<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>chm &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/chm/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Tue, 09 May 2023 14:36:35 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>chm &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>OneNote Malware With ISO File</title>
		<link>https://blog.cerbero.io/onenote-malware-with-iso-file/</link>
					<comments>https://blog.cerbero.io/onenote-malware-with-iso-file/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 May 2023 09:56:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[ISO]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2675</guid>

					<description><![CDATA[We recently stumbled upon this tweet by @Cryptolaemus1 about a malicious OneNote document with an embedded ISO file. Because of our recently released ISO Format package, we thought it would be interesting to analyze this malware sample with Cerbero Suite. SHA256: 2B0B2A15F00C6EED533C70E89001248A0F2BA6FAE5102E1443D7451A59023516 The unidentified embedded object in the OneNote document is an ISO file. We &#8230; <a href="https://blog.cerbero.io/onenote-malware-with-iso-file/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Malware With ISO File"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-malware-with-iso-file/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2675</post-id>	</item>
		<item>
		<title>Improved ITSF (CHM) Format Support</title>
		<link>https://blog.cerbero.io/improved-itsf-chm-format-support/</link>
					<comments>https://blog.cerbero.io/improved-itsf-chm-format-support/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 08 Feb 2022 10:08:56 +0000</pubDate>
				<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[itsf]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2318</guid>

					<description><![CDATA[The upcoming 5.4 version of Cerbero Suite and 2.4 of Cerbero Engine come with improved support for Microsoft&#8217;s ITSF (also known as CHM) format. We also exposed the format to our Python SDK. The following sample enumerates files in a CHM. The commented out line of code extracts the file data. from Pro.Core import * &#8230; <a href="https://blog.cerbero.io/improved-itsf-chm-format-support/" class="more-link">Continue reading<span class="screen-reader-text"> "Improved ITSF (CHM) Format Support"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/improved-itsf-chm-format-support/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2318</post-id>	</item>
		<item>
		<title>A Fun CTF-Like Malware</title>
		<link>https://blog.cerbero.io/a-fun-ctf-like-malware/</link>
					<comments>https://blog.cerbero.io/a-fun-ctf-like-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 30 Sep 2021 13:07:14 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[Encrypted]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[MSCrypto]]></category>
		<category><![CDATA[OLE]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Steganography]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2224</guid>

					<description><![CDATA[From a Twitter post by InQuest, we analyzed an interesting malware: Encrypted MS Office Document, VBA, Windows Link File (LNK), OLE objects, Windows Help Files (CHM), PNG steganography and Powershell. SHA256: 46AFA83E0B43FDB9062DD3E5FB7805997C432DD96F09DDF81F2162781DAAF834 The analysis should take about 15-20 minutes in Cerbero Suite. Highly recommended! SPOILER ALERT: The images below show all the steps of our &#8230; <a href="https://blog.cerbero.io/a-fun-ctf-like-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "A Fun CTF-Like Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/a-fun-ctf-like-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2224</post-id>	</item>
		<item>
		<title>Info-Tech Storage Format support</title>
		<link>https://blog.cerbero.io/info-tech-storage-format-support/</link>
					<comments>https://blog.cerbero.io/info-tech-storage-format-support/#respond</comments>
		
		<dc:creator><![CDATA[Alessandro Gario]]></dc:creator>
		<pubDate>Sat, 24 Mar 2012 16:16:13 +0000</pubDate>
				<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[chi]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[chq]]></category>
		<category><![CDATA[chw]]></category>
		<category><![CDATA[compiled html]]></category>
		<category><![CDATA[help file]]></category>
		<category><![CDATA[html]]></category>
		<category><![CDATA[info-tech storage format]]></category>
		<category><![CDATA[itsf]]></category>
		<category><![CDATA[kpd]]></category>
		<guid isPermaLink="false">http://blog.icerbero.com/?p=320</guid>

					<description><![CDATA[The Info-Tech Storage Format (ITSF) is the primary format that has been adopted by Microsoft for online help files since Windows 98. Due to its popularity, it has been used (and exploited) by many other third parties, mostly because of the support provided by documentation utilities like Doxygen. With the upcoming 0.8.0 release, the Profiler &#8230; <a href="https://blog.cerbero.io/info-tech-storage-format-support/" class="more-link">Continue reading<span class="screen-reader-text"> "Info-Tech Storage Format support"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/info-tech-storage-format-support/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">320</post-id>	</item>
	</channel>
</rss>
