Top Tweets for #oleVBA

over 2 years ago

🚨 Quick blog post on identifying #userforms in #vba projects. These are often used to store data used by the malicious document, such as URLs and #shellcode. https://t.co/EZib1x4MgI Tools used are #oledump, #olevba and the Office IDE.

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#olevba && #GraphViz/Dot. Arreglando la gráfica... #olevba -a Project.bin --json | ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description]

$seguridadyredes's tweet photo. #olevba && #GraphViz/Dot. Arreglando la gráfica... #olevba -a Project.bin --json | ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description] https://t.co/3v8tzdWA5k$

228

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#binlex #olevba -a bin --reveal --decode #binwalk --dd='.*' bin s=$(sha256sum bin|cut -d' ' -f1) https://t.co/mHWdEbTLM5 -v12 -V s #binlex -m auto -p -c malware -g malware:MalwareDownloader -g malware:Hancitor -g malware:FickerStealer -i bin|jq 'select(.size >... capa -vv bin

seguridadyredes's tweet photo. #binlex
#olevba -a bin --reveal --decode
#binwalk --dd='.*' bin
s=$(sha256sum bin|cut -d' ' -f1)
https://t.co/mHWdEbTLM5 -v12 -V s
#binlex -m auto -p -c malware -g malware:MalwareDownloader -g malware:Hancitor -g malware:FickerStealer -i bin|jq 'select(.size >...

capa -vv bin https://t.co/wIo6UVnXHX

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 3 years ago

#olevba / #GraphViz. Graficando "Composite Document File V2 Document, Little Endian, Os: Windows Microsoft Excel" . #olevba -a 50b610.xls.bin --json |ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description]

$seguridadyredes's tweet photo. #olevba / #GraphViz. Graficando "Composite Document File V2 Document, Little Endian, Os: Windows Microsoft Excel" . #olevba -a 50b610.xls.bin --json |ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description] https://t.co/jlcg75Mnn9$

618

Alfon 🎸 Seguridad y Redes @seguridadyredes

almost 4 years ago

#Zeek_IDS #Zeekurity básico. ag CE8vgo4cOz343lxbuc http.log --nonumber | jq . ag CYMLpO2OEXMzfovA54 files.log --nonumber | jq . cat extract_files/extract-1641914625.727687-HTTP-F9FELo4CUg6mKM6Akh #olevba extract_files/HTTP-FXr1VC35SXNVSRzLsa.doc

seguridadyredes's tweet photo. #Zeek_IDS #Zeekurity básico.

ag CE8vgo4cOz343lxbuc http.log --nonumber | jq .
ag CYMLpO2OEXMzfovA54 files.log --nonumber | jq .

cat extract_files/extract-1641914625.727687-HTTP-F9FELo4CUg6mKM6Akh

#olevba extract_files/HTTP-FXr1VC35SXNVSRzLsa.doc https://t.co/Kb8KNeAN8a

Alfon 🎸 Seguridad y Redes @seguridadyredes

almost 5 years ago

#bas64dump && #olevba XLS. olevba -a file00067.xls --reveal | ~/tools/dsuit/base64dump.py -s3 -n10 -z -S

Alfon 🎸 Seguridad y Redes @seguridadyredes

almost 5 years ago

Con este me voy a llevar bien, que es de #Cádiz. [ El Sub #Killo ] #olevba -a ../file00067.xls --reveal -j > https://t.co/fSvgmO6izg #vmonkey.py -l warning --strip --iocs --jit -e file00067.xls

seguridadyredes's tweet photo. Con este me voy a llevar bien, que es de #Cádiz.
[ El Sub #Killo ]

#olevba -a ../file00067.xls --reveal -j > https://t.co/fSvgmO6izg
#vmonkey.py -l warning --strip --iocs --jit -e file00067.xls https://t.co/WgD8upkWDL

Alfon 🎸 Seguridad y Redes @seguridadyredes

almost 5 years ago

#Suricata_IDS / #olevba / #binwalk & diagram-721.doc & #GraphViz / #dot. ag '\.zip' eve.json --nonumber | jq . | less binwalk -e 14c6dd1c37fb6b6b312065273c579731d20c2e579b9fbe55968390ef46224aa7 olevba -a diagram-721.doc --deobf --decode --reveal

$seguridadyredes's tweet photo. #Suricata_IDS / #olevba / #binwalk & diagram-721.doc & #GraphViz / #dot. ag '\.zip' eve.json --nonumber | jq . | less binwalk -e 14c6dd1c37fb6b6b312065273c579731d20c2e579b9fbe55968390ef46224aa7 olevba -a diagram-721.doc --deobf --decode --reveal https://t.co/2xoO01tOa8$

Alfon 🎸 Seguridad y Redes @seguridadyredes

almost 5 years ago

#sufactura_gracias / #olevba && GraphViz/Dot. Arreglando la gráfica... #olevba -a vbaProject.bin --json | ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description]

$seguridadyredes's tweet photo. #sufactura_gracias / #olevba && GraphViz/Dot. Arreglando la gráfica... #olevba -a vbaProject.bin --json | ag -v XLMMacroDeobfuscator|jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description] https://t.co/PSrQtqI4YW$

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 5 years ago

Graficando oletools/#olevba binwalk -e SHIPMENT.xlsm olevba --deobf --decode --reveal vbaProject.bin olevba -a vbaProject.bin --json |jq -c .[].analysis[] |ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description]|ag -v null | tr -d '[]"' |awk 'BEGIN{print

$seguridadyredes's tweet photo. Graficando oletools/#olevba binwalk -e SHIPMENT.xlsm olevba --deobf --decode --reveal vbaProject.bin olevba -a vbaProject.bin --json |jq -c .[].analysis[] |ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description]|ag -v null | tr -d '[]"' |awk 'BEGIN{print https://t.co/QDSdsPoKpt$

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 5 years ago

Trasteando con #Wireshark #binwalk -e 89623_3247.php #olevba --deobf --decode AMA_3729629070291091.vbs

elhacker.NET @elhackernet

over 5 years ago

#oletools: herramientas #Python para analizar archivos MS OLE2 (almacenamiento estructurado, formato binario de archivo compuesto) y documentos de MS Office, para análisis de #malware, análisis forense y depuración #olevba https://t.co/3XvLkJSbdv https://t.co/vER6eQMUv7

𝘚𝘢𝘭𝘷𝘢𝘵𝘰𝘳𝘦 𝘊𝘢𝘮𝘱𝘰𝘭𝘰 ֎ @Totocellux

about 6 years ago

#ThreatIntel: How To #Reversing #MSOffice Droppers, Personal Notes - https://t.co/ApOVdOm9UD @Marco_Ramilli 𝞝 #Organizations #Enterprises #Malware #ReverseEngineering #CyberThreats #InfoSec #CyberSec #CyberSecurity #Python #OfficeMacro #VBAmacro #oleDUMP #oleVBA #XLMDeobfuscator

Totocellux's tweet photo. #ThreatIntel: How To #Reversing #MSOffice Droppers, Personal Notes - https://t.co/ApOVdOm9UD @Marco_Ramilli
𝞝
#Organizations #Enterprises
#Malware #ReverseEngineering
#CyberThreats #InfoSec
#CyberSec #CyberSecurity
#Python #OfficeMacro
#VBAmacro #oleDUMP
#oleVBA #XLMDeobfuscator https://t.co/hTOVAKJfGT

The DFIR Report

@TheDFIRReport

about 6 years ago

A Dridex intrusion report will be out in a day or two. We've spent weeks working on this report and you'll see mentions of Empire, Mimikatz, AdFind, PsExec, WMI, and an opendir. Consider donating $3 or more to the project at https://t.co/aoad6hkgGG #dfir #capa #moloch #olevba

TheDFIRReport's tweet photo. A Dridex intrusion report will be out in a day or two. We've spent weeks working on this report and you'll see mentions of Empire, Mimikatz, AdFind, PsExec, WMI, and an opendir.

Consider donating $3 or more to the project at https://t.co/aoad6hkgGG

#dfir #capa #moloch #olevba https://t.co/9QeAAeljXL

Gabriele Pippi @gabriele_pippi

about 6 years ago

Check out my new article about our new blog series: Advanced VBA macros: bypassing olevba static analyses with 0 hits https://t.co/lPu0zJhUwG @Certego_IRT #RedTeam #BlueTeam #PurpleTeam #vba #olevba #oletools #ViperMonkey #defenseevasion

112

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#olevba -a sufactura_gracias.doc --json | jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description] | ag -v null | tr -d '[]"' | awk 'BEGIN{print "digraph \"G\"{node[style=filled;fillcolor=orange;fontname=verdana];\"Suspicious....

$seguridadyredes's tweet photo. #olevba -a sufactura_gracias.doc --json | jq -c .[].analysis[] | ag '^{"type' | ag -v 'Base64' |tr -d '#' |jq -c [.type,.keyword,.description] | ag -v null | tr -d '[]"' | awk 'BEGIN{print "digraph \"G\"{node[style=filled;fillcolor=orange;fontname=verdana];\"Suspicious.... https://t.co/GGPmGM66Kq$

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

sufactura_gracias #binwalk -e sufactura_gracias.doc #olevba --deobf --decode vbaProject.bin #floss activeX1.bin #CyberChef save file download.dat && #ssma analyzer

seguridadyredes's tweet photo. sufactura_gracias

#binwalk -e sufactura_gracias.doc
#olevba --deobf --decode vbaProject.bin
#floss activeX1.bin

#CyberChef save file download.dat && #ssma analyzer https://t.co/zMXaoWshlt

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#olevba óle !

marc ochsenmeier @ochsenmeier

over 6 years ago

A few days ago, I realized that olevba has a switch to analyze a #Malware DOC file that is password protected! @decalage2 #DFIR

ochsenmeier's tweet photo. A few days ago, I realized that olevba has a switch to analyze a #Malware DOC file that is password protected! @decalage2 #DFIR https://t.co/p0JVBQJclt

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#oledump, #olevba y SU_factura .. gracias. https://t.co/eNgu3QMxUR SU_factura.xls -s 7 https://t.co/eNgu3QMxUR -p plugin_http_heuristics.py SU_factura.xls #olevba SU_factura.xls

seguridadyredes's tweet photo. #oledump, #olevba y SU_factura .. gracias.

https://t.co/eNgu3QMxUR SU_factura.xls -s 7
https://t.co/eNgu3QMxUR -p plugin_http_heuristics.py SU_factura.xls
#olevba SU_factura.xls https://t.co/8PTyySvRvW

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

@Graphviz Graficando #olevba/#VBS/@GraphViz olevba -a Hancitor.doc --json |jq -c .[].analysis[] |ag '^{"type' | ag -v 'Base64'|tr -d '#' |jq -c [.type,.keyword,.description]|ag -v null|tr -d '[]"' |awk 'BEGIN{print "digraph \"G\"{node[style=filled;fillcolor=orange;fontname=verdana];...

$seguridadyredes's tweet photo. @Graphviz Graficando #olevba/#VBS/@GraphViz olevba -a Hancitor.doc --json |jq -c .[].analysis[] |ag '^{"type' | ag -v 'Base64'|tr -d '#' |jq -c [.type,.keyword,.description]|ag -v null|tr -d '[]"' |awk 'BEGIN{print "digraph \"G\"{node[style=filled;fillcolor=orange;fontname=verdana];... https://t.co/fe9nRnmkqh$

Top Tweets for #oleVBA

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users