06.03.2017 Views

Philippe Lagadec – decalage.info - @decalage2

esi4ybW

esi4ybW

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Obfuscation<br />

• To hide important <strong>info</strong>rmation:<br />

URLs where payload is downloaded from,<br />

IP addresses of accessed servers,<br />

Name of created files, etc.<br />

• Usual Techniques :<br />

Split and concatenate strings,<br />

Chr, ChrB, Chr$, etc : convert ASCII codes into characters<br />

Asc : inverse of Chr<br />

StrReverse : string inversion<br />

Strings encoded into Base64, hexadecimal, xor, etc<br />

Dead code insertion<br />

code spread over several modules<br />

Random variable and function names<br />

Strings stored outside of the macro code, for example inside the<br />

Word or Excel document text

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!