Philippe Lagadec – decalage.info - @decalage2

More documents

Recommendations

Info

Disclaimer • The content of this presentation is personal work of its author. It does not represent any advice nor recommendation from his employer, and it does not constitute any official endorsement.
Au menu Red Side • Malicious Macros • Obfuscation, Anti-sandboxing • Advanced techniques • • Blue Side • Analysis • Detection & Protection
Page 1: Toulouse Hacking Convention 3 rd Ma
Page 5 and 6: What can a malicious macro do? •
Page 7 and 8: Sample VBA Dropper Private Declare
Page 9 and 10: Blue Side: Analysis
Page 11 and 12: olevba - extraction + analysis $ ./
Page 13 and 14: Services/Projects using olevba Vipe
Page 15 and 16: ViperMonkey • Olevba alone: 1. Ex
Page 17 and 18: Other Analysis Techniques • Loffi
Page 19 and 20: Macro Detection & Prevention • Wh
Page 21 and 22: MicroRaptor Picture published by Co
Page 23 and 24: MacroRaptor applications Mraptor_mi
Page 25 and 26: Conclusion VBA Macros are still a v
Page 27 and 28: Extra Slides
Page 29 and 30: Obfuscation iKJINJdg = StrReverse(C
Page 31 and 32: MS Office File Formats with macros
Page 33 and 34: oledump • http://blog.didiersteve
Page 35 and 36: oledump - plugins $ ./oledump.py ~/
Page 37 and 38: ViperMonkey - hello world
Page 39 and 40: ViperMonkey - what next • Minimal

Philippe Lagadec – decalage.info - @decalage2

Create successful ePaper yourself

Delete template?

Save as template?