#vbastomping - Twitter Hashtag

about 2 years ago

Tweet: #ThreatProtection Beware of #Orcinius trojan's multi-stage attack via #Dropbox and #Google docs, read more about Symantec's coverage: https://t.co/uxhE91UQdF #trojan #VBAstomping

0

2

0

Filescan.io @filescan_itsec

almost 5 years ago

[UPDATE] In addition to our P-Code analysis itself, we have added an OfficeFileInformation event to the emulator data page, which offers more information about the targetted version/platform and VBA language. Example: https://t.co/r4wVMdwEZV #vbastomping #dfir

filescan_itsec's tweet photo. [UPDATE] In addition to our P-Code analysis itself, we have added an OfficeFileInformation event to the emulator data page, which offers more information about the targetted version/platform and VBA language. Example: https://t.co/r4wVMdwEZV #vbastomping #dfir https://t.co/NqaMHAvYTx

0

8

1

0

Filescan.io @filescan_itsec

almost 5 years ago

[UPDATE] We have started adding P-Code emulation for VBA stomped files, which seems to confuse some analysis tools. Here's a great example to check out: https://t.co/uvA0wuBN0e #maldoc #apt #vbastomping

filescan_itsec's tweet photo. [UPDATE] We have started adding P-Code emulation for VBA stomped files, which seems to confuse some analysis tools. Here's a great example to check out: https://t.co/uvA0wuBN0e #maldoc #apt #vbastomping https://t.co/RJV7xxJLoS

1

8

5

1

0

Nick Carr

@ItsReallyNick

almost 6 years ago

@JohnLaTwC I'm a big fan of @Malwageddon's IRIS-H service to tear apart & understand public samples: https://t.co/EZ495Z6uWt Pic 1: Side-by-side pCode comparison to see #VBAstomping Pic 2: Nice document tracking TTP w/ INCLUDEPICTURE mergeformat technique 😊 Great #redteam payload! 🚪↩️

ItsReallyNick's tweet photo. @JohnLaTwC I'm a big fan of @Malwageddon's IRIS-H service to tear apart & understand public samples: https://t.co/EZ495Z6uWt

Pic 1: Side-by-side pCode comparison to see #VBAstomping
Pic 2: Nice document tracking TTP w/ INCLUDEPICTURE mergeformat technique 😊

Great #redteam payload! 🚪↩️ https://t.co/MJJnNZFs6F

1

8

0

Malwrologist

@DissectMalware

about 7 years ago

Interesting docx + vba #olevba3 shows nothing special #pcodedmp -d shows error Module streams: Error: file not found. #hexeditor reveals the cmd hxxps://aesculapius.000webhostapp.com/svchst.ex #vbastomping with evasion? https://t.co/x4FTPc4DA8 VT 2/60 @InQuest @VessOnSecurity

DissectMalware's tweet photo. Interesting docx + vba
#olevba3 shows nothing special
#pcodedmp -d shows error
Module streams:
Error: file not found.
#hexeditor reveals the cmd
hxxps://aesculapius.000webhostapp.com/svchst.ex
#vbastomping with evasion?
https://t.co/x4FTPc4DA8
VT 2/60
@InQuest @VessOnSecurity https://t.co/5UJIEsYlBN

7

60

25

1

0

Jesse Tadlock @JesseTadlock

over 7 years ago

https://t.co/9G3YTBRpUL - VBA Docs run pcode version behind actual code. Great technique to know. #Sp4rkCon2019 #VBAStomping @Sp4rkCon @OrOneEqualsOne @bigmacjpg

JesseTadlock's tweet photo. https://t.co/9G3YTBRpUL - VBA Docs run pcode version behind actual code. Great technique to know. #Sp4rkCon2019 #VBAStomping @Sp4rkCon @OrOneEqualsOne @bigmacjpg https://t.co/bfbKgrCX7V

1

10

1

0

JB @Cherokeejb_

over 7 years ago

@Sp4rkCon #sp4rkcon - Excited for the update on #vbastomping w @bigmacjpg @OrOneEqualsOne ! Everybody DM me if you'll be around and want to say hi!

Red Canary, a Zscaler company

@redcanary

over 7 years ago

There's an excellent lineup of speakers at this year's @Sp4rkCon, including @likethecoins, @danielhbohannon, and more! Check out the full #Sp4rkCon2019 agenda: https://t.co/9rn3vz01l3

0

10

3

0

1

2

0