Threat Level: green Handler on Duty: Bojan Zdrnja

SANS ISC: When DOSfuscation Helps... SANS ISC InfoSec Forums

Special Webcast: What you need to know about the crypt32.dll vulnerability. Register Now

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
When DOSfuscation Helps...

An anonymous reader submitted a malicious document after Brad posted his diary entry "One Emotet infection leads to three follow-up malware infections".

This sample (MD5 dfff3a02e6e6a4d079c12f83dcc2f7a5) is a malicious Word document with VBA macros to launch a powershell command.

The command is "DOSfuscated", and when I analyzed it by extracting strings and contatenating them, I encountered a small problem.

In this video, you can see how I did the complete analysis:

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

DidierStevens

411 Posts
ISC Handler
Thank you Didier, great work, i´m learning a lot
Netmanzim

46 Posts
Very neat post. I did some similar de-obfuscation recently: https://0xdf.gitlab.io/2018/09/15/malware-analysis-bmw_of_sterlindoc.html
Anonymous

Sign Up for Free or Log In to start participating in the conversation!