Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: Analyzing UDF Files with Python SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Analyzing UDF Files with Python

Yesterday, Xavier wrote a diary entry about malicious UDF files.

I wrote about the analysis of .ISO files before, and it turns out the same techniques work for UDF files too.

Python module isoparser can also parse UDF files:

We can retrieve the content:

And calculate the hash of the contained EXE:

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

 DidierStevens

449 Posts
ISC Handler
Subscribe Apr 19th 2019
1 year ago

Sign Up for Free or Log In to start participating in the conversation!