Live Stream VOD: VBScript Emulation Research Part 1 - Emotet OneNote Malware (Patreon)

In this Twitch stream we start our 3-part research series on emulating VBScript by looking at the new Emotet OneNote docs being used to execute WScript malware.

The first part of the stream we quickly triage the OneNote document, extract the WScript and manually deobfuscate the script.

The rest of the stream is dedicated to starting our automated VBScript deobfuscation project as we learn more about how cscript.exe and vbscript.dll work under the hood.

Emotet WScript Sample

1c3a7f886a544fc56e91b7232402a1d86282165e2699b7bf36e2b1781cb2adc2 

Notes

OneNote WSF Malware (Emotet)