Didier Stevens

Here is an overview of content I published in May:

Blog posts:

• Update: numbers-to-hex.py Version 0.0.3
• MovingXORSelection.1sc
• Update: emldump.py Version 0.0.9
• New YARA Rule: PE_File_pyinstaller
• Update: pecheck.py Version 0.5.0
• Update: pecheck.py Version 0.5.1

YouTube videos:

• oledump: VBA UserForm
• numbers-to-hex.py
• MovingXORSelection.1sc
• emldump: Filter Option
• translate.py: Regex Option

Videoblog posts:

• translate.py: Regex Option
• emldump: Filter Option
• MovingXORSelection.1sc
• numbers-to-hex.py
• oledump: VBA UserForm
• VBE
• translate.py: With regex
• BlackEnergy .XLS Dropper
• CMD.DLL: From DLL To VBA
• Creating CMD.XLS
• xor-kpa.py: XOR Known-Plaintext Attack

SANS ISC Diary entries:

• Python Malware – Part 1
• Python Malware – Part 2

Here is an overview of content I published in April:

Blog posts:

• Update: decode-vbe.py Version 0.0.2
• Update translate.py Version 2.3.0

YouTube videos:

• translate.py: With regex
• VBE

SANS ISC Diary entries:

• Handling Malware Samples
• VBS + VBE

Here is an overview of content I published in March:

Blog posts:

• Even More Obfuscated MIME Type Files
• Update: oledump.py Version 0.0.23
• YARA Rule To Detect VBE Scripts
• Decoding VBE

SANS ISC Diary entries:

• VBE: Encoded VBS Script
• Handling Malware Samples

Here is an overview of content I published in February:

Blog posts:

• Update: numbers-to-hex.py Version 0.0.2
• Create Your Own CMD.XLS
• Update: translate.py Version 2.2.0 for Locky JavaScript Deobfuscation
• More Obfuscated MIME Type Files

SANS ISC Diary entries:

• Locky: JavaScript Deobfuscation
• Tip: Quick Analysis of Office Maldoc

Here is an overview of content I published in January:

Blog posts:

• BlackEnergy .XLS Dropper Puzzle
• Update: base64dump.py Version 0.0.4
• Update: emldump.py Version 0.0.6
• Update: xor-kpa.py Version 0.0.2
• Update: cut-bytes.py Version 0.0.3

YouTube Videos:

• xor-kpa.py: XOR Known-Plaintext Attack
• Creating CMD.XLS
• CMD.DLL: From DLL To VBA
• BlackEnergy .XLS Dropper

SANS ISC Diary entries:

• Failure Is An Option
• A Tip For The Analysis Of MIME Files
• BlackEnergy .XLS Dropper
• Sigcheck and VirusTotal for Offline Machine
• Obfuscated MIME Files

Here is an overview of content I published in December:

Blog posts:

• Windows Backup Privilege: CMD.EXE
• BruCON Spring Training 2016: Analysing Malicious Documents
• Update: oledump.py Version 0.0.22
• MIME File With “Header”
• Maldoc GET Range
• SHA256 Code Signing and Microsoft

YouTube videos:

• MIME File With Header
• Analysis Of A Corrupt OLE File

Videoblog posts:

• SpiderMonkey: Dump
• MIME File With Header
• Analysis Of A Corrupt OLE File

SANS ISC Diary entries:

• Use The Privilege
• Malfunctioning Malware

I teach a class on analyzing malicious documents at BruCON Spring Training 2016.

First day covers PDF, second day covers MS Office documents. When you attend, you also get my PDF and MS Office workshop videos.

Early bird registration till the end of the year.

Here is an overview of content I published in November:

Blog posts:

• Analysis Of An Office Maldoc With Encrypted Payload (Quick And Dirty)
• Analysis Of An Office Maldoc With Encrypted Payload (Slow And Clean)
• Analysis Of An Office Maldoc With Encrypted Payload: oledump plugin
• Update: translate.py V2.1.0
• byte-stats.py
• Update: oledump V0.0.20
• Update: emldump.py Version 0.0.4
• Update: cut-bytes.py Version 0.0.2
• Update: find-file-in-file.py Version 0.0.5
• Maldoc Social Engineering Trick
• Update: nsrl.py Version 0.0.2
• Update: emldump.py Version 0.0.5
• Authenticode And Timestamping And sha256
• Update: virustotal-search.py Version 0.1.3
• Update: oledump.py Version 0.0.21
• Update: Authenticode Tools

YouTube videos:

• byte-stats.py
• oledump.py –extra
• Maldoc Social Engineering Trick
• CMD.EXE: Backup Privilege
• SpiderMonkey: Dump

Videoblog posts:

• byte-stats.py
• oledump.py –extra
• CMD.EXE: Backup Privilege

SANS ISC Diary entries:

• Ransomware & Entropy: Your Turn -> Solution
• Maldoc Social Engineering Trick

Here is an overview of content I published in October:

Blog posts:

• Update: base64dump.py Version 0.0.3
• Release: emldump.py Version 0.0.3
• cut-bytes.py
• New workshop videos: Malicious Office Documents Part 1

Videoblog posts:

• Cut Cut Cut …
• Wireshark Hex Import

SANS ISC Diary entries:

• Ransomware & Entropy
• Ransomware & Entropy: Your Turn

This week I will teach my Malicious Office Documents workshop at hack.lu, explaining how to use my oledump tool.

If you can not attend and are interested, I sell videos for this new workshop. And I also do a promo: if you buy my bundle of 3 workshops, you get the new Malicious Office Documents Part 1 workshop for free. In a nutshell: you pay €60 for 4 workshops in stead of €100.