Hello, good evening everyone. I just want to share one thing that I discovered today. Basically we had an incident. We were targeted with a fishing attack and some kind of malicious sample of HTML. This one was delivered to one of the folks in the company. And I felt that in the reversing this and checking this, the open eye dot GPT may be useful because it has more knowledge done me probably and can computing faster and it sees basically what is seen by the computer from the from the from the beginning. So what I did is, first of all, I've seen that this is the HTML attachment. Yes. So this was kind of suspicious because HTML files are not commonly used and this is kind of popular attack attacking a deaf, yeah, delivery method for for executing some kind of malicious malicious executables onto the windows. And those systems. Okay, so what I did I've opened this kind of malicious HTML or maybe suspicious at that moment. And I found out that there is a lot a bunch of highly sophisticated stuff in here. As you can see, you can see some kind of robots, Google bots meta, information, slurp, et cetera, et cetera, XUA compatible, et cetera, et cetera, yeah. And there is some kind of target the email. Of course, it was redacted by me. And what I did next is idea was the the the call this bunch of base 64 stuff that is actually embedded in here. And I did it with the chatbot, mouse or with with the cyber chef. Okay, and we return something like this. The best for your. The really there is a bunch of bunch of stuff that is that looks highly upfuscated also we can see here some kind of alpha, the chance and numbers. So I assume there will be some kind of decoding or decrypting of of this bunch of stuff, but to do it in fast way, I just opened the new chat with chat GPT and asking a few questions. And he or he will perform this kind of reversing faster. And as you can see, I have asked him if he can optimize the code because I didn't want to basically directly ask him to help for skate the code because it will ask me if this is malicious code, et cetera, I may deny it. So I asked him to optimize the code he asked me for the context of this code as you see, I providing the language environment and also the this is the upfuscated code I need to understand what it does. And he reorganized this code and some kind of cleared it. So you can see there is not so much messing here that were previously. Yeah. Okay. Then I stated that we do something on Windows machines, so specifying more clarifying the environment. Okay, he did some bunch of stuff basically didn't want to perform some kind of reverse engineering because this is the machine and state that he cannot perform reverse engineering as you can see. But asking him to call it in power, shall he provided it for me something like this. Okay. And asking him to decode the encoded phase meaning fragment. So you can see here and call it command and bunch of bunch of bunch of letters. It returned me the both script shall object, which is obvious that this will try to execute something. And as you can see it created this constants. So clarifying the object setting temp folder for it and providing file name here, we can see basics if we're encoded file. Yeah, so there is our executable. I will copy it for demonstration. And then it did this kind of stuff for the crypt ing it. And saving it to this temp folder and file names. So on the our temp slash payload, we would see this payload I want executed because this is for 300% while issues. And I tried to ask him if he could possibly tell me what this encoded file do, but what tonight cannot or reverse engineered. I will deep dive more in this later. So I was able to basically, they are first created meaning the record original malware executable from from from here basically five minutes probably. So can you imagine how, how faster it is for the model, and it's now to the opposite of all of this bunch stuff. Compared to the previous times when the AI cannot help with this, they probably would have to spend a lot a bunch of time or in, you know, setting all of the puzzles in here. And I did it in five minutes probably I strongly recommend to proceed with this with this with this model and what is this buff. So first stage of of four n zicks or this kind of malware investigations are really boosted with this machine learning capabilities. That's all thank you very much. This is my first recording.