Philippe Lagadec

@decalage2

Author of oletools, olefile, ViperMonkey, ExeFilter, Balbuzard. #DFIR, #malware analysis, maldocs, file formats, #Python. @[email protected]

@[email protected]

linktr.ee/decalage

Replies Reposts Media

Pinned
Philippe Lagadec
@decalage2
Oct 27, 2025
At #HackLu I gave a presentation about "How to better identify (weaponized) file formats": - Why do we need to identify file formats accurately? - Why can the current tools (libmagic, magika) sometimes be bypassed? - How can we do better? => See it here: youtu.be/Qp5GDh2sj6A
Philippe Lagadec
@decalage2
Mar 12
"Zombie ZIP" CVE-2026-0866 is not really a vulnerability which can evade AV engines, because the resulting ZIP file cannot be opened by normal tools, it's malformed. It's more like a steganography/obfuscation trick, you need malicious code already running to extract the payload.
blackorbird
@blackorbird
Mar 11
ZIP format confusion technique that evades 98% of antivirus engines. Malformed ZIP archive that evades antivirus detection by declaring Method=0 (stored) while containing DEFLATE-compressed payload. CVE-2026-0866 github.com/bombadil-syste…
Philippe Lagadec
@decalage2
Feb 26
The explanation of the recent vulnerability in Notepad (CVE-2026-20841): ctrl+clicking on a link in markdown files may lead to download and open some types of remote files (such as JAR) without warnings.
Hiumee
@Hiumee
Feb 25
Just published my write-up on CVE-2026-20841 in Windows Notepad. Exploring how Markdown link handling can lead to code execution. hiumee.com/posts/2026-02-…
Philippe Lagadec
@decalage2
Feb 10
A vulnerability in Notepad 🤦‍♂️ msrc.microsoft.com/update-guide/v…
Philippe Lagadec
@decalage2
Feb 6
How can we detect malicious documents exploiting the recent 0-day in MS Office CVE-2026-21509? I designed a YARA rule for this, which detects all the malicious files that have been reported. decalage.info/CVE-2026-21509/
1