As we are giving another round of our Incident Analysis workshop at Troopers16, we wanted to give a little sample taste what you can expect.
Table of Contents
Extracting Mail Attachments
Word Document Analysis
Static JavaScript Analysis
Dynamic JavaScript Analysis
Before we dive into the analysis, I wanted to mention that if you are going to analyze anything unknown/potentially malicious, do it in a safe environment (VM with no internet connection, in the best case on a separate physical analysis device, or at least strip all unnecessary functionality from that VM (CVE-2015-3456 is an example to answer the “why”)). Even things like looking at content with a text editor or extracting zip files should be done in the safe environment, as those tools could contain vulnerabilities.
Continue reading