corpus.blog
43,029 blogs · 5,458,805 posts Claim your blog
Record · corpus.blog/posts/01a0e45f-f4d8-7202-8ad4-dd5845e65b96

New malicious Office docs trick

bartblaze.blogspot.com · published 8 May 2015

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at bartblaze.blogspot.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
38
Words captured
721

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX6mOnyliHuullVux7_STU3YTZwxR6oKRV0F1DLb17ZG2z2JklaKftXwV-_-0Q9aRoo5VYQqabjK0pWrmanShQmKxA2V32xBUZUKlRrj1oqX30AEDr56ja1Pmd7Hmb9MQUXItLt4fEmUq1/s1600/order.PNG
blogger.googleusercontent.com
https://twitter.com/bartblaze
twitter.com
https://twitter.com/decalage2/status/596373169813987330
twitter.com
https://isc.sans.edu/forums/diary/Guest+Diary+Xavier+Mertens+Analyzing+an+MS+Word+document+not+detected+by+AV+software/19555/
isc.sans.edu
https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423
isc.sans.edu
https://blog.avast.com/2015/04/27/malware-authors-go-a-step-further-to-access-bank-accounts/
blog.avast.com
https://bitbucket.org/decalage/oletools/wiki/olevba
bitbucket.org
https://twitter.com/decalage2
twitter.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjR3yOvPGiQmG3JYimjYZ1hPNbTXOcl21HGOW6ixlfrxEILWIjbAgnpN5DZCT9AZ9xMevwyexLlvoKb_5QSQhn0V31BQiDIzQRN5CF7Oa47gTQuiZUzWzcxjTB9PDCKQQY87zXLtj6PHFox/s1600/gibb.PNG
blogger.googleusercontent.com
https://twitter.com/xme
twitter.com
http://blog.rootshell.be/2015/05/08/deobfuscating-malicious-vba-macro-with-a-few-lines-of-python/
blog.rootshell.be
http://pastebin.com/wryUwym8
pastebin.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8_e1w9FPht642MoGDcrjeavbkJ1fcarwfIAgp-clLQWl6Ktv0llPko1LAAtgU6ViyPziZiVbMEBfW-n069bXEV5cqQy8WmFFoBV1nePEmx_hxCBnOmIYicBu2PdZcw-hdaP2VjkW8B3pB/s1600/olevba.PNG
blogger.googleusercontent.com
http://blog.didierstevens.com/programs/oledump-py/
blog.didierstevens.com
http://blog.didierstevens.com/my-software/
blog.didierstevens.com
https://twitter.com/DidierStevens
twitter.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhldtZ-O4O85KWBPewFgQaSBD0EAyLMUZFcCS2-50i4Af0ZKI9l0vW6x5Z4UW5suNKWyDCEO2PoteFgcN9JAu1OfdlYeCng5oQHTYh_rnIogf7eQCTlN75AsMHRJomGICt0_1R89Obxmd9l/s1600/emldump.PNG
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxW_VmPTn92bA6tgHzBhFgvk_hYsMJioAEqs_KWR-xVBOJ9JDdhzmz3tiR5DES8ijLBj2f0fRLIk9joh0z8D6bfBtVyoQC6yPBn_SIBRdrjew_3-vMqxmUQJ7V4xh7vJll9LIR65p44wGS/s1600/macro.PNG
blogger.googleusercontent.com
http://savepic.org/7260406.jpg
savepic.org
http://savepic.net/6856149.jpg
savepic.net
https://www.virustotal.com/en/file/10acbf106dc72540d3975c4652ed612b73ae22dc8b06391cfba5580204eacd60/analysis/
virustotal.com
https://www.virustotal.com/en/file/66d0502f75a09c011563901699a8c6387d40f1d561b15e125514e1719286f3d4/analysis/
virustotal.com
https://www.virustotal.com/en/file/140edc041bc2a38e94c95260de9e2df59202daa175a33fb2f045e5b7c0d8e87b/analysis/
virustotal.com
http://pastebin.com/Seduzq9Z
pastebin.com
https://www.virustotal.com/en/file/2e6af1212a81136b46af40bf82ddd11811dc64490336f7ce1059aa9dd3c39262/analysis/
virustotal.com
https://www.virustotal.com/en/file/0305dda6ec81e8d8ff90152094d5e5e0f8914aeb6d984ee48d72f405a9b90f90/analysis/
virustotal.com
http://office.microsoft.com/en-us/help/enable-or-disable-activex-controls-in-office-documents-HA010031067.aspx
office.microsoft.com
http://office.microsoft.com/en-us/help/enable-or-disable-macros-in-office-documents-HA010031071.aspx
office.microsoft.com
http://office.microsoft.com/en-us/excel-help/block-or-unblock-external-content-in-office-documents-HA010065176.aspx
office.microsoft.com
http://www.microsoft.com/en-us/download/details.aspx?id=3795
microsoft.com
http://www.microsoft.com/en-us/download/details.aspx?id=18968
microsoft.com
http://www.microsoft.com/en-us/download/details.aspx?id=35554
microsoft.com
https://msdn.microsoft.com/en-us/library/4z4t9ed1%28VS.80%29.aspx
msdn.microsoft.com
http://www.opinionatedgeek.com/dotnet/tools/Base64Decode/
opinionatedgeek.com
https://msdn.microsoft.com/en-us/library/613dxh46%28v=vs.90%29.aspx
msdn.microsoft.com
http://www.howtogeek.com/171993/macros-explained-why-microsoft-office-files-can-be-dangerous/?PageSpeed=noscript
howtogeek.com
http://en.wikipedia.org/wiki/Object_Linking_and_Embedding
en.wikipedia.org
https://bitbucket.org/decalage/oletools/overview
bitbucket.org