Macro Archives | /dev/random

[SANS ISC] A Safe Excel Sheet Not So Safe

March 6, 2020 Malware, SANS Internet Storm Center, Security 2 comments

I published the following diary on isc.sans.edu: “A Safe Excel Sheet Not So Safe“: I discovered a nice sample yesterday. This excel sheet was found in a mail flagged as “suspicious” by a security appliance. The recipient asked to release the mail from the quarantine because “it was sent from

[SANS ISC] Antivirus Evasion? Easy as 1,2,3

May 25, 2018 Malware, SANS Internet Storm Center One comment

I published the following diary on isc.sans.org: “Antivirus Evasion? Easy as 1,2,3“: For a while, ISC handlers have demonstrated several obfuscation techniques via our diaries. We always told you that attackers are trying to find new techniques to hide their content to not be flagged as malicious by antivirus products.

[SANS ISC] Microsoft Office VBA Macro Obfuscation via Metadata

December 16, 2017 Malware, Security 2 comments

I published the following diary on isc.sans.org: “Microsoft Office VBA Macro Obfuscation via Metadata“: Often, malicious macros make use of the same functions to infect the victim’s computer. If a macro contains these strings, it can be flagged as malicious or, at least, considered as suspicious. Some examples of suspicious functions

[SANS ISC] Base64 All The Things!

October 9, 2017 Malware, SANS Internet Storm Center, Security One comment

I published the following diary on isc.sans.org: “Base64 All The Things!“. Here is an interesting maldoc sample captured with my spam trap. The attached file is “PO# 36-14673.DOC” and has a score of 6 on VT. The file contains Open XML data that refers to an invoice.. [Read more]

[SANS ISC Diary] Another Day, Another Malicious Behaviour

September 30, 2016 Malware, SANS Internet Storm Center, Security 9 comments

I published the following diary on isc.sans.org: “Another Day, Another Malicious Behaviour“. Every day, we are spammed with thousands of malicious emails and attackers always try to find new ways to bypass the security controls. Yesterday, I detected a suspicious HTTP GET request: … [Read more]

Deobfuscating Malicious VBA Macro with a Few Lines of Python

May 8, 2015 Malware, Security 23 comments

Just a quick post about a problem that security analysts are facing daily… For a while, malicious Office documents are delivered with OLE objects containing VBA macros. Bad guys are always using obfuscation techniques to make the analysis more difficult and (try to) bypass basic filters. This makes the analysis

Malicious MS Word Document not Detected by AV Software

April 7, 2015 Malware, Security 12 comments

[This blogpost has also been published as a guest diary on isc.sans.org] Like everybody, I’m receiving a lot of spam everyday but… I like it! All unsocilited received messages are stored in a dedicated folder for two purposes: An automatic processing via my tool mime2vt A manual review at regular interval