malware / Yet Another Security

Robots.txt Information

Robot	Path	Permission
GoogleBot	/	✔
BingBot	/	✔
BaiduSpider	/	✔
YandexBot	/	✔
# If you are regularly crawling WordPress.com sites, please use our firehose to receive real-time push updates instead. # Please see https://developer.wordpress.com/docs/firehose/ for more details. Sitemap: https://malware.pizza/sitemap.xml Sitemap: https://malware.pizza/news-sitemap.xml User-agent: * Disallow: /wp-admin/ Allow: /wp-admin/admin-ajax.php Disallow: /wp-login.php Disallow: /wp-signup.php Disallow: /press-this.php Disallow: /remote-login.php Disallow: /activate/ Disallow: /cgi-bin/ Disallow: /mshots/v1/ Disallow: /next/ Disallow: /public.api/ # This file was generated on Thu, 02 Feb 2023 00:27:01

Meta Tags

Title	Yet Another Security
Description	Yet Another Security Blog Further Evasion in the Forgotten Corners of MS-XLS It’s been a few weeks since my last discussion 1 of Excel 4.0 macro shenaniga
Keywords	N/A

Server Information

WebSite	malware.pizza
Host IP	192.0.78.24
Location	United States

Related Websites

                        Site
                        Rank
                    

More to Explore

malware.pizza Valuation

US$347,273

Last updated: 2023-04-28 14:44:42

malware.pizza has Semrush global rank of 30,478,355. malware.pizza has an estimated worth of US$ 347,273, based on its estimated Ads revenue. malware.pizza receives approximately 40,070 unique visitors each day. Its web server is located in United States, with IP address 192.0.78.24. According to SiteAdvisor, malware.pizza is safe to visit.

Traffic & Worth Estimates

Purchase/Sale Value	US$347,273
Daily Ads Revenue	US$321
Monthly Ads Revenue	US$9,617
Yearly Ads Revenue	US$115,402
Daily Unique Visitors	2,672
Note: All traffic and earnings values are estimates.

DNS Records

Host	Type	TTL	Data
malware.pizza.	A	300	IP: 192.0.78.24
malware.pizza.	A	300	IP: 192.0.78.25
malware.pizza.	NS	86400	NS Record: ns1.wordpress.com.
malware.pizza.	NS	86400	NS Record: ns2.wordpress.com.
malware.pizza.	NS	86400	NS Record: ns3.wordpress.com.
malware.pizza.	MX	14400	MX Record: 0 malware-pizza.mail.protection.outlook.com.
malware.pizza.	TXT	3600	TXT Record: MS=ms52836740
malware.pizza.	TXT	3600	TXT Record: v=spf1 include:spf.protection.outlook.com -all

HtmlToTextCheckTime:2023-04-28 14:44:42

Yet Another Security Blog Further Evasion in the Forgotten Corners of MS-XLS It’s been a few weeks since my last discussion 1 of Excel 4.0 macro shenanigans and the space continues to change. LastLine published a great report 2 which summarized the progression of weaponized macros from February through May. The good folks at InQuest have continued 3 identifying 4 malicious 5 macro documents 6 . @DissectMalware ‘s excellent XLMMacroDeobfuscator 7 has massively expanded its range of macro emulation, and FortyNorth Security released EXCELntDonut 8 , a tool for converting Donut 9 shellcode into multi-architecture Excel 4.0 macros. Over the past few weeks I’ve also started seeing some of the files generated by my tool Macrome 10 begin to trigger detections on VirusTotal 11 . This is exactly the sort of thing I want to see – besides the fact that it implies that AV is getting better signal on this attack vector, it also provides an opportunity to improve my tool and take better guesses

HTTP Headers

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 21 Oct 2021 14:38:44 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://malware.pizza/
X-ac: 2.mdw _dca 

HTTP/2 200 
server: nginx
date: Thu, 21 Oct 2021 14:38:44 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding
vary: Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
host-header: WordPress.com
link: ; rel=shortlink
x-ac: 2.mdw _dca

malware.pizza Whois Information

Domain Name: malware.pizza
Registry Domain ID: 734bcb9411494016bb3b1fe796516c12-DONUTS
Registrar WHOIS Server: whois.godaddy.com/
Registrar URL: http://www.godaddy.com/domains/search.aspx?ci=8990
Updated Date: 2021-06-16T21:33:40Z
Creation Date: 2017-05-02T21:33:21Z
Registry Expiry Date: 2022-05-02T21:33:21Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Registrant Organization: Domains By Proxy, LLC
Registrant State/Province: Arizona
Registrant Country: US
Name Server: ns2.wordpress.com
Name Server: ns1.wordpress.com
Name Server: ns3.wordpress.com
DNSSEC: unsigned
>>> Last update of WHOIS database: 2021-09-10T08:45:52Z <<<

malware.pizza valuation and analysis