Analyzing infected files

MSOFFICE 2007+
unzip the file and get vbaProject.bin

sigtool --vba vbaProject.bin

PRE MSOFFICE 2007

sigtool --vba FILE.xls

EXECUTABLES

get http://hexacorn.com/d/PESectionExtractor.pl

use it..

sigtool --mdb

sigtool --md5

	# on Ubuntu on KVM \|boot into the g…
	psychocod3r on Ubuntu on KVM \|boot into the g…
	Ismael A. da Silva -… on ICECAST WITH HTTPS
	Trash Can on Gentoo // Samba 4.5 as AD…
	Michael on ICECAST WITH HTTPS

bytes and bones