I wrote a Python program to decode encoded VBS scripts (VBE).
decode-vbe_V0_0_1.zip (https)
MD5: 87E61217BC77275DBACEA77B8EDF12B5
SHA256: 11A9B5D47657C123845007E3E29FB331CAE7483B6A4A3AC54276DB90116911B5
Tuesday 29 March 2016
Decoding VBE
Overview of Content Published In February
Here is an overview of content I published in February:
Blog posts:
- Update: numbers-to-hex.py Version 0.0.2
- Create Your Own CMD.XLS
- Update: translate.py Version 2.2.0 for Locky JavaScript Deobfuscation
- More Obfuscated MIME Type Files
SANS ISC Diary entries:
Tuesday 22 March 2016
YARA Rule To Detect VBE Scripts
Malicious documents that drop VBE scripts (VBScript Encode scripts) are in the wild. Here is an example:
I have a YARA rule to detect VBE scripts:
yara-rules-V0.0.6.zip (https)
MD5: 01CB37759AC30EEA8D2B66226609C73E
SHA256: 1B56C1D7D0E1A8F500674B74F93F3E7DE6B2EFC85259ABE3A57F1DCA458CCFF8
Friday 11 March 2016
Update: oledump.py Version 0.0.23
I’m providing a 2-day training at Brucon Spring Training 2016: “Analysing Malicious Documents“. Use promo-code SPRING16 for a 10% discount.
This new version of oledump brings an update to the –cut option and a new plugin: plugin_hifo.
As I documented in this ISC Diary entry, maldocs can store URLs in properties of userforms:
The plugin plugin_hifo is a simple plugin that looks for streams that end with /o and then searches for strings starting with http (hence the name: http in form /o).
oledump_V0_0_23.zip (https)
MD5: 991910FF4AA47808A5BBCE0CC109D41A
SHA256: 612B6FD06856C7790D2F66B29286E7B89D35D8354ADB167CA512CC1CDE3F6C47
Saturday 5 March 2016
Even More Obfuscated MIME Type Files
I’m providing a 2-day training at Brucon Spring Training 2016: “Analysing Malicious Documents“. Use promo-code SPRING16 for a 10% discount.
I received another maldoc sample (MD5 73D06B898E03395DA3D60D11E49751CC):
Lines 2, 3, 6, 7 and 8 are there to obfuscate this MIME type file. emldump.py now detects all lines without a colon in the first block (all lines before the empty line 9: 1 – 8).
You can filter out these lines with option -f:
emldump_V0_0_8.zip (https)
MD5: B6FBAF2AB403AFE30F7C3D7CA166793B
SHA256: 7A7016B29F291C3D42B43D43B265DAD86B96DA519DB426163CC2D15C556896E3
Didier Stevens 