Forum Discussion

Obsidian's avatar
Obsidian
Icon for Bronze I rankBronze I
28 days ago

Malicious Document Analysis: Visual Basic for Applications (VBA) Question 6

"Analyzing sample2.xls, what is the name of the function used to decode and save the Base64 encoded values?"

I have zero idea on how to get this answer. There is a function Base64Decode() and a function SaveDocument(). I don't know if I am supposed to run a olevba command, look at the screenshots in the briefing, or run some question code. 

Thank you

 

 

1 Reply

  • Found it. Run <olevba --reveal sample2.xls> and the answer is in the results, but not obvious. Answer to #7 is also there.