We find out that the #malicious JS code #exploits a buffer overflow that forces the machine to execute the #shellcode stored in the payload variable. 4/5

CinCan’s #peepdf tool extracts suspicious JavaScript code from the PDF into javascript.txt. 3/5

CinCan’s #PDFiD tool shows that the PDF contains "/JS" and "/JavaScript" objects which raises 🚩🚩 because they might contain #malicious code. 2/5

Today is officially final day of the CinCan project! We would like to thank everyone who has participated to this project in a way or another. Of course there is plans to continue this work in Autumn but first we are heading to summer holiday! Have a secure summer!

CinCan project is having a workshop showcasing DFIR tools tomorrow 8:00 - 12:00 UTC cincan.io/workshop/ Tasks include #phishing #memoryanalysis #documentanalysis #deobfuscation #reversing #Dotnet #malware See you at 11:00 in WhereBy: cincan.whereby.com/workshop

After running the modification script, the #IoCs are sent to #VirusTotal, the resulting report can be seen from the #Cortex #web #interface. The #scan #report from #VirusTotal classifies the first address as #suspicious. It was a #kill #switch domain for #WannaCry ransomware.5/6

There are a number of #tools on how to extract indicators of compromise (#IoCs) for #Cortex #Analyzers. In this example we will be using the #dockerized #ioc_strings tool, which can extract #hashes, #emails and links from files. We will be analyzing a #WannaCry.exe 4/6