Hello and welcome to the Tuesday, May 30th, 2020, 3 edition of the Sandsenet Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

Well, you got a couple of interesting diaries to talk about after the long weekend.

First of all, Diddy wrote up how to deal with Word

documents embedded in a PowerPoint document. These kind of nested office documents are kind of common

when it comes to malware because it is one nice way to evade some detection rules. When

DDE for example, looked at it first with Olli Dump, it just shows up as a compressed attachment

and then of course after it's being extracted, D he was able to identify and further analyze a divert document.

After all, office documents are compressed.

They're usually zip directory structures, and, well, once you have the actual file, it's then not too hard to figure out what's inside that zip file.

And Brad published another one of his neat Malware analysis write-ups.

This is a sample that Brad collected on the 25th, so last Thursday, pretty current sample.

Usually when Brad writes about these samples, he sort of attributes them to a particular malware campaign.

The interesting thing here is that it actually doesn't fit in these sort of any well-known campaign patterns, even though it uses a fairly classic trick. It arrives as a docusign email. That email then includes an HTML attachment

that will drop a zip file that then tricks the user and actually opening the zip file and

executing JavaScript. DocuSign has been such a common theme in these scams that I think it was a week or two ago. I received a legitimate

docu-sign message and first deleted it as yet another mal-spam before the party that sent me

the email actually reached out to check why I hadn't responded yet.

Now, other than that, this particular sample isn't really all that special.

It uses scheduled tasks in order to then download additional stages. For the full walkthrough, take a look at what Brad has written up, and as always, his diaries are great because it allows you to

sort of follow along with all the P-caps and the samples that Brad publishes so you can basically

...