Josh Stroschein
Identifying UserForms with Oledump and Olevba
Malware authors often find creative ways to obfuscate and store their data and malicious office documents are no exception. One such...
top of page
The Cyber Yeti | Keep Exploring
Josh Stroschein
Feb 152 min read
OneNote Malware: Hidden Payloads in Page Versions
While the abuse of OneNote documents is nothing new, a recent document I investigated revealed multiple payloads through the page...
924 views
Josh Stroschein
Feb 112 min read
Anti-Analysis in JavaScript Executed by Windows Script Host (WSH)
Note: This blog was originally published on Feb 24, 2020 It’s common to see malicious office documents drop a JavaScript (JS) file to be...
46 views
Josh Stroschein
Feb 105 min read
Locating DLL Name from the Process Environment Block (PEB)
I often encounter software, especially when performing malware analysis, that dynamically constructs it’s own import table. This can be...
85 views
Josh Stroschein
Feb 101 min read
Exploring the Process Environment Block (PEB) with WinDbg
The source code for this example can be found here. The assembly is: mov ebx, fs:[ 0x30 ] ; // get a pointer to the PEB mov ebx, [ ebx +...
24 views
Josh Stroschein
Feb 82 min read
Maldoc Uses Template Injection for Macro Execution
Note - this was originally published in May of 2020 I recently came across a handful of malicious office documents (maldocs) whose...
128 views
bottom of page