A .WAV With A Payload, (Tue, Apr 21st)

There have been reports of threat actors using a .wav file as a vector for malware . It's a proper .wav file, but they didn't use staganography. The .wav file will play, but you'll just hear noise: That's because the TAs have just replaced the bytes that encode the sound with the BASE64 representation of their payload: Thus I don't need a .wav parser to extract the encoded payload, I can just use my base64dump.py tool: The BASE64-decoded payload is an XOR-encoded PE file. So I don't need to make a custom decoder, I can just perform a known-plaintext attack looking for the DOS header with my xor-kpa.py tool: The XOR key was found. Thus we can easily dump the decoded PE file and see the MZ header at position 0x08 and a bit further down the DOS header we used in the known-plaintext-attack: And my tool pecheck.py can extract an analyse the sample : Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.