decalage2 opened this issue 2 years ago · 0 comments
example (technique used by icedid): https://twitter.com/filescan_itsec/status/1575841289718874115 https://isc.sans.edu//forums/diary/Word+Maldoc+With+CustomXML+and+Renamed+VBAProjectbin/29056/