Toomas Lepik
well seasoned Cyber Security Analyst with over 20+ years of experience in the IT industry.
Specialises in network forensics, malware analysis and in incident handling.
Work blends hands-on technical analysis with emphasis on critical thinking and laziness being also passionate about secure software practices. Likes to pet dogs and other domestic animals.
Session
09-25
14:45
60min
Examining document file structure.
Toomas Lepik
Short overview off file analysis
Brief deep dives into:
PDF Format
Office formats (DOCX, XLSX...DOC,XLS..)
Image formats (JPEG, PNG)
Archives (ZIP, RAR, 7z...)
Each topic we look at
- Headers and structure basics
- How file structure had ben used in attacks.
Detection artifacts in file format with Hands-on file Dissection with using tools like:
Hexeditor ,
ExifTool
oletools , pefile ,PDFid ,PDF-Parser and so on.
Task to understand structure and identify potently malicious components
Toolset :https://remnux.org/
Fails for workshop : https://tinyurl.com/4mjzjxjt -
small prices: https://bsides.nopcoders.com/
Slides: https://docs.google.com/presentation/d/1J6IfCLnQNAK83MoshP9il4NGWYzEhG3Y2ZozRLE4uXI/edit?usp=sharing
Workshop
Workshops