Common way of malware distribution, used i.e. by Locky ransomware are downloader scripts. They are spread in massive spam campaigns attached to e-mails. Using simple social engineering tricks attackers try to tempt recipients into running the attached file, that leads to downloading and deploying malicious payloads. Those scripts are most often obfuscated, using various tricks they try to hide the URL from where they get the payload. This time we will present some of the latest downloaders used to deliver Locky and show how to statically decipher their hidden URLs.”]