Like packing, the presence of obfuscated data in executable files often indicates a malicious disposition. If we can find a way to detect obfuscation techniques in a feed of suspicious files, then we can potentially identify new strains of malware as they are first collected.During this presentation, we’ll focus on stackstrings, a common technique that mixes code and data to break-up contiguous data and evade naïve malware analysis tools. I’ll demonstrate why FLOSS (the FireEye Labs Obfuscated String Solver) can pull out stackstrings of a file, but is not a good fit for hunting stackstrings at scale. Instead, we’ll see how to develop Yara rules that match C code constructs in compiled binaries. Finally, I’ll share an introduction to the Unicorn CPU engine and teach the audience how to emulate select portions of malware samples to deobfuscate stackstrings. We’ll see that the proposed solution can detect and decode stackstrings from thousands of samples per second, easily consuming the entire public VirusShare corpus (30 million samples).The audience will enjoy a real-world case study of scaling a hunting technique by relying on high-performance, open-source tools. We’ll see that with very few lines of code, we can implement a novel, yet effective, sieve for malware executable files. If all goes well, the audience will leave with renewed confidence to hunt for new malware families using Yara alongside binary code emulation.