Philippe Lagadec – decalage.info - @decalage2

More documents

Recommendations

Info

olevba <strong>–</strong> Python API • How to integrate olevba into Python scripts: • Doc: https://github.com/<strong>decalage</strong>2/oletools/wiki/olevba from oletools.olevba import VBA_Parser, VBA_Scanner import sys vba = VBA_Parser(sys.argv[1]) if vba.detect_vba_macros(): print 'VBA Macros found' for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros(): print '-'*79 print 'Filename :', filename print 'OLE stream :', stream_path print 'VBA filename:', vba_filename print '- '*39 print vba_code print '- '*39 vba_scanner = VBA_Scanner(vba_code) results = vba_scanner.scan(include_decoded_strings=True) for kw_type, keyword, description in results: print 'type=%s - keyword=%s - description=%s' % (kw_type, keyword, description) else: print 'No VBA Macros found' vba.close()
Services/Projects using olevba Viper, REMnux, Hybrid-analysis.com, • Joe Sandbox, Deepviz, Laika BOSS, Cuckoo Sandbox, Anlyz.io, ViperMonkey, pcodedmp, dridex.malwareconfig.com, and probably VirusTotal.
Page 1 and 2: Toulouse Hacking Convention 3 rd Ma
Page 3 and 4: Au menu Red Side • Malicious Macr
Page 5 and 6: What can a malicious macro do? •
Page 7 and 8: Sample VBA Dropper Private Declare
Page 9 and 10: Blue Side: Analysis
Page 11: olevba - extraction + analysis $ ./
Page 15 and 16: ViperMonkey • Olevba alone: 1. Ex
Page 17 and 18: Other Analysis Techniques • Loffi
Page 19 and 20: Macro Detection & Prevention • Wh
Page 21 and 22: MicroRaptor Picture published by Co
Page 23 and 24: MacroRaptor applications Mraptor_mi
Page 25 and 26: Conclusion VBA Macros are still a v
Page 27 and 28: Extra Slides
Page 29 and 30: Obfuscation iKJINJdg = StrReverse(C
Page 31 and 32: MS Office File Formats with macros
Page 33 and 34: oledump • http://blog.didiersteve
Page 35 and 36: oledump - plugins $ ./oledump.py ~/
Page 37 and 38: ViperMonkey - hello world
Page 39 and 40: ViperMonkey - what next • Minimal

Philippe Lagadec – decalage.info - @decalage2

Create successful ePaper yourself

Delete template?

Save as template?