Malware authors often find creative ways to obfuscate and store their data and malicious office documents are no exception. One such...

While the abuse of OneNote documents is nothing new, a recent document I investigated revealed multiple payloads through the page...

Note: This blog was originally published on Feb 24, 2020 It’s common to see malicious office documents drop a JavaScript (JS) file to be...

I often encounter software, especially when performing malware analysis, that dynamically constructs it’s own import table. This can be...

The source code for this example can be found here. The assembly is: mov ebx, fs:[ 0x30 ] ; // get a pointer to the PEB mov ebx, [ ebx +...

Note - this was originally published in May of 2020 I recently came across a handful of malicious office documents (maldocs) whose...