Over the last months, I’ve been quite busy working with my colleagues on report “Epic Manchego – atypical maldoc delivery brings flurry of infostealers“: we’ve tracked an actor creating a new type of malicious Office document.
To help with the automatic analysis of all the maldocs produced by this actor (several per day), I added new features to existing tools and created new tools.
I’m releasing this work in the coming months (some has already been published: oledump.py and zipdump.py).
Didier Stevens 
Just a few minutes ago there was a new sample: Bazaar 430b0f7bdcbd48c46ce405797e74e37db99e2c453e8dd434eeb57eb9217b1781
The VBA is very efficient
Comment by No — Wednesday 30 September 2020 @ 8:13
I’ll take a look.
Comment by Didier Stevens — Wednesday 30 September 2020 @ 15:57
Are the samples available somewhere to test existing protection tools on the local Webserver?
Comment by iko — Wednesday 30 September 2020 @ 20:48
Yes, all of the samples are on VirusTotal. And many samples are also available on malware bazaar (free download, no subscription). The samples’ hashes are listed in our report.
Comment by Didier Stevens — Wednesday 30 September 2020 @ 20:50