Static MalDoc Analysis

---

Malicious document (maldoc) refers to a weaponized document file that has been modified to carry out malicious activities when it is opened.

• done through macros embedded in the file
  • or other objects embedded
• macros are scripts that can be embedded into office documents that can be programmed to execute a series of commands automatically
  • are a legitimate tool that can be used to automate repetitive tasks
  • but can also be exploited
  • Visual Basic for Applications (VBA) is the typical language used to write macros

Static Analysis

Oledump.py

• Part of DidierStevensSuite
• oledump.py
• OLE stands for Object Linking and Embedding
  • allows embedding and linking to objects in documents
  • enables embedding charts and other stuff in documents
• allows us to analyze the embedded objects
• macro-enabled documents end with an extra m
  • e.g., .docm, .xlsm
• usage: python3 oledump.py <file-name>
  • see which data stream number to analyze
  • M in the stream means there is an embedded macro
• python3 oledump.py <file-name> -s <stream-number>
  • get hex dump of macro
  • -S flag runs strings
  • --vbadecompresscorrupt
    • extracts full VBA script

Python Oletools

oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and debugging.

• oletools