Discover and read the best of Twitter Threads about #macrome
Most recents (1)
Want to make those #xlm macros particularly resistant to AV? Get yourself a copy of Office 2003 and use the XOR Obfuscation method of encryption to protect your document with default password (VelvetSweatshop). Suddenly your #maldoc is invisible. Example: virustotal.com/gui/file/c3466… 
The example I posted is otherwise identical to this document I generated with #macrome - virustotal.com/gui/file/e23f9…. Goes from 11 detections to 0.
AV knows about the VelvetSweatshop trick, but they don't know how to decrypt the XOR Obfuscation method.
AV knows about the VelvetSweatshop trick, but they don't know how to decrypt the XOR Obfuscation method.
The MS-OFFCRYPTO specification is actually full of goodies if you give it a read. XOR Obfuscation is described at docs.microsoft.com/en-us/openspec…. It's a legacy format stemming from the crypto-is-a-munition days. It's trivial to bypass, but unsupported by most document forensic tools.
