Blindeagle Jc46 Obfuscation Toolmarks
Detects Blind Eagle JC-46 VBScript/JScript loader obfuscation toolmarks: zv-prefixed self-mutating XOR decryptor with 0xE0 key, junk arithmetic index shuffle, custom RC4-like stream decoder, custom AES S-box/RCON with 0xA5 mask, Wales() decimal decoder, Base28 alphabet, and oversized VBScript droppers
YARA
