Sample: 007de2c71861a3e1e6d70f7fe8f4ce9b.

Tools: oledump.py

Blog post: Maldoc: Excel 4.0 Macro

Sample: 55c336693e66b5d6a799b6b4f8eb5f1a.

Tools: pdfid.py, pdf-parser.py

Blog post: Analyzing a Phishing PDF with /ObjStm

Tools: pdfid.py, pdf-parser.py

 

Sample: 8598361ecbbffb35900d0720b0316a56.

Tools: oledump.py

ISC Diary entry: Video: Finding Property Values in Office Documents

Sample: 8598361ecbbffb35900d0720b0316a56.

Tools: oledump.py, base64dump.py, zipdump.py

ISC Diary entry: Video: Maldoc Analysis of the Weekend

Tools: oledump.py

ISC Diary entry: Video: Analyzing a Simple HTML Phishing Attachment

Sample: 2d0d0094b25f0116dbdfa85a2a3b69d2

Tools: numbers-to-string.py

ISC Diary entry: Video: De-DOSfuscation Example

Sample: 1f27e4d035c8ec71264c9fb1c8915f0b

Tools: rtfdump.py, oledump.py, format-bytes.py, scdbg.exe

ISC Diary entry: Dissecting a CVE-2017-11882 Exploit