|
|
| Line 9: |
Line 9: |
Warning: require(): Unable to allocate memory for pool. in /usr/local/www/mediawiki/includes/AutoLoader.php on line 1007
| | ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren]. | | ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren]. |
| | | | |
| − | There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22&safe=off&espv=2&biw=1920&bih=955&source=lnt&tbs=cdr%3A1%2Ccd_min%3A2012%2Ccd_max%3A2013&tbm= 2012] but not much earlier. | + | There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22 |
| − | | + | |
| − | There is more information and a further call for collaboration or corrections on what is documented on the Pishme GitHub [https://github.com/phishme/python-amime/blob/master/README.md README].
| + | |
| − | | + | |
| − | == Magic Number ==
| + | |
| − | The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
| + | |
| − | | + | |
| − | == Software ==
| + | |
| − | * [https://github.com/idiom/activemime-format activemime-format (extractor)]
| + | |
| − | | + | |
| − | == Sample files ==
| + | |
| − | * https://telparia.com/fileFormatSamples/archive/activeMime/
| + | |
| − | | + | |
| − | == Other Links ==
| + | |
| − | * [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
| + | |
| − | * [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload
| + | |
| − | * [https://www.fireeye.com/blog/threat-research/2015/06/evolution_of_dridex.html Evolution of Dridex]
| + | |
| − | * [https://github.com/decalage2/oletools/commit/75259a45f4e9b375b7c22f830ddf725b648b8917#diff-fcb46827023e27f0d62a2fe61f52c1a0R432 Decalage Python code for extracting data from ActiveMime]
| + | |
| − | * [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren Article on ActiveMime]
| + | |
| − | * [https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/ Malicious Macros Evades Detection Using Unusual File Format]
| + | |
| − | * [https://social.msdn.microsoft.com/Forums/office/en-US/fa6aa92a-ed56-4699-a0d4-3f42c077c602/question-about-base64-encoded-in-word-2003-xml-file?forum=worddev Early MSDN forum post asking about ActiveMime]
| + | |
| − | | + | |
| − | [[Category:Microsoft]]
| + | |
Revision as of 02:55, 28 December 2023
Documented by phishme on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.
ActiveMime binary objects may reside in Microsoft Web Archive (MHT) files documented by Cyren.
There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22
