Top Tweets for #oleObject

almost 8 years ago

Seems #rtf is loaded by another malicious #doc (external #oleObject #Relationship) -> /bitly.com/2uIzlx4 (/michiganpppp.com/work/doc/3.doc) example: https://t.co/AhLwIdligl

DissectMalware's tweet photo. Seems #rtf is loaded by another malicious #doc (external #oleObject #Relationship)
-> /bitly.com/2uIzlx4 (/michiganpppp.com/work/doc/3.doc)
example: https://t.co/AhLwIdligl https://t.co/0UvTDlSQDW

Malwrologist

@DissectMalware

about 8 years ago

#docx has external #Relationship (with type #oleObject) -> #rtf (/idontknow.moe/files/ptceg.doc) -> #exploit -> #pe (/ecuadortrust.org.uk/images/two/dew008.exe) -> #c2 (/zenshinonline.ru/dew8/fre.php) #rtf https://t.co/PxWmckMPUL

DissectMalware's tweet photo. #docx has external #Relationship (with type #oleObject) -> #rtf (/idontknow.moe/files/ptceg.doc) -> #exploit -> #pe (/ecuadortrust.org.uk/images/two/dew008.exe) -> #c2 (/zenshinonline.ru/dew8/fre.php)

#rtf
https://t.co/PxWmckMPUL https://t.co/aknPyIhTz7

Malwrologist

@DissectMalware

about 8 years ago

Interesting #malicious #pdf (in #ACSII format) dumps & launches #docx. docx has an external #Relationship with type #oleObject (/pomf.pyonpyon.moe/lhvazm.doc) -> #rtf file has embedded #OLE obj (#Exploit) to understand pdf part read: https://t.co/Bg1RMXyZg1 by @DidierStevens

DissectMalware's tweet photo. Interesting #malicious #pdf (in #ACSII format) dumps & launches #docx. docx has an external #Relationship with type #oleObject (/pomf.pyonpyon.moe/lhvazm.doc) -> #rtf file has embedded #OLE obj (#Exploit)
to understand pdf part read: https://t.co/Bg1RMXyZg1 by @DidierStevens https://t.co/iewTUfX3WG

Malwrologist

@DissectMalware

about 8 years ago

#pptx (ppt\slides\_rels\slide1.xml.rels) contains #external #relationship with type #oleObject (url encoded string) -> #hta (/secured.eroea.com/plugin.hta) -> #NET (/secured.eroea.com/wealth.123)

$DissectMalware's tweet photo. #pptx (ppt\slides\_rels\slide1.xml.rels) contains #external #relationship with type #oleObject (url encoded string) -> #hta (/secured.eroea.com/plugin.hta) -> #NET (/secured.eroea.com/wealth.123) https://t.co/j09ztvGD0y$

Malwrologist

@DissectMalware

about 8 years ago

#docx (external #relationship [type #oleObject]) -> #rtf contains #ole object (#exploit EQNEDT32) https://t.co/x5nnhKFtR6 rtf: hxxp://i876edw4e5f6tg78hy9tg7r6ftgiy8.erlivia.ltd/update.wbk @decalage2 please check the rtf, manually extracted ole is fine.

DissectMalware's tweet photo. #docx (external #relationship [type #oleObject]) -> #rtf contains #ole object (#exploit EQNEDT32)

https://t.co/x5nnhKFtR6

rtf: hxxp://i876edw4e5f6tg78hy9tg7r6ftgiy8.erlivia.ltd/update.wbk

@decalage2 please check the rtf, manually extracted ole is fine. https://t.co/bAPrPeULiW

Malwrologist

@DissectMalware

about 8 years ago

complex #malware: #docx (external #Relationshop - type #oleObject) -> #rtf contains 10 #ole -> each has #package (#xlsx) -> #vba macro dls #vbs -> #powershell->#NET. It compiles embedded c# code, dynamically invokes. The code decrypts data stored as a #resource and calls it

DissectMalware's tweet photo. complex #malware: #docx (external #Relationshop - type #oleObject) -> #rtf contains 10 #ole -> each has #package (#xlsx) -> #vba macro dls #vbs -> #powershell->#NET. It compiles embedded c# code, dynamically invokes. The code decrypts data stored as a #resource and calls it https://t.co/14zrkoDC6K

Malwrologist

@DissectMalware

about 8 years ago

#multi #stage: #docx contains external #Relationship elm (#oleObject) -> #rtf doc contains #ole obj --> execs #mshta to dl/exec #hta (#exploit) -> #vbscript runs #powershell to dl #PE file (All external files are hosted on amazon #aws #s3 @AWS_Security) https://t.co/p91t424WZL

DissectMalware's tweet photo. #multi #stage: #docx contains external #Relationship elm (#oleObject) -> #rtf doc contains #ole obj --> execs #mshta to dl/exec #hta (#exploit) -> #vbscript runs #powershell to dl #PE file
(All external files are hosted on amazon #aws #s3 @AWS_Security)
https://t.co/p91t424WZL https://t.co/noaJR6kqwV

Sören Krengel @soerenkrengel

over 9 years ago · Dortmund

"How to create an ole .bin". Simple question, no answer. This is why everyone hates Micosoft. #OLEObject #CompoundFileBinaryFormat

Top Tweets for #oleObject

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users