Blog post: Malicious Documents: The Matryoshka Edition
Tools: pdf tools, oledump.py, re-search.py
Sample: 98a727a32fee7115d9599b4df9b6b433
Author: Didier Stevens
Bash Bunny Dropping PDF Via HID
CVE-2017-0199 & Metasploit – Analysis
CVE-2017-0199 Demo
Bash Bunny & QuickCreds
oledump & YARA
Tools: oledump.py.
Maldoc Deobfuscation: Plugin sub-str
cut-bytes.py & Here Documents
Tools: cut-bytes.py.
Maldoc Deobfuscation: Character Removal
ISC Diary entry: Another example of maldoc string obfuscation, with extra bonus: UAC bypass
Tools: oledump.py, re-search.py and sets.py.
Sample: 7dff363557f711a92216da9e9af3bb1f
sets.py
Blog post: New Tool: sets.py
Didier Stevens Videos 