Comments (4)
Would it also please be possible to hook OleConvertOLESTREAMToIStorage for RTF decoding mentioned here:
https://www.fireeye.com/blog/threat-research/2016/05/how_rtf_malware_evad.html
from monitor.
Unfortunately only Office 2007 as of yet. Regarding your request, I added that a little while ago as well https://github.com/cuckoosandbox/monitor/blob/master/sigs/ole.rst#oleconvertolestreamtoistorage. The issue though is the fact that this dumps a plain OLE1 file
I believe they call it and I couldn't find any existing tools to work with OLE1
files. I believe it is possible to convert it to an OLE2
structure with some Windows API usage, but that obviously requires some additional work.
from monitor.
I do plan to add other versions of Office, it's just that one can only focus on so many things at once.
Thanks for the continuous requests, though! Keep 'em coming :-)
from monitor.
Hi,
Yes I understand this; just was unsure as it wasn't noted office 2007 (not
that it would be). Unfortunately this bit is beyond me or I would just get
it done; I have been looking at the API stuff though and while not wrapped
my head around that I want to see if I can figure out enough to get some
more hooks that I have requested although I hope my signature stuff will be
somewhat helpful. Thanks for the response :-)
On 22 July 2016 at 09:41, Jurriaan Bremer [email protected] wrote:
I do plan to add other versions of Office, it's just that one can only
focus on so many things at once.—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#27 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ACTXtXWGmgNQ8FISAURY2A7IejrasoKbks5qYIIvgaJpZM4JOnfK
.
from monitor.
Related Issues (20)
- Install monitor help HOT 4
- Internal Server Error for url: http:/192.168.56.101:800/mkdtemp HOT 5
- monitor crash. attachment unzip password:virus HOT 6
- Add hook for RtlQueryEnvironmentVariable_U
- Weird output when compiling
- Missing symbol SIG_vbscript_COleScript_Compile_0
- Cuckoo Monitor integration HOT 1
- COleScript::Compile hook not working HOT 4
- Error creating function stub for advapi32!RegOpenKeyExW.
- Inject issue to malware service process by CreateService API HOT 6
- insn hook bug
- IWbemServices_ExecMethod api can not be monitored in win7 HOT 4
- Hooking additional functions HOT 3
- Virtual* function hook bug
- Change behaviour by cuckoo monitor HOT 4
- Debugging cuckoo monitor HOT 1
- Monitor leaks memory?
- Export the Sandbox results
- Configuring procmon filter
- Why does the RtlDispatchException function return true?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from monitor.