I finding it interesting and entertaining the relative flood these phishing campaigns use, these DocuSign messages all have links that point to the @[email protected] feed proxy service.

One of URLs contained “sad.php” its seemed like an appropriate filename.

#spam #security

I look forward to see how Ghidra will handle .Net files. It’ll be nice to have a cross platform add to look at .Net file.

https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html