Quickpost: PDF/ActiveMime Maldocs YARA Rule
Here is a YARA rule I developed to detect PDF/ActiveMime maldocs I wrote about in “Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs“. It looks for files that start with %PDF- (this header can be...
View ArticleClik here to view.
Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs
jpcert reported a new type of maldoc: “MalDoc in PDF – Detection bypass by embedding a malicious Word file into a PDF file –“. These maldocs are PDF files that embed a Word document (ActiveMime) in...
View ArticleClik here to view.
New Tool: onedump.py
This is a new tool (based on my Python template for binary files) to analyze OneNote files. This version is limited to handling embedded files (for the moment). As I might still make significant...
View ArticleClik here to view.
Combining zipdump, file-magic And myjson-filter
In this blog post, I show how you can combine my tools zipdump.py, file-magic.py and myjson-filter.py to select and analyze files of a particular type. I start with a daily batch of malware files...
View ArticleClik here to view.
Combining dns-pydivert And dnsresolver
I use my tools dns-pydivert and dnsresolver.py for dynamic analysis of software (malware and benign software). On the virtual machine where I’m doing dynamic analysis, I disable IPv6 support. I...
View ArticleClik here to view.
Extracting Certificates For Defender
A colleague asked me for help with extracting code signing certificates from malicious files, to add them to Defender’s block list. The procedure involves right-clicking the EXE in Windows Explorer,...
View ArticleMaldoc Analysis Video – Rehearsed & Unrehearsed
When I record maldoc analysis videos, I have already analyzed the maldoc prior to recording, and I rehearse the recording. This time, I also recorded the unrehearsed analysis: when I take the first...
View ArticleExamples Of Encoding Reversing
I recently created 2 blog posts with corresponding videos for the reversing of encodings. The first one is on the ISC diary: “Decoding Obfuscated BASE64 Statistically“. The payload is encoded with a...
View ArticleClik here to view.
Another Exercise In Encoding Reversing
In this blog post, I will show how to decode a payload encoded in a variation of hexadecimal encoding, by performing statistical analysis and guessing some of the “plaintext”. I do have the decoder...
View ArticlePoC: Cobalt Strike mitm Attack
I did this about 6 months ago, but this blog post didn’t get posted back then. I’m posting it now. I made a small Proof-of-Concept: cs-mitm.py is a mitmproxy script that intercepts Cobalt Strike...
View ArticleClik here to view.
.ISO Files With Office Maldocs & Protected View in Office 2019 and 2021
We have seen ISO files being used to deliver malicious documents via email. There are different variants of this attack. One of the reasons to do this, is to evade “mark-of-web propagation”. When a...
View ArticleMiTM Cobalt Strike Network Traffic
I made a small PoC. cs-mitm. py is a mitmproxy script that intercepts Cobalt Strike traffic, decrypts it and injects its own commands. In this video, a malicious beacon is terminated by sending it an...
View ArticleClik here to view.
“Public” Private Cobalt Strike Keys
I found 6 private keys used by malicious Cobalt Strike servers. There’s a significant number of malicious CS servers on the Internet that reuse these keys, thus allowing us to decrypt their C2...
View ArticleClik here to view.
Patching A Java .class File
010 Editor is one of few commercial applications that I use daily. It’s a powerful binary editor with scripting and templates. I recently had to patch a Java .class file: extend a string inside that...
View ArticleClik here to view.
Quickpost: Decrypting Cobalt Strike Traffic
I have been looking at several samples of Cobalt Strike beacons used in malware attacks. Although work is still ongoing, I already want to share my findings. Cobalt Strike beacons communicating over...
View ArticleClik here to view.
Quickpost: oledump.py plugin_biff.py: Remove Sheet Protection From Spreadsheets
My new version of plugin_biff.py has a new option: –hexrecord. Here I’ll show how I use this to remove the sheet protection from malicious spreadsheets. If you want to open a malicious spreadsheet (for...
View ArticleClik here to view.
Update: XORSelection.1sc Version 6.0
I released an update to my 010 Editor script XORSelection.1sc. 010 is a binary editor with a scripting engine. XORSelection.1sc is a script I wrote years ago, that will XOR-encode a (partial) file open...
View ArticleVideo: Maldoc Analysis With CyberChef
In this video, I show how to analyze a .doc malicious document using CyberChef only. This is possible, because the payload is a very long string that can be extracted without having to parse the...
View ArticleClik here to view.
Update: oledump.py Version 0.0.50
This new version brings updates to plugin plugin_biff.py. This plugin can now produce a CSV list of cell values and formulas (option -c) or a JSON file of values and formulas (option -j). Cell...
View ArticleClik here to view.
April 1st 2020: FlashPix File With VBA Code
Last year, there was some misunderstanding regarding Office Documents with VBA code mistakenly identified as FlashPix picture files. The FlashPix picture format is an old format, based on the Compound...
View Article
