<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>VBA &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/vba/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Wed, 04 Oct 2023 06:15:04 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>VBA &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>ActiveMime Format Package</title>
		<link>https://blog.cerbero.io/activemime-format-package/</link>
					<comments>https://blog.cerbero.io/activemime-format-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 04 Oct 2023 06:15:04 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Microsoft Office]]></category>
		<category><![CDATA[VBA]]></category>
		<category><![CDATA[Word]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2810</guid>

					<description><![CDATA[We have added support for the Microsoft Office ActiveMime format. This format can be used to encapsulate Office documents and hide their contents during analysis. You can download the package from Cerbero Store.]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/activemime-format-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2810</post-id>	</item>
		<item>
		<title>Video: Blitz XLS Malware Payload Extraction</title>
		<link>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/</link>
					<comments>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 02 Aug 2022 20:02:08 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2457</guid>

					<description><![CDATA[The malware sample analyzed in this video uses VBA code to extract a payload contained in Excel spreadsheet cells. SHA256: F00252AB17546CD922B9BDA75942BEBFED4F6CDA4AE3E02DC390B40599CE1740 The following is the Python code which mimics the VBA extraction code. from Pro.SiliconSpreadsheet import * from Pro.UI import proContext v = proContext().getCurrentAnalysisView() if v.isValid(): view = SiliconSpreadsheetWorkspaceView(v) ws = view.getSpreadsheetWorkspace() sheet = ws.sheetFromName(&#34;Final &#8230; <a href="https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: Blitz XLS Malware Payload Extraction"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2457</post-id>	</item>
		<item>
		<title>A Fun CTF-Like Malware</title>
		<link>https://blog.cerbero.io/a-fun-ctf-like-malware/</link>
					<comments>https://blog.cerbero.io/a-fun-ctf-like-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 30 Sep 2021 13:07:14 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[Encrypted]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[MSCrypto]]></category>
		<category><![CDATA[OLE]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Steganography]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2224</guid>

					<description><![CDATA[From a Twitter post by InQuest, we analyzed an interesting malware: Encrypted MS Office Document, VBA, Windows Link File (LNK), OLE objects, Windows Help Files (CHM), PNG steganography and Powershell. SHA256: 46AFA83E0B43FDB9062DD3E5FB7805997C432DD96F09DDF81F2162781DAAF834 The analysis should take about 15-20 minutes in Cerbero Suite. Highly recommended! SPOILER ALERT: The images below show all the steps of our &#8230; <a href="https://blog.cerbero.io/a-fun-ctf-like-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "A Fun CTF-Like Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/a-fun-ctf-like-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2224</post-id>	</item>
		<item>
		<title>Video: Emotet MS Office Malware 150-Seconds Analysis</title>
		<link>https://blog.cerbero.io/emotet-ms-office-malware-150-seconds-analysis/</link>
					<comments>https://blog.cerbero.io/emotet-ms-office-malware-150-seconds-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 21 Sep 2021 12:22:50 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Emotet]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2220</guid>

					<description><![CDATA[This Microsoft Office document belongs to the Emotet malware campaign and as part of its obfuscation strategy uses the content of text boxes from its VBA code. In the upcoming Cerbero Suite 5.1 we have simplified the analysis of text controls by previewing their name in the format view. The script below deobfuscates the VBA &#8230; <a href="https://blog.cerbero.io/emotet-ms-office-malware-150-seconds-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: Emotet MS Office Malware 150-Seconds Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/emotet-ms-office-malware-150-seconds-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2220</post-id>	</item>
		<item>
		<title>Video: In-Depth Obfuscated VBA Analysis</title>
		<link>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/</link>
					<comments>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 11 Nov 2020 08:44:24 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1946</guid>

					<description><![CDATA[This script concatenates strings such as &#8220;a&#8221; + &#8220;b&#8221;: from Pro.UI import * import re ctx = proContext() v = ctx.getCurrentView() if v.isValid() and v.hasSelection(): s = v.getSelectedText().replace('" &#038;', '" +') s = eval(s) v.setSelectedText('"' + s + '"') This second script decrypts strings the same way as the &#8220;NobosMeik&#8221; function: from Pro.UI import * &#8230; <a href="https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: In-Depth Obfuscated VBA Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-in-depth-obfuscated-vba-analysis/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1946</post-id>	</item>
	</channel>
</rss>
