When DOSfuscation Helps...

Published: 2018-09-30
Last Updated: 2018-09-30 21:38:43 UTC
by Didier Stevens (Version: 1)
2 comment(s)

An anonymous reader submitted a malicious document after Brad posted his diary entry "One Emotet infection leads to three follow-up malware infections".

This sample (MD5 dfff3a02e6e6a4d079c12f83dcc2f7a5) is a malicious Word document with VBA macros to launch a powershell command.

The command is "DOSfuscated", and when I analyzed it by extracting strings and contatenating them, I encountered a small problem.

In this video, you can see how I did the complete analysis:

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

2 comment(s)

Comments

Thank you Didier, great work, i´m learning a lot
Very neat post. I did some similar de-obfuscation recently: https://0xdf.gitlab.io/2018/09/15/malware-analysis-bmw_of_sterlindoc.html

Diary Archives