<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Sehr schön.<div class=""><br class=""></div><div class="">Mit git ging das nicht, unter thirdparty fehlt so einiges.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Ich habe das jetzt mit </div><div class=""><br class=""></div><div class=""><span style="caret-color: rgb(73, 73, 73); color: rgb(73, 73, 73); font-family: Verdana, sans-serif; background-color: rgb(255, 255, 255);" class="">pip3 install -U </span><a href="https://github.com/decalage2/oletools/archive/master.zip" title="https://github.com/decalage2/oletools/archive/master.zip" style="color: rgb(2, 122, 198); text-decoration: none; font-family: Verdana, sans-serif;" class="">https://github.com/decalage2/oletools/archive/master.zip</a><br class=""><div><br class=""></div><div>Wie auf der Homepage dokumentiert installiert und dann wird AutoExec erkannt.</div><div>Muss ich eigentlich olefy durchstarten oder werden die oletools zur Laufzeit gezogen?</div><div><br class=""></div><div><br class=""></div><div>Danke!</div><div><br class=""><blockquote type="cite" class=""><div class="">Am 28.11.2019 um 11:08 schrieb Carsten Rosenberg <<a href="mailto:cr@ncxs.de" class="">cr@ncxs.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hallo Frank,<br class=""><br class="">danke für die Datei. Da ist tatsächlich eine neue Variante des AutoExec<br class="">drin. die aktuelle Git Version von oletools hat das schon integriert:<br class=""><br class="">+----------+----------------+-----------------------------------------+<br class="">|Type |Keyword |Description |<br class="">+----------+----------------+-----------------------------------------+<br class="">|AutoExec |Image1_Click |Runs when the file is opened and ActiveX |<br class="">| | |objects trigger events |<br class="">|AutoExec |Image1_MouseMove|Runs when the file is opened and ActiveX |<br class=""> | | |objects trigger events |<br class="">|Suspicious|Open |May open a file |<br class="">|Suspicious|Output |May write to a file (if combined with Open) |<br class="">|Suspicious|Print # |May write to a file (if combined with Open) |<br class="">|Suspicious|MkDir |May create a directory |<br class="">|Suspicious|CreateObject |May create an OLE object |<br class="">|Suspicious|CallByName |May attempt to obfuscate malicious function |<br class="">| | |calls |<br class="">|Suspicious|Chr |May attempt to obfuscate specific strings|<br class="">| | |(use option --deobf to deobfuscate) |<br class="">|Suspicious|VBA obfuscated |VBA string expressions were detected, may be |<br class="">| |Strings |used to obfuscate strings (option --decode to|<br class="">| | |see all)<br class="">+----------+--------------------+-------------------------------------+<br class=""><br class="">Die git Version kannst du so benutzen:<br class=""><br class="">git clone --recurse-submodules <a href="https://github.com/decalage2/oletools.git" class="">https://github.com/decalage2/oletools.git</a><br class="">/opt/oletools<br class=""><br class="">und in /etc/olefy.conf:<br class=""><br class="">OLEFY_OLEVBA_PATH=/opt/oletools/oletools/olevba.py<br class=""><br class="">VG Carsten<br class=""><br class="">On 27.11.19 12:03, Frank Fiene wrote:<br class=""><blockquote type="cite" class="">Wo soll ich sie dir hinlegen?<br class=""><br class="">Aktuelle Virenpattern erkennen die Datei schon als Virus.<br class=""><br class=""><br class="">Viele Grüße! <br class=""></blockquote></div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Viele Grüße!<br class="">i.A. Frank Fiene<br class="">-- <br class="">Frank Fiene</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">IT-Security Manager VEKA Group</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com" class="">http://www.veka.com</a><br class=""><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AG<br class="">Dieselstr. 8<br class="">48324 Sendenhorst<br class="">Deutschland/Germany<br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO),<br class="">Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler,<br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer<br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div></div></div></div></div></div>
</div>
<br class=""></div></body></html>