Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Finding Strings With SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Finding Strings With

In diary entry "CFBF Files Strings Analysis" I show how to extract strings from CFBF/ole files with my tool

What if you have found an interesting string, and want to know from which stream it was extracted? Like the URL extracted in my previous diary entry: hxxp://example[.]com/phishing

oledump has an option to check the content of streams with YARA rules: -y.

You could make a small YARA rule to search for, save it to disk and use it as oledump's -y value: -y rule.yara

But you don't need to create a file with a YARA rule, you can also do this from the command-line using "Ad Hoc rules", like this:

With this result, we know that stream 2 and 8 contain string

Didier Stevens
Senior handler
Microsoft MVP


597 Posts
ISC Handler
Jul 3rd 2021

Sign Up for Free or Log In to start participating in the conversation!