tight strings |
--only decoded | Only emulated/decoded strings |
--no decoded | Skip the (slow) emulation phase |
# Fast triage: skip emulation
floss --no decoded sample.exe
# Deep pass: everything, JSON for tooling
floss -j sample.exe > strings.json
Triage Signals to Grep For
| Pattern | Suggests |
|---|
| URLs / IPs | C2 infrastructure |
HKLM\, HKCU\ | Persistence via registry |
cmd.exe, powershell | Command execution |
CreateRemoteThread, VirtualAlloc | Process injection |
| Base64 blobs | Embedded payloads |
.onion, wallet addresses | Ransomware/exfil |
floss sample.exe | grep -iE "http|\.exe|HKLM|powershell|AppData"
Output & Integration
| Option | Purpose |
|---|
-j / --json | Machine-readable output for pipelines |
-v / -vv | Verbose / debug |
--functions 0x401000 | Focus emulation on specific functions |
| IDA/Ghidra scripts | Annotate recovered strings back into the disassembly |
Feeding FLOSS output back into Ghidra as comments makes subsequent manual analysis far faster.
Common Workflows
# Standard malware triage sequence
floss -j sample.exe > floss.json # recover strings
jq -r '.strings.decoded[].string' floss.json | sort -u # focus on decoded
# → pivot to Ghidra/x64dbg on the functions that produced interesting strings
# Compare variants: which strings changed between samples?
floss --no decoded a.exe > a.txt; floss --no decoded b.exe > b.txt
diff a.txt b.txt
| Tool | Recovers |
|---|
| FLOSS | Static + stack + tight + decoded (emulation) |
strings | Contiguous printable bytes only |
| capa | Capabilities/behaviors, not strings |
| Detect It Easy | Packer/compiler identification |
A standard triage trio: Detect It Easy to identify packing, FLOSS to recover strings, capa to enumerate capabilities.
Resources
