<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Analysis &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/category/analysis/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 09 Oct 2025 10:11:12 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Analysis &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Memory Challenge 2: MEM Challenge</title>
		<link>https://blog.cerbero.io/memory-challenge-2-mem-challenge/</link>
					<comments>https://blog.cerbero.io/memory-challenge-2-mem-challenge/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 09 Oct 2025 10:11:12 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3209</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to the BlackHat MEA Team for creating it in the first place. The challenge can be downloaded directly from here. The scenario is &#8230; <a href="https://blog.cerbero.io/memory-challenge-2-mem-challenge/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 2: MEM Challenge"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-2-mem-challenge/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3209</post-id>	</item>
		<item>
		<title>Obfuscated Batch Scripts in OneNote Document</title>
		<link>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/</link>
					<comments>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 24 May 2023 08:09:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[OneNote]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2696</guid>

					<description><![CDATA[This malicious OneNote document contains two obfuscated batch scripts and we&#8217;ll be using our commercial Simple Batch Emulator package to understand what they do. SHA256: 46149F56028829246628FFAFC58DF81A4B0FF1C87ED6466492E25AD2F23C0A13 We open the first batch script and decode its data to text with the action &#8220;Conversion -> Bytes to text&#8221; (Ctrl+R). This is the batch script and as we &#8230; <a href="https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/" class="more-link">Continue reading<span class="screen-reader-text"> "Obfuscated Batch Scripts in OneNote Document"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2696</post-id>	</item>
		<item>
		<title>PowerShell Malware with x64 Shellcode</title>
		<link>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/</link>
					<comments>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 May 2023 08:05:21 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Silicon]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2682</guid>

					<description><![CDATA[This malware gives us a chance to see the recently introduced Silicon Shellcode Emulator in action. SHA256: 8CF1E49C74FB05DE954A6B70281F47E3CBD021108B0EE11F4A59667FF28BFEE9 The PowerShell code is not obfuscated: it decodes a base64 encoded string, decrypts the result with a xor operation, allocates memory with VirtualAlloc, copies the shellcode to the allocated memory and then executes it. If ([IntPtr]::size -eq &#8230; <a href="https://blog.cerbero.io/powershell-malware-with-x64-shellcode/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Malware with x64 Shellcode"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2682</post-id>	</item>
		<item>
		<title>OneNote Malware With ISO File</title>
		<link>https://blog.cerbero.io/onenote-malware-with-iso-file/</link>
					<comments>https://blog.cerbero.io/onenote-malware-with-iso-file/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 May 2023 09:56:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[ISO]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2675</guid>

					<description><![CDATA[We recently stumbled upon this tweet by @Cryptolaemus1 about a malicious OneNote document with an embedded ISO file. Because of our recently released ISO Format package, we thought it would be interesting to analyze this malware sample with Cerbero Suite. SHA256: 2B0B2A15F00C6EED533C70E89001248A0F2BA6FAE5102E1443D7451A59023516 The unidentified embedded object in the OneNote document is an ISO file. We &#8230; <a href="https://blog.cerbero.io/onenote-malware-with-iso-file/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Malware With ISO File"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-malware-with-iso-file/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2675</post-id>	</item>
		<item>
		<title>Reversing Complex PowerShell Malware</title>
		<link>https://blog.cerbero.io/reversing-complex-powershell-malware/</link>
					<comments>https://blog.cerbero.io/reversing-complex-powershell-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 28 Mar 2023 10:21:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[beautifier]]></category>
		<category><![CDATA[Injection]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2617</guid>

					<description><![CDATA[In this post we&#8217;re going to analyze a multi-stage PowerShell malware, which gives us an opportunity to use our commercial PowerShell Beautifier package and its capability to replace variables. Sample SHA2-256: 2840D561ED4F949D7D1DADD626E594B9430DEEB399DB5FF53FC0BB1AD30552AA Interestingly, the malicious script is detected by only 6 out of 58 engines on VirusTotal. We open the script in Cerbero Suite, decode &#8230; <a href="https://blog.cerbero.io/reversing-complex-powershell-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "Reversing Complex PowerShell Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/reversing-complex-powershell-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2617</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Obfuscated XLSB Malware Analysis</title>
		<link>https://blog.cerbero.io/obfuscated-xlsb-malware-analysis/</link>
					<comments>https://blog.cerbero.io/obfuscated-xlsb-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 18 Oct 2021 11:59:49 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[XLSB]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2257</guid>

					<description><![CDATA[This analysis was originally posted as a thread on Twitter. SHA256: B17FA8AD0F315C1C6E28BAFC5A97969728402510E2D7DC31A7960BD48DE3FCB6 By previewing the spreadsheet in Cerbero Suite, we can see that the macros are obfuscated. An obfuscated formula looks like this: =ATAN(83483899833434.0)=ATAN(9.34889399761e+16)=ATAN(234889343300.0)=FORMULA.ARRAY(&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT24&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT27&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT29&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT30&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT31&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT33&#38;&#039;erj74^#MNDKJ3OODL _ WEKJKJERKE &#039;!AT34&#38;&#039;erj74^#MNDKJ3OODL &#8230; <a href="https://blog.cerbero.io/obfuscated-xlsb-malware-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Obfuscated XLSB Malware Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/obfuscated-xlsb-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2257</post-id>	</item>
		<item>
		<title>A Fun CTF-Like Malware</title>
		<link>https://blog.cerbero.io/a-fun-ctf-like-malware/</link>
					<comments>https://blog.cerbero.io/a-fun-ctf-like-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 30 Sep 2021 13:07:14 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[Encrypted]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[MSCrypto]]></category>
		<category><![CDATA[OLE]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Steganography]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2224</guid>

					<description><![CDATA[From a Twitter post by InQuest, we analyzed an interesting malware: Encrypted MS Office Document, VBA, Windows Link File (LNK), OLE objects, Windows Help Files (CHM), PNG steganography and Powershell. SHA256: 46AFA83E0B43FDB9062DD3E5FB7805997C432DD96F09DDF81F2162781DAAF834 The analysis should take about 15-20 minutes in Cerbero Suite. Highly recommended! SPOILER ALERT: The images below show all the steps of our &#8230; <a href="https://blog.cerbero.io/a-fun-ctf-like-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "A Fun CTF-Like Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/a-fun-ctf-like-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2224</post-id>	</item>
	</channel>
</rss>
