S4E02: Weaponizing Office Documents with VBA Purging
Update: 2020-11-19
Description
Malicious Office document’s module streams that contain source code,
but no P-code are more likely to evade YARA rules and AV detection.
This evasion technique is called VBA purging; which is different than
the observed VBA stomping technique. In this episode we will discuss
what VBA purging is, the difference between purging and stomping, the
consequences of this technique, and a new tool created by Mandiant’s
Red Team called OfficePurge.
Comments
In Channel
Download from Google Play
Download from App Store
United States00:00
00:00
x
