HTML Applications (HTA): Wrapped Payloads, Scripted Delivery, & WMI

• HTML files that run HTML, CSS, and Windows native scripting
  • JScript for windows, VBScript
• HTAs do not run in the context of the Windows web browser, but instead run as a trusted application on the operating system
• document.write(): The write() method writes directly to an open (HTML) document stream.
• unescape(): The unescape() function computes a new string in which hexadecimal escape sequences are replaced with the characters that they represent
• Windows Management Instrumentation (WMI) to execute a process

MobSF

https://mobsf.github.io/docs/#/docker

• we can take a look at the source code
• link to mobile pentest section

Programming Language Recognition & Analyzing a Go Service Backdoor

https://unit42.paloaltonetworks.com/the-gopher-in-the-room-analysis-of-golang-malware-in-the-wild/

https://github.com/Ne0nd0g/merlin

• go binairies are FAT

• .symtab string and section

  

• golang.org string

• Go user agent while http import

• PE-bear support 64 executable

⇒ all languages have recognizable pattern