Chaitanya Haritash ChaitanyaHaritash

## icedid-reconstruct.py
"""
Py3 version of IcedID custom steganographic loader (PNG parser & PE reconstructor)
Inspired by https://github.com/hasherezade/funky_malware_formats/tree/master/iced_id_parser
Authored by @nazywam and @psrok1.

pip3 install malduck lief
"""

import sys
import malduck

## shellcode.xlsm
BEWARE: THIS WILL ONLY WORK IN A FRENCH VERSION OF MS-OFFICE/EXCEL

1. Open Excel
2. Click on the active tab
3. Select "Insérer"
4. Click on "Macro MS Excel 4.0".
5. This will create a new worksheet called "Macro1"

================================================================================
In the Macro1 worksheet, paste the following block in cells in column A, starting in cell A1:

## drvscan.cpp
#include <string>
#include <vector>
#include <fstream>
#include <iostream>
#include <filesystem>

#include <Windows.h>
#include <winternl.h>

static_assert( sizeof( void* ) == 8 );

## ExpandDefenderSig.ps1
filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

## RTF obfuscation techniques.rtf
{\rt- RTF SPECIFICATION SUCKS
    {\u0097}}
    {\uc2 \u0098}}}
    {\uc2 \u0099\'**}}
    {\uc2 \uc31682 \u0101}
    {\u0100}}
    {\uc-1 \u0102}

    {\object\objemb\objw-\objh-

## ExcelXLL.md

      
              1 file
            
          
              60 forks
            
          
              3 comments
            
          
              111 stars
            
          
                ryhanson
                / ExcelXLL.md
            
            
              Last active
              July 22, 2024 15:25
            
              
                Execute a DLL via .xll files and the Excel.Application object's RegisterXLL() method
              
          
    DLL Execution via Excel.Application RegisterXLL() method

A DLL can be loaded and executed via Excel by initializing the Excel.Application COM object and passing a DLL to the RegisterXLL method. The DLL path does not need to be local, it can also be a UNC path that points to a remote WebDAV server.
When delivering via WebDAV, it should be noted that the DLL is still written to disk but the dropped file is not the one loaded in to the process. This is the case for any file downloaded via WebDAV, and they are stored at: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\.
The RegisterXLL function expects an XLL add-in which is essentially a specially crafted DLL with specific exports. More info on XLL's can be found on MSDN
The XLL can also be executed by double-clicking the .xll file, however there is a security warning. @rxwx has more notes on this here inc

  
## WoW64_call.cpp
#include "stdafx.h"

#define DB(_val_) __asm __emit (_val_)

#define INVALID_SYSCALL (DWORD)(-1)

// code selectors
#define CS_32   0x23
#define CS_64   0x33

## getppid.c
#if _WIN32_WINNT < 0x0500
# error "should be NT"
#endif
#include    <windows.h>
#include    <tlhelp32.h>
#include	<winternl.h>
#include    <stdio.h>

DWORD getppid()
{
	"""
	Py3 version of IcedID custom steganographic loader (PNG parser & PE reconstructor)
	Inspired by https://github.com/hasherezade/funky_malware_formats/tree/master/iced_id_parser
	Authored by @nazywam and @psrok1.

	pip3 install malduck lief
	"""

	import sys
	import malduck
	BEWARE: THIS WILL ONLY WORK IN A FRENCH VERSION OF MS-OFFICE/EXCEL

	1. Open Excel
	2. Click on the active tab
	3. Select "Insérer"
	4. Click on "Macro MS Excel 4.0".
	5. This will create a new worksheet called "Macro1"

	================================================================================
	In the Macro1 worksheet, paste the following block in cells in column A, starting in cell A1:
	#include <string>
	#include <vector>
	#include <fstream>
	#include <iostream>
	#include <filesystem>

	#include <Windows.h>
	#include <winternl.h>

	static_assert( sizeof( void* ) == 8 );
	filter Expand-DefenderAVSignatureDB {
	<#
	.SYNOPSIS

	Decompresses a Windows Defender AV signature database (.VDM file).

	.DESCRIPTION

	Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.
	{\rt- RTF SPECIFICATION SUCKS
	{\u0097}}
	{\uc2 \u0098}}}
	{\uc2 \u0099\'**}}
	{\uc2 \uc31682 \u0101}
	{\u0100}}
	{\uc-1 \u0102}

	{\object\objemb\objw-\objh-
	#include "stdafx.h"

	#define DB(_val_) __asm __emit (_val_)

	#define INVALID_SYSCALL (DWORD)(-1)

	// code selectors
	#define CS_32 0x23
	#define CS_64 0x33
	#if _WIN32_WINNT < 0x0500
	# error "should be NT"
	#endif
	#include <windows.h>
	#include <tlhelp32.h>
	#include <winternl.h>
	#include <stdio.h>

	DWORD getppid()
	{