#oledump - Twitter Hashtag

over 2 years ago

🚨 Quick blog post on identifying #userforms in #vba projects. These are often used to store data used by the malicious document, such as URLs and #shellcode. https://t.co/EZib1x4MgI Tools used are #oledump, #olevba and the Office IDE.

1

42

13

9

4K

TheGentlemanHacker @mld_77

over 4 years ago

Day 22 of Advent of Cyber 2021 completed!✅ Today's challenge was about to discover basics of #Cyberchef and #oledump which are amazing tools! We had to use #oledump to dump a obfuscated Powershell Script RAT. @tryhackme #BlueTeam #Obfuscation #Powershell #Rat

0

10

0

elhacker.NET @elhackernet

about 5 years ago

➡️ Analizar documento malicioso 🪲 #maldoc de Microsoft Office ✍️ con la herramienta 🔧 oledump 👾💣 https://t.co/K74WagF2z8 - Cheat Sheet #oledump por @DidierStevens [PDF] https://t.co/IXcxEuL4O7 Vía @REMnux

elhackernet's tweet photo. ➡️ Analizar documento malicioso 🪲 #maldoc de Microsoft Office ✍️ con la herramienta 🔧 oledump 👾💣
https://t.co/K74WagF2z8
- Cheat Sheet #oledump por @DidierStevens
[PDF] https://t.co/IXcxEuL4O7
Vía @REMnux https://t.co/KL63Z3yokh

0

48

28

10

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 5 years ago

Created a quick how-to on installing #oledump in Windows - fairly straight-forward but get asked enough so wanted to put something together :) https://t.co/MpQxl62rF4

jstrosch's tweet photo. Created a quick how-to on installing #oledump in Windows - fairly straight-forward but get asked enough so wanted to put something together :)

https://t.co/MpQxl62rF4 https://t.co/vsbN9tZsKF

0

17

5

2

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 5 years ago

5 days of hands-on training will take you deep into all phases of malware ops – from delivery to post-infection payloads. Learn to analyze malware w/ everything from #Ghidra & #IDAPro to #oledump, #pestudio and #suricata More info -> https://t.co/A8e0ir49b2 @hitbsectrain

jstrosch's tweet photo. 5 days of hands-on training will take you deep into all phases of malware ops – from delivery to post-infection payloads. Learn to analyze malware w/ everything from #Ghidra & #IDAPro to #oledump, #pestudio and #suricata

More info -> https://t.co/A8e0ir49b2

@hitbsectrain https://t.co/2kTKL1KYCt

1

18

14

5

0

Blue Team News

@blueteamsec1

over 5 years ago

https://t.co/LkaOZLUkNV version 0.0.57 - new version of #oledump brings an update to plugin_stream_o, to handle /o form streams with multiple entries. https://t.co/3eEB37g5uD #cyber #threathunting #infosec

blueteamsec1's tweet photo. https://t.co/LkaOZLUkNV version 0.0.57 - new version of #oledump brings an update to plugin_stream_o, to handle /o form streams with multiple entries. https://t.co/3eEB37g5uD #cyber #threathunting #infosec https://t.co/dT07htpapV

0

5

4

0

Josh Stroschein | The Cyber Yeti

@jstrosch

almost 6 years ago

Excited to be presenting on malware analysis techniques at the next @SWFLSec meeting! We'll be looking at tools and techniques from #maldocs to native code binaries Time: 9/15 at 6:30pm EDT Register -> https://t.co/XxjkAJYRDQ #oledump #idapro #ghidra…

0

18

10

1

0

𝘚𝘢𝘭𝘷𝘢𝘵𝘰𝘳𝘦 𝘊𝘢𝘮𝘱𝘰𝘭𝘰 ֎ @Totocellux

about 6 years ago

#ThreatIntel: How To #Reversing #MSOffice Droppers, Personal Notes - https://t.co/ApOVdOm9UD @Marco_Ramilli 𝞝 #Organizations #Enterprises #Malware #ReverseEngineering #CyberThreats #InfoSec #CyberSec #CyberSecurity #Python #OfficeMacro #VBAmacro #oleDUMP #oleVBA #XLMDeobfuscator

Totocellux's tweet photo. #ThreatIntel: How To #Reversing #MSOffice Droppers, Personal Notes - https://t.co/ApOVdOm9UD @Marco_Ramilli
𝞝
#Organizations #Enterprises
#Malware #ReverseEngineering
#CyberThreats #InfoSec
#CyberSec #CyberSecurity
#Python #OfficeMacro
#VBAmacro #oleDUMP
#oleVBA #XLMDeobfuscator https://t.co/hTOVAKJfGT

0

9

10

1

0

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#oledump, #olevba y SU_factura .. gracias. https://t.co/eNgu3QMxUR SU_factura.xls -s 7 https://t.co/eNgu3QMxUR -p plugin_http_heuristics.py SU_factura.xls #olevba SU_factura.xls

seguridadyredes's tweet photo. #oledump, #olevba y SU_factura .. gracias.

https://t.co/eNgu3QMxUR SU_factura.xls -s 7
https://t.co/eNgu3QMxUR -p plugin_http_heuristics.py SU_factura.xls
#olevba SU_factura.xls https://t.co/8PTyySvRvW

1

6

3

0

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#urlscan.io/#oledump/#msoffcrypto-crack https://t.co/6JNg0ejrpj: page.domain:* AND filename:.xlsx https://t.co/eNgu3R48Mp -p plugin_office_crypto.py url1.xlsx msoffcrypto-tool url1.xlsx --test -v https://t.co/w6dway03T1 url1.xls msoffcrypto-tool url1.xlsx url2.xlsx -p ... etc..

seguridadyredes's tweet photo. #urlscan.io/#oledump/#msoffcrypto-crack

https://t.co/6JNg0ejrpj: page.domain:* AND filename:.xlsx
https://t.co/eNgu3R48Mp -p plugin_office_crypto.py url1.xlsx
msoffcrypto-tool url1.xlsx --test -v
https://t.co/w6dway03T1 url1.xls
msoffcrypto-tool url1.xlsx url2.xlsx -p ...
etc.. https://t.co/l1GfF9B7g7

1

12

7

2

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 6 years ago

#maldoc executes macros via code in a spreadsheet cell. Macro streams here are only for fake alert - otherwise there would be no identifiable streams via #oledump. User still needs to enable content for macro execution. https://t.co/0Ce4fH7FnI #malware @anyrun_app

jstrosch's tweet photo. #maldoc executes macros via code in a spreadsheet cell. Macro streams here are only for fake alert - otherwise there would be no identifiable streams via #oledump. User still needs to enable content for macro execution. https://t.co/0Ce4fH7FnI #malware @anyrun_app https://t.co/FXMgj5sC2G

0

3

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 6 years ago

Once you've identified a user form (via trailing f/o) with #oledump, you also have the form name. This is used in macro code to reference controls and obtain content. Attached screenshot shows a user form of "discord" and the use of the form to access a control called playbill.

jstrosch's tweet photo. Once you've identified a user form (via trailing f/o) with #oledump, you also have the form name. This is used in macro code to reference controls and obtain content. Attached screenshot shows a user form of "discord" and the use of the form to access a control called playbill. https://t.co/i0Q0Clj9XO

0

4

1

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 6 years ago

This 4 day training will take you deep into all phases of malware ops – from delivery to post-infection payloads. Learn to analyze malware w/ everything from #Ghidra & #IDAPro to #oledump, #pestudio and #suricata - https://t.co/XAox9XwtG9 Hack In The Box (HITB) #HITBAMS2020

0

8

6

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 6 years ago

With #oledump you can determine if an office doc has a user form by trailing "f" & "o" when analyzing structure of the doc. In attached screenshot, stream 8 contains form objs that are often used to store additional resources for macros, such as base64 encoded PowerShell scripts

jstrosch's tweet photo. With #oledump you can determine if an office doc has a user form by trailing "f" & "o" when analyzing structure of the doc. In attached screenshot, stream 8 contains form objs that are often used to store additional resources for macros, such as base64 encoded PowerShell scripts https://t.co/4NxaDjjHcN

0

5

2

0

Alfon 🎸 Seguridad y Redes @seguridadyredes

over 6 years ago

#pcodedmp && #oledump pcodedmp -b file007Hancitor.doc python2 dsuit/oledump.py -p dsuit/plugin_vba_summary.py file007Hancitor.doc | ccze -A python2 dsuit/oledump.py -s 35 -v file007Hancitor.doc | ccze -A

seguridadyredes's tweet photo. #pcodedmp && #oledump

pcodedmp -b file007Hancitor.doc

python2 dsuit/oledump.py -p dsuit/plugin_vba_summary.py file007Hancitor.doc | ccze -A

python2 dsuit/oledump.py -s 35 -v file007Hancitor.doc | ccze -A https://t.co/yMv7fraDc4

0

9

6

0

Traficomin Kyberturvallisuuskeskus @CERTFI

over 6 years ago

Lue #CinCan-projektin #joulukalenteri blogitekstit 5.-9.12. #apktool #radamsa #jsunpack-n #oledump #dex2jar -työkaluista.

CinCan project @CinCanProject

over 6 years ago

♫ On the 9th day of Christmas Bob Pan sent to me dex2jar, so that I can decompile dex file to jar package♫ Thanks for this great tool Bob! Read more: https://t.co/ZMlBbDKAZ5 #infosec #digitalforensics #containers #cincan #security #dex2jar @pxb1988

0

3

4

0

2

1

0

CinCan project @CinCanProject

over 6 years ago

♫ On the 8th day of Christmas Didier Stevens sent to me Oledump, so that I can dump streams from OLE files… ♫ We are so thankful about all the fine software by Mr. Stevens! Read more: https://t.co/TuZMKUFJtf #dfir #infosec #digitalforensics #containers #oledump @DidierStevens

0

4

0

Josh Stroschein | The Cyber Yeti

@jstrosch

about 7 years ago

Here's a quick post detailing how you can use #oledump to find userforms in a malicious office document. You'll also see how the malware authors used the #WindowsAPI directly to execute #shellcode https://t.co/iVb5G4CGiS

0

1

0