|
In diary entry "CFBF Files Strings Analysis" I show how to extract strings from CFBF/ole files with my tool oledump.py. What if you have found an interesting string, and want to know from which stream it was extracted? Like the URL extracted in my previous diary entry: hxxp://example[.]com/phishing oledump has an option to check the content of streams with YARA rules: -y. You could make a small YARA rule to search for example.com, save it to disk and use it as oledump's -y value: oledump.py -y rule.yara example.com But you don't need to create a file with a YARA rule, you can also do this from the command-line using "Ad Hoc rules", like this:
With this result, we know that stream 2 and 8 contain string example.com:
Didier Stevens |
DidierStevens 638 Posts ISC Handler Jul 3rd 2021 |
| Thread locked Subscribe |
Jul 3rd 2021 10 months ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
