Tools: zipdump.py, pecheck.py, file-magic.py.
Blog post: Analysis Of Unusual ZIP Files
AutoCAD & VBA
Analyzing .DWG Files With Embedded VBA Macros
Tools: oledump.py, cut-bytes.py.
Blog post: Analyzing .DWG Files With Embedded VBA Macros
ISC Diary entry: Malicious .DWG Files?
Encrypted Sextortion PDFs
Tools: pdfid.py and pdf-parser.py, QPDF and Poppler.
ISC diary entries: “Encrypted Sextortion PDFs”
Sample: 294592cd85ddf80ad1a092f955f1ae25
Analyzing DAA Files
Tools: search-for-compression.py
ISC diary entries: “Malicious .DAA Attachments” and “The DAA File Format”
Sample: 6e8947a82c97c26728dc590ed797ee23
Analyzing Compressed PowerShell Scripts
Tools: oledump.py, base64dump.py, translate.py
ISC diary entry: Analyzing Compressed PowerShell Scripts
Sample: 1d5794e6b276db06f6f70d5fae6d718e
