Macro analysis on an Emotet dropper (office document) from 01/17/2020

This video focuses on analyzing the macro code from a recent Emotet dropper (i.e. office document). I'll use oledump to analyze the code and perform quick, yet detailed, analysis of how they operate. By the end of this video you will understand how to identify the macro code, perform analysis and extract additional indicators of compromise (IOCs).

Sample MD5: 29b48523e390bf2393796049d7042461

You can find the sample at the following GitHub: https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2020/January/29b48523e390bf2393796049d7042461

And the associated PCAP: https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2020/January/29b48523e390bf2393796049d7042461.pcap

Видео Macro analysis on an Emotet dropper (office document) from 01/17/2020 канала Josh Stroschein