ActiveMime - Revision history

Dexvertbot: /* Sample files */

2023-12-28T03:25:58Z

‎Sample files

Dexvertbot: Undo revision 46580 by Dexvertbot (talk)

2023-12-28T03:01:56Z

Undo revision 46580 by Dexvertbot (talk)

Dexvertbot: Change telparia.com samples link to template

2023-12-28T02:55:22Z

Change telparia.com samples link to template

Sembiance: added software and sample files

2022-12-16T15:50:10Z

added software and sample files

Jsummers: Category:Microsoft

2016-08-24T18:48:38Z

Category:Microsoft

Jsummers at 18:46, 24 August 2016

2016-08-24T18:46:54Z

Dan Tobias at 03:30, 8 June 2016

2016-06-08T03:30:28Z

Ross-spencer: Initial commit of the undocumented format from Microsoft using information on https://github.com/phishme

2016-06-08T03:11:43Z

Initial commit of the undocumented format from Microsoft using information on https://github.com/phishme

New page

Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.

ActiveMime binary objects may reside in Microsoft Web Archive ([http://fileformats.archiveteam.org/wiki/Ext:mht MHT]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].

There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22&safe=off&espv=2&biw=1920&bih=955&source=lnt&tbs=cdr%3A1%2Ccd_min%3A2012%2Ccd_max%3A2013&tbm= 2012] but not much earlier.

There is more information and a further call for collaboration or corrections on what is documented on the Pishme GitHub [https://github.com/phishme/python-amime/blob/master/README.md README].

== Magic Number ==

The structure is partially reversed engineered by phishme on GitHub. Once decoded from Base64 the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.

== Other Links ==

* [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
* [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload
* [https://www.fireeye.com/blog/threat-research/2015/06/evolution_of_dridex.html Evolution of Dridex]
* [https://github.com/decalage2/oletools/commit/75259a45f4e9b375b7c22f830ddf725b648b8917#diff-fcb46827023e27f0d62a2fe61f52c1a0R432 Decalage Python code for extracting data from ActiveMime]
* [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren Article on ActiveMime]
* [https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/ Malicious Macros Evades Detection Using Unusual File Format]
* [https://social.msdn.microsoft.com/Forums/office/en-US/fa6aa92a-ed56-4699-a0d4-3f42c077c602/question-about-base64-encoded-in-word-2003-xml-file?forum=worddev Early MSDN forum post asking about ActiveMime]

@@ Line 20: / Line 20: @@
 == Sample files ==
-* https://telparia.com/fileFormatSamples/archive/activeMime/
+* {{DexvertSamples|archive/activeMime}}
 == Other Links ==

← Older revision		Revision as of 03:01, 28 December 2023
Line 9:		Line 9:
	ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht\|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].		ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht\|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].

−	There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22	+	There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22&safe=off&espv=2&biw=1920&bih=955&source=lnt&tbs=cdr%3A1%2Ccd_min%3A2012%2Ccd_max%3A2013&tbm= 2012] but not much earlier.
		+
		+	There is more information and a further call for collaboration or corrections on what is documented on the Pishme GitHub [https://github.com/phishme/python-amime/blob/master/README.md README].
		+
		+	== Magic Number ==
		+	The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
		+
		+	== Software ==
		+	* [https://github.com/idiom/activemime-format activemime-format (extractor)]
		+
		+	== Sample files ==
		+	* https://telparia.com/fileFormatSamples/archive/activeMime/
		+
		+	== Other Links ==
		+	* [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
		+	* [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload
		+	* [https://www.fireeye.com/blog/threat-research/2015/06/evolution_of_dridex.html Evolution of Dridex]
		+	* [https://github.com/decalage2/oletools/commit/75259a45f4e9b375b7c22f830ddf725b648b8917#diff-fcb46827023e27f0d62a2fe61f52c1a0R432 Decalage Python code for extracting data from ActiveMime]
		+	* [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren Article on ActiveMime]
		+	* [https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/ Malicious Macros Evades Detection Using Unusual File Format]
		+	* [https://social.msdn.microsoft.com/Forums/office/en-US/fa6aa92a-ed56-4699-a0d4-3f42c077c602/question-about-base64-encoded-in-word-2003-xml-file?forum=worddev Early MSDN forum post asking about ActiveMime]
		+
		+	[[Category:Microsoft]]

@@ Line 5: / Line 5: @@
 |mimetypes={{mimetype|application/x-mso}}
 }}
-Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode [[Microsoft Office]] Macros.
+Documented by [https://github.com/phishme phishme] on GitHub, '''ActiveMime''' is an undocumented Microsoft file format often seen used to encode [[Microsoft Office]] Macros.
 ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].
@@ Line 15: / Line 15: @@
 == Magic Number ==
-The structure is partially reversed engineered by phishme on GitHub. Once decoded from Base64 the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
+The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
 == Other Links ==
@@ Line 26: / Line 26: @@
 * [https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/ Malicious Macros Evades Detection Using Unusual File Format]
 * [https://social.msdn.microsoft.com/Forums/office/en-US/fa6aa92a-ed56-4699-a0d4-3f42c077c602/question-about-base64-encoded-in-word-2003-xml-file?forum=worddev Early MSDN forum post asking about ActiveMime]

@@ Line 5: / Line 5: @@
 |mimetypes={{mimetype|application/x-mso}}
 }}
-Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.
+Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode [[Microsoft Office]] Macros.
-ActiveMime binary objects may reside in Microsoft Web Archive ([http://fileformats.archiveteam.org/wiki/Ext:mht MHT]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].
+ActiveMime binary objects may reside in Microsoft Web Archive ([[Ext:mht|MHT]]) files documented by [https://blog.cyren.com/articles/new-tricks-of-macro-malware.html Cyren].
 There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from [https://www.google.co.nz/search?q=%22activemime%22&safe=off&espv=2&biw=1920&bih=955&source=lnt&tbs=cdr%3A1%2Ccd_min%3A2012%2Ccd_max%3A2013&tbm= 2012] but not much earlier.

← Older revision		Revision as of 03:30, 8 June 2016
Line 1:		Line 1:
		+	{{FormatInfo
		+	\|formattype=electronic
		+	\|subcat=Document
		+	\|extensions={{ext\|mso}}
		+	\|mimetypes={{mimetype\|application/x-mso}}
		+	}}
	Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.		Documented by [https://github.com/phishme phishme] on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.

@@ Line 14: / Line 14: @@
 == Magic Number ==
 The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
-== Other Links ==
+== Software ==
 * [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
 * [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload