oledump's ! Indicator, (Sun, Nov 15th)
SANS Internet Storm Center, InfoCON: green 2020-11-19
In diary entry "AV Cleaned Maldoc" I analyze a malicious document with VBA code that has been removed by anti-virus.
As the VBA code has been wiped, no M or m indicators are present:
I've updated my oledump.py to add a ! indicator for such streams:
I also compiled an overview of oledump's indicators.
Didier Stevens Senior handler Microsoft MVP blog.DidierStevens.com DidierStevensLabs.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.