Didier Stevens

Here is an overview of content I published in June:

Blog posts:

• Update: xor-kpa.py Version 0.0.5

YouTube videos:

• xor-kpa.py Version 0.0.5

Videoblog posts:

• xor-kpa.py Version 0.0.5

SANS ISC Diary entries:

• Malware and XOR – Part 1
• Malware and XOR – Part 2

NVISO Labs blog posts:

• Malicious PowerPoint Documents Abusing Mouse Over Actions

NVISO YouTube videos:

• PoC PowerPoint Slide Show Mouse Hover Command

Here is an overview of content I published in May:

Blog posts:

• Gzip Decompression Via Pipes
• Quickpost: Internet Zone IDs
• Crack A ZIP Password, And Fly To Dubai …
• Quickpost: ZIP Password Cracking With John The Ripper
• Update: re_search.py Version 0.0.5
• Quickpost: WannaCry Killswitch Check Is Not Proxy AwareQuickpost: WannaCry Killswitch Check Is Not Proxy Aware
• Quickpost: WannaCry’s Mutex Is MsWinZonesCacheCounterMutexA0 (Digit Zero At The End)
• Update: re_search.py Version 0.0.7
• Update: zipdump.py Version 0.0.7
• Update: zipdump.py Version 0.0.8
• WannaCry Simple File Analysis

YouTube videos:

• WannaCry: Simple File Analysis

Videoblog posts:

• WannaCry: Simple File Analysis

NVISO Labs blog posts:

• Critical Samba vulnerability CVE-2017-7494 – Impact on Belgium

Here is an overview of content I published in April:

Blog posts:

• Quickpost: Using My Bash Bunny To “Snag Creds From A Locked Machine”
• Quickpost: Infinite Control For Bash Bunny
• Quickpost: Bash Bunny & Keyboard Layouts
• Update: re-search.py Version 0.0.4
• CVE-2017-0199
• Malicious Documents: The Matryoshka Edition
• New Tool: python-per-line
• Bash Bunny PDF Dropper

YouTube videos:

• Bash Bunny & QuickCreds
• CVE-2017-0199 Demo
• CVE-2017-0199 & Metasploit – Analysis
• Bash Bunny Dropping PDF Via HID
• Malicious Documents: The Matryoshka Edition

Videoblog posts:

• Maldoc Deobfuscation: Plugin sub-str
• oledump & YARA
• Bash Bunny & QuickCreds
• CVE-2017-0199 Demo
• CVE-2017-0199 & Metasploit – Analysis
• Bash Bunny Dropping PDF Via HID
• Malicious Documents: The Matryoshka Edition

SANS ISC Diary entries:

• Domain Whitelisting With Alexa and Umbrella Lists
• Domain Whitelisting With Alexa and Umbrella Lists – update
• Password History: Insights Shared by a Reader
• Malicious Documents: A Bit Of News

NVISO Labs blog posts:

• Analysis of a CVE-2017-0199 Malicious RTF Document
• Hunting malware with metadata

NVISO YouTube videos:

• .LNK downloader and bitsadmin.exe in malicious Office document

Here is an overview of content I published in March:

Blog posts:

• Practice ntds.dit File Part 9: Extracting Password History Hashes
• Update: re-search.py Version 0.0.3
• New Tool: sets.py
• Update: cut-bytes.py Version 0.0.5
• Update: oledump.py Version 0.0.27
• That Is Not My Child Process!

YouTube videos:

• sets.py
• Maldoc Deobfuscation: Character Removal
• Maldoc Deobfuscation: Plugin sub-str
• cut-bytes.py & Here Documents
• oledump & YARA

Videoblog posts:

• sets.py
• Maldoc Deobfuscation: Character Removal
• cut-bytes.py & Here Documents

SANS ISC Diary entries:

• Another example of maldoc string obfuscation, with extra bonus: UAC bypass

NVISO Labs blog posts:

• Developing complex Suricata rules with Lua – part 1
• Developing complex Suricata rules with Lua – part 2
• New Hancitor maldocs keep on coming…

Here is an overview of content I published in February:

Blog posts:

• Quickpost: ClamAV and ZIP File Decryption
• Update: base64dump.py Version 0.0.6
• Update: rtfdump.py Version 0.0.5
• Update: translate.py Version 2.4.0
• Password History Analysis

SANS ISC Diary entries:

• CRA Maldoc Analysis

NVISO Labs blog posts:

• Working with GFI Cloud anti-virus quarantine files
• Maldoc: It’s not all VBA these days
• Hunting with YARA rules and ClamAV

Here is an overview of content I published in January:

Blog posts:

• Update: byte-stats.py Version 0.0.5
• Update: FileScanner Version 0.0.0.4
• Quickpost: Dropbox & Alternate Data Streams
• Update: zipdump.py Version 0.0.5

SANS ISC Diary entries:

• py2exe Decompiling – Part 2

NVISO Labs blog posts:

• Decompiling py2exe Executables
• Detecting py2exe Executables: YARA Rule

Here is an overview of content I published in December:

Blog posts:

• Update: pecheck.py Version 0.5.2
• Update: oledump.py Version 0.0.26
• Update: pecheck.py Version 0.6.0 – Overview Of Resources
• Hancitor Maldoc Videos
• Update: pdf-parser Version 0.6.7

YouTube videos:

• Sleeping VBS Really Wants To Sleep

Videoblog posts:

• Sleeping VBS Really Wants To Sleep

SANS ISC Diary entries:

• Hancitor Maldoc Videos
• Sleeping VBS Really Wants To Sleep
• Pinging All The Way
• py2exe Decompiling – Part 1

NVISO Labs blog posts:

• Analyzing an Office Maldoc with a VBA Emulator
• Videos: Analyzing an Office Maldoc with a VBA Emulator
• PDF Analysis: Back To Basics

Here is an overview of content I published in November:

Blog posts:

• Maldoc With Process Hollowing Shellcode
• Quickpost: Zone.Identifier
• Update: shellcode2vba.py Version 0.5
• Update: byte_stats.py Version 0.0.4
• Update: zipdump.py Version 0.0.4
• Update: base64dump.py Version 0.0.5
• Simple Ciphers: cipher-tool.py
• Update: xor-kpa.py Version 0.0.4
• Update: pdf-parser Version 0.6.6

YouTube videos:

• VBA Shellcode To Test EMET
• EMET vs Hancitor Maldoc
• Hancitor maldoc: Extracting URLs
• Hancitor Maldoc: Shellcode Dynamic Analysis

Videoblog posts:

• VBA Shellcode To Test EMET
• EMET vs Hancitor Maldoc
• Hancitor maldoc: Extracting URLs
• Hancitor Maldoc: Shellcode Dynamic Analysis

SANS ISC Diary entries:

• Hancitor Maldoc Bypasses Application Whitelisting
• VBA Shellcode and EMET
• VBA Shellcode and Windows 10
• ZIP With Comment
• Update:ZIP With Comment
• Extracting Shellcode From JavaScript

NVISO Labs blog posts:

• Malicious Document Targets Belgian Users
• PDF URIs

Here is an overview of content I published in October:

Blog posts:

• rtfdump Videos
• Analyzing Office Maldocs With Decoder.xls
• Update: oledump.py Version 0.0.25
• Update: cut-bytes.py Version 0.0.4
• Update: virustotal-search.py Version 0.1.4

YouTube videos:

• Maldoc VBA: Decoding With Excel

Videoblog posts:

• rtfdump: intro
• rtfdump: MS12-027 Maldoc
• rtfdump: MS10-087 Maldoc
• CreateCertGUI
• oledump xor kpa
• ntds.dit: Mimikatz Golden Ticket & DCSync
• Visual Studio 2013 & OpenSSL
• Visual Studio 2013 & MFC
• Maldoc: numbers-to-string.py
• Training: Attacking with Excel
• Malware: Process Explorer & Procmon
• Malware: FakeNet-NG
• Maldoc VBA: .pub File
• Maldoc VBA: decoder.xls
• Maldoc VBA: Shellcode
• Maldoc VBA: Decoding With Excel

SANS ISC Diary entries:

• Radare2: rahash2
• Maldoc VBA Anti-Analysis
• Analyzing Office Maldocs With Decoder.xls
• Maldoc VBA Anti-Analysis: Video

Here is an overview of content I published in September:

Blog posts:

• Update: translate.py Version 2.3.1
• decoder-search.py Beta
• Quickpost: Enhancing Radare2 Disassembly Listing

YouTube videos:

• Malware: Process Explorer & Procmon
• Malware: FakeNet-NG
• Maldoc VBA: .pub File
• Maldoc VBA: decoder.xls
• Maldoc VBA: Shellcode

SANS ISC Diary entries:

• .PUB Analysis
• VBA and P-code