Published in FAUN Publication

·May 14

Hello Python! : A short introduction.

Python is a high-level, interpreted, general-purpose programming language. Its design philosophy emphasizes code readability with the use of significant indentation. Python was created by Guido Van Rossum and was first released in 1991. The latest version of Python available at the time of this write-up is Python 3.10.4. The programming…

Python

5 min read

Published in System Weakness

·May 10

Network Forensics: PCAP Analysis of a cyber attack.

Executive Summary: This report is prepared for the client as part of the investigations regarding a cyber attack. The goal of this report is to outline the detailed investigation from the review of the network logs (PCAP) captured between 11:35:57 EDT on 29th July 2020 and 11:36:01 EDT 29th July…

Forensics

4 min read

Published in System Weakness

·Feb 23

Static code analysis of .xlsm Emotet sample.

Demo for the analysis is on my YouTube. File identification The file is a Microsoft Excel 2007+ Macro-enabled workbook (.xlsm) with the macro embedded in stream A9 using VB script. The following were extracted during the file identification phase: md5: C9D8323EB4494AF25E08E24A6CE298B9 sha1: F80B6FF7FFEA61724AC3D4E674FE76576D8DB1CE sha256: 077548FA2AB464FDA25DF2EBAF12C5D223149BBE8928C755CF6DCD10F6883176 file-size: 45580 (bytes)

Malware

2 min read

Static code analysis of .xlsm Emotet sample.

Demo for the analysis is on my YouTube.

File identification

The file is a Microsoft Excel 2007+ Macro-enabled workbook (.xlsm) with the macro embedded in stream A9 using VB script.

The following were extracted during the file identification phase:

md5: C9D8323EB4494AF25E08E24A6CE298B9
sha1: F80B6FF7FFEA61724AC3D4E674FE76576D8DB1CE
sha256: 077548FA2AB464FDA25DF2EBAF12C5D223149BBE8928C755CF6DCD10F6883176
file-size: 45580 (bytes)

Published in FAUN Publication

·Feb 21

Static code analysis of Clownic Ransomware using dnSpy.

Today, I performed a static code analysis on a sample of Clownic Ransomware, obtained from vx-underground, the program was developed in C# and analysed using dnSpy. Demo for the analysis is on my YouTube. File Identification The following were extracted during the file identification phase: md5: 711486A19E8B011528DEE34A5D25776E sha1: 7E131940FCE4D157D0A338B8285E8E2298E8677D sha256: 880823DD9DF0CA6047CD829A1031E8A167CCEC0629FDEAC40A097DD555DEBF7C file-size: 143872 (bytes) signature: Microsoft…

Malware

3 min read

Static code analysis of Clownic Ransomware using dnSpy.

Feb 18

Static code analysis of CobaltStrike HTA malware sample

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Today, I analyse a HTA malware sample from vx-underground. The demo for this analysis can be found on my YouTube. File Identification and Identification of malicious indicators

HTML

2 min read

Static code analysis of CobaltStrike HTA malware sample

Published in FAUN Publication

·Feb 16

Static code analysis of an Emotet malware sample

Today, I decided to pick a random file from the Emotet family on vx-underground repo. The demo for this analysis can be found on my YouTube. File Identification and Identification of malicious indicators The file is a Microsoft Word 2007+ Macro-Enabled Document (.docm) with a High risk macro embedded in stream ‘A5'. file-size,146070 (bytes) md5,8DF71E674C2A891330651D3ACA0C6F7F sha1,FDD6E375BC0F789F5691AF8624DA5493D3ABE9E6 sha256,02F9ECDD1DE018BDFAA27979567C7CC39FAE5CD066288C9EC1342508C05E0CDC Macro: Stream -A5, 10452…

Malware

2 min read

Feb 14

Valentine FLAMES!

This will definitely bring back some childhood memories for some! FLAMES is a game we played as kids to determine our ‘relationship status’. FLAMES is an acronym which stands out for “Friends Lovers Admirers Marriage Enemies ‘Situationship’”. …

Valentines Day

2 min read

Published in FAUN Publication

·Feb 13

Static code analysis of Trickbot + Emotet .xlsm payload using OfficeMalScanner and VSCode.

15 November 2021 saw the return of Emotet. Check Point Research (CPR) observed that the Emotet botnet started to re-emerge with Trickbot after disappearing for 10 months. Trickbot and Emotet are considered some of the largest botnets in history. In this article, I provide a quick summary from my analysis…

Malware

3 min read

Static code analysis of Trickbot + Emotet .xlsm payload using OfficeMalScanner and VSCode.

Published in FAUN Publication

·Feb 12

Methodology for Malware Static Analysis (2): MS documents (.doc/xls/ppt) and PDF files

This is the part two (2) of my Methodology for malware analysis series, in part one (1), I discussed the static analysis of PE files. In this article, I will highlight methodology and some tools that can be used for analysing DOC and PDF files. When analyzing PDFs, there are…

Cybersecurity

4 min read