Josh Stroschein
Analyzing Shellcode with SCLauncher
Analyzing and debugging shellcode is a common task when performing malware analysis, exploit development and reverse engineering....
top of page
The Cyber Yeti | Keep Exploring
Josh Stroschein
Mar 42 min
Customizing FakeNet-NG's Default Web Root
This article delves into tailoring Fakenet-NG's default web root, empowering you to craft a more precise and controlled environment for...
309 views
Josh Stroschein
Feb 282 min
Identifying UserForms with Oledump and Olevba
Malware authors often find creative ways to obfuscate and store their data and malicious office documents are no exception. One such...
384 views
Josh Stroschein
Feb 162 min
OneNote Malware: Hidden Payloads in Page Versions
While the abuse of OneNote documents is nothing new, a recent document I investigated revealed multiple payloads through the page...
918 views
Josh Stroschein
Feb 112 min
Anti-Analysis in JavaScript Executed by Windows Script Host (WSH)
Note: This blog was originally published on Feb 24, 2020 It’s common to see malicious office documents drop a JavaScript (JS) file to be...
44 views
Josh Stroschein
Feb 105 min
Locating DLL Name from the Process Environment Block (PEB)
I often encounter software, especially when performing malware analysis, that dynamically constructs it’s own import table. This can be...
62 views
Josh Stroschein
Feb 101 min
Exploring the Process Environment Block (PEB) with WinDbg
The source code for this example can be found here. The assembly is: mov ebx, fs:[ 0x30 ] ; // get a pointer to the PEB mov ebx, [ ebx +...
24 views
Josh Stroschein
Feb 82 min
Maldoc Uses Template Injection for Macro Execution
Note - this was originally published in May of 2020 I recently came across a handful of malicious office documents (maldocs) whose...
112 views
Josh Stroschein
Feb 11, 20211 min
How-To: Installing Oledump in Windows
In this video, we’ll look into installing OLEDUMP in Microsoft Windows. Microsoft office documents are a common vehicle used by malware...
18 views
Josh Stroschein
Jan 6, 20211 min
Creating an IDA Python Plugin for Static XOR String Deobfuscation
In this video, we’ll explore a recent XLS document that drops and executes a DLL using RUNDLL32. The DLL is small and only used to...
75 views
Josh Stroschein
Dec 2, 20201 min
Emotet Maldoc Analysis – Embedded DLL and CertUtil for Base64 Decoding
On 11/10/2020, AnyRun posted an Emotet maldoc that utilized CertUtil to decode a DLL payload that was used for unpacking and running the...
18 views
Josh Stroschein
Apr 12, 20201 min
Excel 4 Macros – Get.Workspace Reference
With the recent resurgence of the use of Excel 4 macros in malicious excel documents, I’ve found myself scouring the internet looking for...
10 views
Josh Stroschein
Apr 9, 20202 min
Removing Passwords from VBA Projects
Occasionally I’ll encounter a maldoc that has a password-protected VBA project. While tools such as oledump may still extract the macros,...
12 views
Josh Stroschein
Mar 25, 20203 min
Maldoc drops DLL and executes via ExecuteExcel4Macro
Behavioral information is a key indicator used to determine if an office document is malicious or not. I’ve recently seen a series of...
10 views
Josh Stroschein
Mar 18, 20205 min
Maldoc uses Windows API to perform process hollowing
A favorite technique by malware authors is to use macros in their office documents to utilize a normal system executable and replace the...
18 views
Josh Stroschein
Mar 10, 20203 min
Maldoc uses RC4 to hide PowerShell script, retrieves payload from DNS TXT record
Malware authors are constantly coming up with new and clever techniques to help avoid detection. In this maldoc, the authors employed...
27 views
Josh Stroschein
Feb 29, 20201 min
Disabling Teredo IPv6 Tunnelling
If you’re seeing DNS queries for teredo.ipv6.microsoft.com you may be interested in disabling it (more at MSDN and WikiPedia). On Windows...
3 views
Josh Stroschein
Feb 10, 20205 min
Malware Analysis – Triaging Emotet (Fall 2019)
This is a summary of initial (triage) analysis of Emotet droppers and the associated network traffic from the fall of 2019. This write-up...
15 views
Josh Stroschein
Jan 26, 20201 min
How to Disable Microsoft Error Reporting
If you’ve ever encountered the following dialog – you know that an application has crashed in Windows. As the dialog indicates, Microsoft...
1 view
Josh Stroschein
Jan 25, 20201 min
Disabling Network Connectivity Status Indicator (NCSI)
According to this article on MSDN, Microsoft introduced the Network Connectivity Status Indicator in Windows Vista. While there may be a...
20 views
bottom of page