Didier Stevens

Here is an overview of content I published in March:

Blog posts:

• Quickpost: Using Suricata on Windows
• CTRL-Z is EOF

SANS ISC Diary entries:

• Wireshark and USB
• “Error 19874: You must have Office Professional Edition to read this content, please upgrade your licence.”
• Phishing PDFs with multiple links

Here is an overview of content I published in February:

Blog posts:

• Quickpost: Code To Connect To Tor Onion Service
• Quickpost: Remote Shell On Windows Via Tor Onion Service
• Update: python-per-line version 0.0.3
• Update: hash.py Version 0.0.2
• Update: jpegdump.py Version 0.0.4
• Update: pdfid.py Version 0.2.4
• Update: translate.py Version 2.5.3
• Update: oledump.py Version 0.0.33
• Update: pecheck.py Version 0.7.2
• Quickpost: Using nmap With Tallow (Tor proxy)
• Wireshark Comments

YouTube videos:

• Wireshark comments

SANS ISC Diary entries:

• Analyzing an HTA file
• Analyzing an HTA file: Update
• An autograph from the Dridex gang
• Finding VBA signatures in Word documents
• Analyzing compressed shellcode
• Finding VBA signatures in .docm files
• Analyzing MSI files
• Retrieving malware over Tor on Windows

Here is an overview of content I published in January:

Blog posts:

• New Tool: What Is New?
• Update: xmldump.py Version 0.0.2
• Update: format-bytes.py Version 0.0.4
• Quickpost: Data Exfiltration With Tor Browser And Domain Fronting
• Quickpost: Retrieving Malware Via Tor On Windows
• New Tool: jpegdump.py
• Update: translate.py Version 2.5.2
• Update: rtfdump.py Version 0.0.7

YouTube videos:

• .xlsm: Button & VBA & PowerShell & EXE
• VirusTotal Upload

SANS ISC Diary entries:

• What is new?
• PDF documents & URLs: video
• Peeking into Excel files
• Decrypting malicious PDFs with the key
• An RTF phish
• Retrieving malware over Tor
• HTTPS on every port?
• Is this a pentest?
• Comment your Packet Captures – Extra!

NVISO Blog posts:

• Windows Credential Guard & Mimikatz

Here is an overview of content I published in December:

Blog posts:

• Update: rtfdump.py Version 0.0.6
• New Tool: hash.py
• Update: plugin_biff.py Version 0.0.2 / oledump.py Version 0.0.31
• New oledump Plugin: plugin_msg.py / oledump.py Version 0.0.32
• New Tool: xmldump.py
• New Tool: format-bytes.py
• Cracking Encrypted PDFs – Part 1
• Cracking Encrypted PDFs – Part 2
• Cracking Encrypted PDFs – Part 3
• Cracking Encrypted PDFs – Conclusion

YouTube videos:

• PDF’s /URI
• Dealing with obfuscated rtf files
• .xlsm: Button & VBA & PowerShell & EXE

Videoblog posts:

• Bash Bunny InfiniteControl Payload
• PyBoard LCD160CR Text Scrolling
• PDF’s /URI
• Dealing with obfuscated rtf files

SANS ISC Diary entries:

• Sometimes it’s a dud
• Phish or scam? – Part 1
• Phish or scam? – Part 2
• Encrypted PDFs
• PDF documents & URLs: update
• Dealing with obfuscated RTF files
• Analyzing TNEF files

Here is an overview of content I published in November:

Blog posts:

• Analyzing Metasploit’s Office Maldoc
• Update: byte-stats.py Version 0.0.7
• Update: cut-bytes.py Version 0.0.6
• Update: pecheck.py Version 0.7.1
• Update: oledump.py Version 0.0.30
• Update: numbers-to-string.py Version 0.0.3
• WebDAV Traffic To Malicious Sites
• Update: pcap-rename.py Version 0.0.2
• Update: pdfid.py Version 0.2.3

SANS ISC Diary entries:

• PDF documents & URLs
• Extracting the text from PDF documents
• Metasploit’s Maldoc
• BTC Pickpockets

Here is an overview of content I published in October:

Blog posts:

• Quickpost: Mimikatz DCSync Detection
• Update: oledump.py Version 0.0.29
• Update: base64dump.py Version 0.0.8
• Update: pdf-parser.py Version 0.6.8
• Update: pdfid.py Version 0.2.2
• Analyzing A Malicious Document Cleaned By Anti-Virus

SANS ISC Diary entries:

• A strange JPEG file
• Peeking into .msg files
• It’s in the signature.
• Remember ACE files?
• PE files and debug info

NVISO Blog posts:

• Detecting DDE in MS Office documents
• YARA DDE rules: DDE Command Execution observed in-the-wild

Here is an overview of content I published in September:

Blog posts:

• Abusing A Writable Windows Service
• Compiling a Windows Service With Mono on Kali
• Overview of Content Published In August
• Update: re-search.py Version 0.0.9
• Running Windows Services on Linux with Mono
• Quickpost: DllDemo
• Quickpost: Keyboard Setting For pfSense
• PyBoard LCD160CR Text Scrolling Window 8
• Quickpost: Update: Infinite Control For Bash Bunny
• Quickpost: GNU Radio On Windows
• Quickpost: Creating A Simple Flow Graph With GNU Radio Companion

YouTube videos:

• Bash Bunny InfiniteControl Payload
• PyBoard LCD160CR Text Scrolling Window 8

SANS ISC Diary entries:

• It is a resume – Part 1
• It is a resume – Part 2
• Malware analysis output sanitization
• Analyzing JPEG files
• It is a resume – Part 3

NVISO Blog posts:

• Active exploitation of Struts vulnerability S2-052 CVE-2017-9805
• YARA rules for CCleaner 5.33

Here is an overview of content I published in August:

Blog posts:

• Update: byte-stats.py Version 0.0.6
• Reading Memory Of 64-bit Processes
• Using Metasploit On Windows
• Generating PowerShell Scripts With MSFVenom On Windows
• Wireshark: Follow Streams
• Quickpost: Using ClamAV On Windows
• Quickpost: Metasploit PowerShell BASE64 Commands
• Quickpost: PowerShell Options Order

YouTube videos:

• .ZIP Files With Zone.Identifier
• Emotet Maldoc & ViperMonkey
• It’s Not An Invoice
• Wireshark: Follow Streams
• Metasploit’s msf.docm Analysis

Videoblog posts:

• .ZIP Files With Zone.Identifier
• Emotet Maldoc & ViperMonkey
• It’s Not An Invoice
• Wireshark: Follow Streams
• Metasploit’s msf.docm Analysis

SANS ISC Diary entries:

• Maldoc Analysis with ViperMonkey
• The Good Phishing Email
• Sometimes it’s just SPAM
• It’s Not An Invoice …
• Malware analysis: searching for dots

NVISO Blog posts:

• Decoding malware via simple statistical analysis

Here is an overview of content I published in July:

Blog posts:

• Update; base64dump.py Version 0.0.7
• Update: zipdump.py Version 0.0.9
• Update: pecheck.py Version 0.7.0
• Update: re-search.py Version 0.0.8
• I Will Follow (no, not talking about social media)
• Quickpost: mimikatz !bsod
• Video: mimikatz & !bsod
• Video: mimikatz & minesweeper
• Select Parent Process from VBA
• Update: zipdump.py Version 0.0.10
• Analyzing ClamAV Signatures
• Analyzing ClamAV Signatures – Correction
• ClamAV sigtool –decode-sigs
• Mimikatz Videos
• Beta: format-bytes.py
• Quickpost: Analyzing .ISO Files Containing Malware
• .ISO Files With Zone.Identifier
• Update:zipdump.py Version 0.0.11
• Update: oledump.py Version 0.0.28
• Update: emldump.py Version 0.0.10
• oledump.py *.vir
• Update: python-per-line.py Version 0.0.2
• New Tool: headtail.py
• The Clip Command
• The Paste Command
• Update: count.py Version 0.2.0
• Analyzing Password Dumps With My Tools – Part 1
• .ISO Files & autorun.inf
• Quickpost: Trying Out JA3
• Update: translate.py Version 2.5.0

YouTube videos:

• Ransomware: Very Simple IOC Extraction
• mimikatz & !bsod
• mimikatz & minesweeper
• Select Parent Process From VBA
• mimikatz & Protected Processes
• mimikatz RPC Mode
• mimikatz skeleton
• .ISO Files With Zone.Identifier
• .ISO Files & autorun.inf

Videoblog posts:

• Ransomware: Very Simple IOC Extraction
• .ISO Files & autorun.inf
• .ISO Files With Zone.Identifier
• mimikatz & !bsod
• mimikatz & minesweeper
• mimikatz & Protected Processes
• mimikatz RPC Mode
• mimikatz skeleton
• Select Parent Process From VBA

SANS ISC Diary entries:

• PE Section Name Descriptions
• Selecting domains with random names
• Basic Office maldoc analysis
• Office maldoc + .lnk
• Malicious .iso Attachments
• Another .lnk File
• Static Analysis of Emotet Maldoc
• Maldoc Submitted and Analyzed

Here is an overview of content I published in June:

Blog posts:

• Update: xor-kpa.py Version 0.0.5

YouTube videos:

• xor-kpa.py Version 0.0.5

Videoblog posts:

• xor-kpa.py Version 0.0.5

SANS ISC Diary entries:

• Malware and XOR – Part 1
• Malware and XOR – Part 2

NVISO Labs blog posts:

• Malicious PowerPoint Documents Abusing Mouse Over Actions

NVISO YouTube videos:

• PoC PowerPoint Slide Show Mouse Hover Command