Threat Level: green Handler on Duty: Yee Ching Tok

SANS ISC: Finding Strings With oledump.py SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Finding Strings With oledump.py

In diary entry "CFBF Files Strings Analysis" I show how to extract strings from CFBF/ole files with my tool oledump.py.

What if you have found an interesting string, and want to know from which stream it was extracted? Like the URL extracted in my previous diary entry: hxxp://example[.]com/phishing

oledump has an option to check the content of streams with YARA rules: -y.

You could make a small YARA rule to search for example.com, save it to disk and use it as oledump's -y value:

oledump.py -y rule.yara example.com

But you don't need to create a file with a YARA rule, you can also do this from the command-line using "Ad Hoc rules", like this:

With this result, we know that stream 2 and 8 contain string example.com:

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com

DidierStevens

562 Posts
ISC Handler
Jul 3rd 2021

Sign Up for Free or Log In to start participating in the conversation!