/explore
|
You are here 
|
hunter-r.com | ||
| | | | |
forensicitguy.github.io
After writing the last post on bringing malware down to a manageable size for analysis, I got some good feedback on different ways to achieve the same results outside of using pecheck. In this post I'll go over an alternative method that moves much faster than pecheck which was recommended (and loved) by @AndreGironda. |
|
| | | | | ||
| | | | |
forensicitguy.github.io
In this post I want to walk through analysis of a malicious PowerPoint file using olevba. This tool allows you to view macros within Office documents without opening them. If you want to follow along at home, I'm using this sample from MalwareBazaar: |
|
| | | | | ||
| | | | |
forensicitguy.github.io
A colleague asked me a question today about the relationship between Qbot and a Windows system utility: esentutl.exe. It's been sparsely documented via tweet, and I want to more fully explain why Qbot jumped into using the utility during operations. |
|
| | | | | ||
| | | | |
christopheradams.io
The uptick of static site generators |
|
| | | |||
