Category Archives: obfuscation

[SANS ISC] Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript

Posted on by

I published the following diary on isc.sans.edu: “Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript“: I found an interesting VBScript sample that is a perfect textbook case for training or learning purposes. It implements a nice obfuscation technique as well as many classic sandbox detection mechanisms. The script

[The post [SANS ISC] Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript has been first published on /dev/random]

Continue reading [SANS ISC] Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript→

Hacked Website Threat Report – 2019

Posted on by

The threat landscape for website owners is constantly shifting on a regular basis — and it’s becoming increasingly more complex. As attackers continue to develop tools and find new vulnerabilities to massively exploit, our team works dilig… Continue reading Hacked Website Threat Report – 2019→

[SANS ISC] Complex Obfuscation VS Simple Trick

Posted on by

I published the following diary on isc.sans.edu: “Complex Obfuscation VS Simple Trick“: Today, I would like to make a comparison between two techniques applied to malicious code to try to bypass AV detection. The Emotet malware family does not need to be presented. Very active for years, new waves of

[The post [SANS ISC] Complex Obfuscation VS Simple Trick has been first published on /dev/random]

Continue reading [SANS ISC] Complex Obfuscation VS Simple Trick→

Packaging Python code for github: should I obfuscate author email address from the `setup.py`?

Posted on by

The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available publicly on github.

Am I unnece… Continue reading Packaging Python code for github: should I obfuscate author email address from the `setup.py`?→

Another Fake Google Domain: fonts.googlesapi.com

Posted on by

Our Remediation team lead Ben Martin recently found a fake Google domain that is pretty convincing to the naked eye.
The malicious domain was abusing the URL shortener service is.gd: shortened URLs were being injected into the posts table of the clien… Continue reading Another Fake Google Domain: fonts.googlesapi.com→

Black Friday/Cyber Monday Ecommerce Security Threats

Posted on by

With the end of November comes the height of the holiday shopping season — specifically Black Friday and Cyber Monday sales, which typically span the last calendar days of November into the first week of December.
As consumer behavior changes an… Continue reading Black Friday/Cyber Monday Ecommerce Security Threats→