EvilClippy

이 도구는 2019년 3월 28일 BlackHat Asia 발표에서 공개되었습니다. 해당 발표의 영상 녹화본은 https://www.youtube.com/watch?v=9ULzZA70Dzg 에서 확인하실 수 있습니다. Evil Clippy 악성 MS Office 문서를 생성하기 위한 크로스 플랫폼 도우미입니다. VBA 매크로를 숨기고, VBA 코드를 스톰핑P-Code 이용하며, 매크로 분석 도구를 혼란스럽게 할 수 있습니다. Linux, OSX 및 Windows에서 실행됩니다. 이 도구가 처음이라면, Evil Clippy에 대...

Purgalicious VBA: Macro Obfuscation With VBA Purging

Malicious Office documents remain a favorite technique for every type of threat actor, from red teamers to FIN groups to APTs. In this blog post, we will discuss "VBA Purging", a technique we have increasingly observed in the wild and that was first publicly documented by Didier Stevens in Februa...

U.S. Finance Sector Hit with Targeted Backdoor Campaign

The financial services sector in the U.S. found itself under a barrage of cyberattacks last month, all bent on delivering a powerful backdoor called Minebridge. The attack chain employed a known method called “VBA Stomping” to avoid detection. According to researchers at FireEye, the campaigns,...

Malicious MS Office Macro Creator

Evil Clippy is a tool for creating malicious Microsoft Office macros: At BlackHat Asia we released Evil Clippy, a tool which assists red teamers and security testers in creating malicious MS Office documents. Amongst others, Evil Clippy can hide VBA macros, stomp VBA code via p-code and confuse...

Evil Clippy - A Cross-Platform Assistant For Creating Malicious MS Office Documents

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and confuse macro analysis tools. Runs on Linux, OSX and Windows. Current features Hide VBA macros from the GUI editor VBA stomping P-code abuse Fool analyst tools Serve VBA stomp...