Hello and welcome to the Tuesday, March 28, 2020,

edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

For everybody out there enjoying Malware reverse engineering, DDIT,

today started a nice series of

diaries looking into

reverse engineering

HTA files.

HTA, these are

HTML applications.

It's essentially sort of

HTML, JavaScript and such,

bundled together,

very often used than by ransomware and such.

I've seen it, for example, where you receive a sip file. Once you unsip it, you get that.

Dot HTA file that then when you double-click it, does additional malicious things, basically triggered by JavaScript.

So today's diary is mostly about how do we de-obfuscate this JavaScript part to basically

figure out what's next.

The next part is then, well, some other scripting language like this car case, PowerShell or

other tools to download and run additional

malicious code. Pretty neat diary to get you started with, and of course, DDI has all the tools

for you in order to make reverse analysis pretty easy. And Apple today updated, well, pretty much everything.

...