EvilClippy

该工具在我们于BlackHat Asia大会（2019年3月28日）上的演讲中发布。该演讲的视频录像可在 https://www.youtube.com/watch?v=9ULzZA70Dzg 获取。 Evil Clippy 一款跨平台助手，用于创建恶意的MS Office文档。可以隐藏VBA宏、篡改VBA代码（通过P-code）并干扰宏分析工具。支持Linux、OSX和Windows。 如果你是初次接触该工具，建议先阅读我们关于Evil Clippy的博客文章：...

Feeding Gophers to Ghidra

Feeding Gophers to Ghidra By Max Kersten · June 6, 2023 The scripts discussed in the article are based on the magnificent work of Dorka Palotay from CUJOai. Golang malware is becoming increasingly prevalent, requiring analysts to know how to effectively analyze these files without diving into a...

Delving deep into VBScript

In late April we found and wrote a description of CVE-2018-8174, a new zero-day vulnerability for Internet Explorer that was picked up by our sandbox. The vulnerability uses a well-known technique from the proof-of-concept exploit CVE-2014-6332 that essentially "corrupts" two memory objects and...