Read more of this story at Slashdot.
We received another Emotet maldoc, but this time the analysis with VBA emulator ViperMonkey will have to be done differently.
ViperMonkey is still under development, and for this maldoc, it does not manage to execute the code that reveals the base64 payload. But when we use ViperMonkeys option -a to use an alternate parser, we can extract the base64 payload.
The maldoc was delivered inside a password protected ZIP file.
This time, I made a video of the static analysis process:
Didier Stevens
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com
Read more of this story at Slashdot.
Read the full article at TidBITS, the oldest continuously published technology publication on the Internet. To get a full-text RSS feed, help support our work and become a TidBITS member! Members also enjoy an ad-free version of our Web site, email delivery of individual articles, the ability to make long comments with live links, and discounts on Take Control orders and other Apple-related products.