Tools: search-for-compression.py
ISC diary entries: “Malicious .DAA Attachments” and “The DAA File Format”
Sample: 6e8947a82c97c26728dc590ed797ee23
malware
Analyzing Compressed PowerShell Scripts
Tools: oledump.py, base64dump.py, translate.py
ISC diary entry: Analyzing Compressed PowerShell Scripts
Sample: 1d5794e6b276db06f6f70d5fae6d718e
Maldoc Analysis: Excel 4.0 Macro
Sample: 7df15be35bd8fd1a98adc24e6be7bfcd..
Tools: oledump.py
ISC Diary entry: Maldoc: Excel 4.0 Macro
Maldoc: Excel 4.0 Macro
Analyzing a Phishing PDF with /ObjStm
Sample: 55c336693e66b5d6a799b6b4f8eb5f1a.
Tools: pdfid.py, pdf-parser.py
Blog post: Analyzing a Phishing PDF with /ObjStm
PDF: Stream Objects (/ObjStm)
Finding Property Values in Office Documents
Sample: 8598361ecbbffb35900d0720b0316a56.
Tools: oledump.py
ISC Diary entry: Video: Finding Property Values in Office Documents
