Malicious Document Analysis
Malicous documents are ubiquitous source of infection. It's good to learn to analyze them.
Static Analysis
.xlsm m denotes that it is macro enabled document.
We can unzip the excel documents to see it's contents and see if anything interesting appears.
Use tools like
oledump.pyon remnux
oledump.py is a powerful tool developed by Didier Stevens used for analyzing OLE (Object Linking and Embedding) files. These are commonly found in Microsoft Office documents (e.g., .doc, .xls, .ppt) and can contain embedded objects like macros, scripts, or even malicious payloads.
🔍 Purpose of oledump.py
Primarily used in malware analysis and digital forensics, oledump.py helps:
Inspect internal streams in OLE files.
Detect and extract VBA macros, which may be obfuscated or malicious.
Analyze potential malware hidden inside Office documents (e.g., phishing attachments).
e.g.
it detects A3 stream has Macros, we can extract those
It will show decompressed macros code
docm file similarly can have macros in them,
however docx file can still execute macros even though they themselves can't have macros in them.
e.g.
in this docx filw after unzipping we see settings file which uses dotm (Document Template + Macros) file from a remote server which serves macros and will be executed.
Last updated
