Josh Stroschein
Identifying UserForms with Oledump and Olevba
Malware authors often find creative ways to obfuscate and store their data and malicious office documents are no exception. One such...
top of page
The Cyber Yeti | Keep Exploring
Josh Stroschein
Feb 162 min
OneNote Malware: Hidden Payloads in Page Versions
While the abuse of OneNote documents is nothing new, a recent document I investigated revealed multiple payloads through the page...
918 views
Josh Stroschein
Feb 11, 20211 min
How-To: Installing Oledump in Windows
In this video, we’ll look into installing OLEDUMP in Microsoft Windows. Microsoft office documents are a common vehicle used by malware...
18 views
Josh Stroschein
Dec 2, 20201 min
Emotet Maldoc Analysis – Embedded DLL and CertUtil for Base64 Decoding
On 11/10/2020, AnyRun posted an Emotet maldoc that utilized CertUtil to decode a DLL payload that was used for unpacking and running the...
18 views
Josh Stroschein
Mar 25, 20203 min
Maldoc drops DLL and executes via ExecuteExcel4Macro
Behavioral information is a key indicator used to determine if an office document is malicious or not. I’ve recently seen a series of...
10 views
Josh Stroschein
Mar 18, 20205 min
Maldoc uses Windows API to perform process hollowing
A favorite technique by malware authors is to use macros in their office documents to utilize a normal system executable and replace the...
18 views
Josh Stroschein
Mar 10, 20203 min
Maldoc uses RC4 to hide PowerShell script, retrieves payload from DNS TXT record
Malware authors are constantly coming up with new and clever techniques to help avoid detection. In this maldoc, the authors employed...
27 views
Josh Stroschein
Feb 10, 20205 min
Malware Analysis – Triaging Emotet (Fall 2019)
This is a summary of initial (triage) analysis of Emotet droppers and the associated network traffic from the fall of 2019. This write-up...
15 views
Josh Stroschein
Jul 15, 20193 min
Anti-Analysis in an Office Document
Please note: This was a blog post I originally authored for Bromium. Due to changes in how they host their blog content, it has fallen...
5 views
Josh Stroschein
Jun 28, 20195 min
Identifying a User Form in an Office Document
In this post, we will be looking into ways to identify and analyze the presence of a user form in an office document. As I discussed in a...
8 views
Josh Stroschein
Jun 4, 20198 min
Analyzing Malicious Office Documents with OLEDUMP
Microsoft office documents are a common vehicle used by malware authors to deliver malware. These documents, used for malicious purposes,...
76 views
bottom of page