Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Maldoc Analysis with ViperMonkey - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Maldoc Analysis with ViperMonkey

We received another Emotet maldoc, but this time the analysis with VBA emulator ViperMonkey will have to be done differently.

ViperMonkey is still under development, and for this maldoc, it does not manage to execute the code that reveals the base64 payload. But when we use ViperMonkey's option -a to use an alternate parser, we can extract the base64 payload.

The maldoc was delivered inside a password protected ZIP file.

This time, I made a video of the static analysis process:


Didier Stevens
Microsoft MVP


638 Posts
ISC Handler
Aug 10th 2017

Sign Up for Free or Log In to start participating in the conversation!