This new version of re-search.py adds a regex for UNCs to the library and has a Python 3 fix.

MD5: 294DD5D4027F0AFD0A2DE6432FE4552D
SHA256: B818CE4F7E217B381128550A3A36B40B6D07CC687CE4CF5AFF3C70EC0D3EEAD2
This new version of re-search.py adds a regex for UNCs to the library and has a Python 3 fix.
This update brings an update to plugin plugin_vba_dco.py.
This is a plugin that scans VBA source code for keywords (Declare, CreateObject, GetObject, CallByName and Shell), extracts all lines with these keywords, followed by all lines with identifiers associated with these keywords.
For example, if the result of a CreateObject call is stored in variable oXML, then all lines with this oXML identifier are selected.
I updated this plugin with two options -g (–generalize) and -a (–all).
Option -g generalize will replace all identifiers (like variable & functions names) with a general name: Identifier#### where #### is a numeric counter.
I added this option to analyze a sample where almost all identifiers where completely unreadable, as they consisted solely out of characters that are between byte values 128 and 255 (e.g., non-ASCII).
Here is the output for that sample, without using any plugin option:
You can see the CreateObject functions, but appart from the WshShell identifier, the other identifiers don’t have letters and are hard to trace in the code.
This changes when you use option -g:
All identifiers have been generalized to names like Identifier0001, Identifier0002, …
To view all generalized code (and not only the lines with keywords), use option -a:
Remark that this plugin is not a VBA parser: it uses some simple scans and regexes to find identifiers. For example, it handles line comments like any other lines.
oledump_V0_0_69.zip (http)This new version adds JSON input support, allowing,for example, to detect encoded payloads inside the registry:
More info in an upcoming blog post.
base64dump_V0_0_23.zip (http)This new version of format-bytes.py adds a feature to search for a range of integers:
#iv5#6080 means: look for an integer (i) equal to 6080 with a variation of 5 (v5), e.g., look for integers between 6075 and 6085.
format-bytes_V0_0_14.zip (http)This new version contains a Python 3 fix.
cut-bytes_V0_0_15.zip (http)This new version of base64dump.py adds some extra info for the encoded strings.
In -e all mode, a new column Chars tells you how many unique characters are used for that encoded string:
For example, the last line is recognized as a syntactically valid variant of BASE85 (b85), but it uses only 63 unique characters (85 unique characters is the maximum). So this is probably not b85, or else the encoded data has low entropy.
And there is also new info when you select a string for info:
This new version adds option -l to provide a short list via an option, in stead of using a file. And there’s a Python 3 bug fix.
python-per-line_V0_0_8.zip (http)This new version of oledump.py brings extra info variables %CTIME% %MTIME% %CTIMEHEX% and %MTIMEHEX% to view the creation time & modification time of storages (UTC).
And there’s a new plugin (plugin_olestreams) to parse the OLE data found in streams like \001Ole, \003LinkInfo and \003ObjInfo:
Some small updates to my Python templates.
python-templates_V0_0_7.zip (http)Here is a small update of my tool to analyze Cobalt Strike beacons.
1768_v0_0_14.zip (http)