4 ms·
The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any
by 13of40 10y ago
The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...
- jstanley 10y ago> the only trick is to implement that detection in code String entropy scoring works surprisingly well for problems like this: build a corpus of function names (scrape it from github?), generate a markov model, see how probable the candidate function name is according to the markov model.
- Senji 10y agoThen I'll just run a prettifyer with the same sample data and name functions in my malicious macros from that.
- jstanley 10y agoLike a lot of things, it's an arms race. For the most part people aren't doing that yet because it's easier, and almost as effective, to just generate them at random.
- robryk 10y ago> Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code... Don't people run code obfuscators on macros?