Want to make those #xlm macros particularly resistant to AV? Get yourself a copy of Office 2003 and use the XOR Obfuscation method of encryption to protect your document with default password (VelvetSweatshop). Suddenly your #maldoc is invisible. Example: virustotal.com/gui/file/c3466… 
The example I posted is otherwise identical to this document I generated with #macrome - virustotal.com/gui/file/e23f9…. Goes from 11 detections to 0.
AV knows about the VelvetSweatshop trick, but they don't know how to decrypt the XOR Obfuscation method.
AV knows about the VelvetSweatshop trick, but they don't know how to decrypt the XOR Obfuscation method.
The MS-OFFCRYPTO specification is actually full of goodies if you give it a read. XOR Obfuscation is described at docs.microsoft.com/en-us/openspec…. It's a legacy format stemming from the crypto-is-a-munition days. It's trivial to bypass, but unsupported by most document forensic tools.
The specification actually has a sort of fun way of mentioning the default encryption passwords as well - they're all presented as hex strings instead of their ASCII value. VelvetSweatshop lives at docs.microsoft.com/en-us/openspec….
If you already knew about VelvetSweatshop though, did you know there's a different default password for Powerpoint? docs.microsoft.com/en-us/openspec…. Try saving a PPT file with the password of /01Hannes Ruescher/01 and opening it somewhere else. You'll notice you don't get prompted.
I don't know exactly why this password was chosen...but if I had to guess, it's the work of this long-time Microsoft employee: linkedin.com/in/hannes-rues…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
