Quick Post: Analyzing Maldoc with “Do While” Loop in VBA Downloader

Quick Post: Analyzing Maldoc with “Do While” Loop in VBA Downloader

Summary Emotet is a modular malware delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that…

Who Should Take the CISSP Exam and How to Pass?

Who Should Take the CISSP Exam and How to Pass?

estimated read time = 5 minutes Introduction and Context The Certified Information Systems Security Professional (CISSP) is one of the most well known cybersecurity certifications offered to professionals today. It is an independent and vendor neutral certification offered by The International Information System Security Certification Consortium, better known as (ISC)². This certification is highly sought after by…

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 3

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 3

read time = 5 minutes Summary This is the third in a series of posts exploring fundamental malware analysis techniques. Please check out Part 1 and Part 2 for some additional background. The following techniques are presented as an alternative to automated sandboxing, which are effective and powerful tools. However, as we showed in Part…

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 2

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 2

read time = 4 minutes Summary This is the second in a series of posts exploring fundamental malware analysis techniques. Please check out Part 1 for some additional background,. The following techniques are presented as an alternative to automated sandboxing, which are effective and powerful tools. However, as we showed in Part 1, they may…

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 1

How To: Extract Network Indicators of Compromise (IOCs) from Maldoc Macros — Part 1

read time = 3 minutes Summary:  The goal of this tutorial series is to show analysts a variety of methods to extract IOCs from malicious document samples as an alternative to a reliance on automated sandboxes. Sandboxes are valuable tools, but in many cases (with default settings) they may not provide full details and critical…