Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Analyzing UDF Files with Python

Published: 2019-04-19
Last Updated: 2019-04-19 22:05:09 UTC
by Didier Stevens (Version: 1)
0 comment(s)

Yesterday, Xavier wrote a diary entry about malicious UDF files.

I wrote about the analysis of .ISO files before, and it turns out the same techniques work for UDF files too.

Python module isoparser can also parse UDF files:

We can retrieve the content:

And calculate the hash of the contained EXE:


Didier Stevens
Senior handler
Microsoft MVP

Keywords: malware UDF
0 comment(s)
ISC Stormcast For Friday, April 19th 2019
Diary Archives