[SANS ISC] Microsoft Office VBA Macro Obfuscation via Metadata

I published the following diary on “Microsoft Office VBA Macro Obfuscation via Metadata“:

Often, malicious macros make use of the same functions to infect the victim’s computer. If a macro contains these strings, it can be flagged as malicious or, at least, considered as suspicious. Some examples of suspicious functions are:

  • Microsoft.XMLHTTP (used to fetch web data)
  • WScript.Shell (used to execute other scripts or commands)

… [Read more]



Leave a Reply

Your email address will not be published. Required fields are marked *