<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>VBS &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/vbs/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Tue, 21 Apr 2026 11:39:52 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>VBS &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>VBA Beautifier Package</title>
		<link>https://blog.cerbero.io/vba-beautifier-package/</link>
					<comments>https://blog.cerbero.io/vba-beautifier-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 21 Apr 2026 11:38:34 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[VBA]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3392</guid>

					<description><![CDATA[We are happy to announce the beta release for commercial licenses of the VBA Beautifier package. It provides automated beautification and deobfuscation for VBA (Visual Basic for Applications) and VBS (VBScript) code, the most common macro language found in malicious Office documents. VBA macros remain one of the primary initial access vectors in the threat &#8230; <a href="https://blog.cerbero.io/vba-beautifier-package/" class="more-link">Continue reading<span class="screen-reader-text"> "VBA Beautifier Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/vba-beautifier-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3392</post-id>	</item>
		<item>
		<title>Video: Blitz 45 Seconds OneNote Malware Analysis</title>
		<link>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/</link>
					<comments>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Fri, 03 Feb 2023 13:29:36 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2522</guid>

					<description><![CDATA[The malicious OneNote sample analyzed in this video contains an executable. The executable contains a CAB archive in a resource entry. The CAB archive contains a VBS script which can directly be inspected in Cerbero Suite. SHA256: F408EF3FA89546483BA63F58BE3F27A98795655EB4B9B6217CBE302A5BA9D5F7]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2522</post-id>	</item>
		<item>
		<title>Analysis of CVE-2013-3906 (TIFF)</title>
		<link>https://blog.cerbero.io/analysis-of-cve-2013-3906-tiff/</link>
					<comments>https://blog.cerbero.io/analysis-of-cve-2013-3906-tiff/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 18 Nov 2013 13:44:19 +0000</pubDate>
				<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[CVE-2013-3906]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Shellcode]]></category>
		<category><![CDATA[TIFF]]></category>
		<category><![CDATA[VBE]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1421</guid>

					<description><![CDATA[This is just a demonstration of malware analysis with Profiler, I haven&#8217;t looked into previous literature on the topic. So, perhaps there&#8217;s nothing new here, but I hope it will be of help for our users. We open the main DOCX file. The first embedded file we analyze is the TIFF image, which stands out &#8230; <a href="https://blog.cerbero.io/analysis-of-cve-2013-3906-tiff/" class="more-link">Continue reading<span class="screen-reader-text"> "Analysis of CVE-2013-3906 (TIFF)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/analysis-of-cve-2013-3906-tiff/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1421</post-id>	</item>
	</channel>
</rss>
