<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>XLS &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/xls/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 01 Apr 2021 15:46:00 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>XLS &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Video: 3-Minutes Self-Decrypting Excel Malware Analysis</title>
		<link>https://blog.cerbero.io/video/</link>
					<comments>https://blog.cerbero.io/video/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 15 Mar 2021 09:00:55 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[XLS]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1980</guid>

					<description><![CDATA[The script below shows how to brute-force the decryption of the code. It is not necessary, as in the video we calculate the correct value of the W86 cell manually, but the snippet might be useful for future samples. from Pro.SiliconSpreadsheet import * from Pro.UI import proContext v = proContext().findView("Analysis [selfdecrxls]") if v.isValid(): view = &#8230; <a href="https://blog.cerbero.io/video/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: 3-Minutes Self-Decrypting Excel Malware Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1980</post-id>	</item>
		<item>
		<title>Video: 1.5-Minutes QakBot Excel Malware Analysis (2nd sample)</title>
		<link>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/</link>
					<comments>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 Mar 2021 09:00:04 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[XLS]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1973</guid>

					<description><![CDATA[The script extends the Silicon Excel Emulator by implementing th &#8220;FORMULA&#8221; function: from Pro.SiliconSpreadsheet import * from Pro.UI import proContext class EmulatorHelper(SiliconExcelEmulatorHelper): def __init__(self): super(EmulatorHelper, self).__init__() def evaluateFunction(self, emu, ctx, opts, depth, e): function_name = e.toString() if function_name == "FORMULA": if emu.expectedArguments(e, 2, 2): ve = emu.argToValue(ctx, opts, depth, e, 0) v = emu.valueToSpreadsheetValue(ve) idxstr &#8230; <a href="https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: 1.5-Minutes QakBot Excel Malware Analysis (2nd sample)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1973</post-id>	</item>
		<item>
		<title>Video: 2-Minutes QakBot Excel Malware Analysis</title>
		<link>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/</link>
					<comments>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 Mar 2021 13:38:38 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[XLS]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1971</guid>

					<description><![CDATA[The script extends the Silicon Excel Emulator by implementing the &#8220;NOW&#8221; and &#8220;FORMULA.FILL&#8221; functions: from Pro.SiliconSpreadsheet import * from Pro.UI import proContext class EmulatorHelper(SiliconExcelEmulatorHelper): def __init__(self): super(EmulatorHelper, self).__init__() def evaluateFunction(self, emu, ctx, opts, depth, e): function_name = e.toString() if function_name == "FORMULA.FILL": if emu.expectedArguments(e, 2, 2): ve = emu.argToValue(ctx, opts, depth, e, 0) v = &#8230; <a href="https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: 2-Minutes QakBot Excel Malware Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1971</post-id>	</item>
	</channel>
</rss>
