Project Obsidian: Reverse Engineering Malware - Phishing in the Morning & Abundance of Samples
Project Obsidian walks through triaging and reverse engineering high volumes of malicious email attachments and phishing lures.
Summary
Security researcher Scrabble leads a hands-on technical workshop for Blue Team Village's Project Obsidian, walking through reverse engineering malware (REM) triage workflows for suspicious phishing attachments and malicious executables.
[07:15] The workshop begins with safe handling and initial static analysis of a malicious payload delivered via an email phishing campaign. Scrabble demonstrates using command-line and graphical static analysis tools (such as PEview, pestudio, and strings) to examine file hashes, inspect compiler timestamps, and evaluate entropy to identify potential packing or encryption routines.
[21:23] The session walks through analyzing Portable Executable (PE) structures, including DOS headers, NT headers, Section headers, and the Import Address Table (IAT). Scrabble shows how examining imported Windows APIs (such as VirtualAlloc, WriteProcessMemory, and CreateRemoteThread) provides immediate indicators of process injection or evasion capabilities. He introduces Ghidra and Capa [28:25] to identify higher-level attacker capabilities, extract embedded command-and-control (C2) URLs and IP addresses, and formulate detection rules without executing the sample in a sandbox.
(AI summary — Gemini Flash)
Related talks
Demo Labs·20 min
Tomoaki Tani · Shusei Tomonaga
A demonstration of using MalConfScan with Cuckoo Sandbox to extract configuration data from malware families in memory.
Blue Team Village·43 min
Project Obsidian
Project Obsidian explores methods for decoding and analyzing heavily obfuscated PowerShell scripts used in initial access payloads.
Blue Team Village·52 min
Filipi Pires
Filipi Pires demonstrates techniques for dissecting malicious PDF documents, extracting embedded JavaScript, and uncovering hidden exploit streams.