Teaser on the TROOPERS16 Incident Analysis Workshop: Analyzing the current Spam Flood

Fri, 18 Dec 2015 00:00:00 +0000

As we are giving another round of our Incident Analysis workshop at Troopers16, we wanted to give a little sample taste what you can expect.

Table of Contents
Extracting Mail Attachments
Word Document Analysis
Static JavaScript Analysis
Dynamic JavaScript Analysis

Before we dive into the analysis, I wanted to mention that if you are going to analyze anything unknown/potentially malicious, do it in a safe environment (VM with no internet connection, in the best case on a separate physical analysis device, or at least strip all unnecessary functionality from that VM (CVE-2015-3456 is an example to answer the “why”)). Even things like looking at content with a text editor or extracting zip files should be done in the safe environment, as those tools could contain vulnerabilities.

Spam on Insinuator.net - Bold Statements

Teaser on the TROOPERS16 Incident Analysis Workshop: Analyzing the current Spam Flood