{"id":12293,"date":"2026-04-22T04:03:44","date_gmt":"2026-04-22T04:03:44","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/22\/32910\/"},"modified":"2026-04-22T04:03:44","modified_gmt":"2026-04-22T04:03:44","slug":"32910","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/22\/32910\/","title":{"rendered":"A .WAV With A Payload, (Tue, Apr 21st)"},"content":{"rendered":"

A .WAV With A Payload, (Tue, Apr 21st)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

There have been reports of threat actors using a .wav file as a vector for malware<\/a>.<\/p>\n

It’s a proper .wav file, but they didn’t use staganography. The .wav file will play, but you’ll just hear noise:<\/p>\n

\"\"<\/p>\n

That’s because the TAs have just replaced the bytes that encode the sound with the BASE64 representation of their payload:<\/p>\n

\"\"<\/p>\n

Thus I don’t need a .wav parser to extract the encoded payload, I can just use my base64dump.py<\/a> tool:<\/p>\n

\"\"<\/p>\n

The BASE64-decoded payload is an XOR-encoded PE file. So I don’t need to make a custom decoder, I can just perform a known-plaintext attack looking for the DOS header with my xor-kpa.py<\/a> tool:<\/p>\n

\"\"<\/p>\n

The XOR key was found. Thus we can easily dump the decoded PE file and see the MZ header at position 0x08 and a bit further down the DOS header we used in the known-plaintext-attack:<\/p>\n

\"\"<\/p>\n

And my tool pecheck.py<\/a> can extract an analyse the sample<\/a>:<\/p>\n

\"\"<\/p>\n

Didier Stevens
\nSenior handler
\nblog.DidierStevens.com<\/a><\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

A .WAV With A Payload, (Tue, Apr 21st) There have been reports of threat actors using a .wav file as a vector for malware. It’s a proper .wav file, but they didn’t use staganography. The .wav file will play, but you’ll just hear noise: That’s because the TAs have just replaced the bytes that encode […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-12293","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12293"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=12293"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12293\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=12293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=12293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=12293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}