SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsre-doc-malware

re-doc-malware

Data & analytics

View repository

Updated 10-15 21:34

About this skill

Malicious Document Analysis

When to Use / When Not to Use

  • Use: phishing attachments (PDF/Office/RTF), document exploit samples, macro documents, document-based malicious payloads
  • Use: only a single document sample is available, and the payload extraction chain needs to be reconstructed (macro → script → executable → callback)
  • Don't use: pure script macros (go to [[re-script-deob]]); the document is only a carrier (core logic in the downloaded payload)
  • Don't use: only web/email gateway-side metadata is available (no sample file itself)—get the sample first, then analyze
  • Note: dynamically opening documents must be done in a sandbox ([[re-sandbox]], [[re-analyze/platform-tips]] highest principle); documents may detect the environment and not trigger (see pitfall 6)

Tool Preparation

pdf-parser / pdfid (PDF structure analysis)

  • Linux: apt install pdf-parser pdfid(often preinstalled on Kali; same-named packages in Debian/Ubuntu repositories) or run from GitHub DidierStevens/DidierStevensSuite source; macOS: brew install pdf-parser / pip
  • Windows: pip (WSL also works)
  • Verify: pdf-parser --version(if not, python3 pdf_parser.py --help）；pdfid.py sample.pdf can output object counts
  • Supplement (note: peepdf is archived, from the Python 2 era, PyPI only has 0.3.6—prefer pdf-parser/pdfid)

qpdf (PDF stream decompression, optional)

  • Linux: apt install qpdf；macOS: brew install qpdf
  • Verify: qpdf --version
  • Purpose: expand object streams/compressed streams into readable form (qpdf --qdf --object-streams=disable in.pdf out.pdf), and cross-check with -d dump

olevba / rtfobj (Office/RTF macro and embedded object extraction)

  • Multi-platform: pip install oletools(oletools includes olevba, rtfobj, oleobj, msodde, oleid, mraptor, etc.)
  • Verify: olevba --help；rtfobj --help
  • Note: oledump is not in the oletools package—it is a standalone tool (GitHub DidierStevens/DidierStevensSuite to get oledump.py, requires pip install olefile dependency;python3 oledump.py -s <流号> <文件> dump by stream)

xlmdeobfuscator (Excel 4.0 macro deobfuscation, optional)

  • pip install xlmdeobfuscator
  • Verify: xlmdeobfuscator --help
  • Applicable: XLM macro sheets in .xls (olevba 0.54+ can already recognize XLM; use this tool to restore when obfuscation is deep)

LibreOffice (sandbox open verification, optional)

  • Linux: apt install libreoffice / dnf install libreoffice；macOS: brew install --cask libreoffice; Windows: official installer
  • Verify: libreoffice --version
  • Note: LibreOffice by defaultdoes not execute VBA macros (macro security restriction)—to verify macro behavior in the sandbox, install real Office or change LibreOffice macro security settings (see [[gotchas]])

7z (OLE/OOXML unpacking)

  • Linux: apt install p7zip-full；macOS: brew install sevenzip; Windows: official installer
  • Verify: 7z --help
  • 7z can directly list internal streams of OLE compound documents (WordDocument/1Table/VBA/PROJECT, etc.) and files inside OOXML packages

Operation Steps

Execute in order; archive each step's artifacts (path + sha256, see [[re-triage]]).

  1. Document Type Identification：

    file sample.pdf sample.docm sample.rtf
    • PDF：%PDF header; old Office format: CFB (OLE compound document,D0 CF 11 E0）；OOXML：zip（PK）；RTF：{\rtf
    • The type determines the subsequent toolchain; for mixed types (such as PDF with embedded OLE), follow each branch separately

  2. PDF Static Analysis：

    pdfid.py sample.pdf                       # 对象计数，恶意特征速览
pdf-parser -f sample.pdf | head -50       # 对象树遍历（-f 经过 filter 解压流）
pdf-parser -s /JS sample.pdf              # JavaScript 动作
pdf-parser -s /OpenAction sample.pdf      # 打开即执行动作
pdf-parser -O sample.pdf                  # 解析对象流（ObjStm）内的对象
    • Malicious characteristics:/JS(JavaScript action),/OpenAction(open trigger),/AA(additional actions, page-level/document-level),/Launch(external program),/EmbeddedFile(embedded file),/RichMedia(Flash legacy)
    • Vulnerability documents:/JBIG2Decode(JBIG2 vulnerability),/RichMedia and other CVE-corresponding structures — compare against known exploitation patterns by structural features (not version numbers)
    • JS payload → [[re-script-deob]] to restore; when the structure is suspicious but the object tree is incomplete, first qpdf --qdf --object-streams=disable expand, then inspect

  3. Office macro extraction：

    olevba -c sample.docm > macro.txt        # 提取宏源码（-c 只输出源码）
olevba --decode -c sample.docm > macro_decoded.txt  # 自动解常见字符串混淆（--decode 自 oletools 0.24 起；源码内解码串显示用 --reveal）
olevba --deobf -c sample.docm            # 表达式级去混淆（0.46+）
strings sample.docm | grep -iE 'DDEAUTO|http|powershell' | head
    • Macro chain entry points: Word Document_Open / AutoOpen / AutoExec；Excel Workbook_Open / Auto_Open; form controls/hotkeys/custom button triggers are also not uncommon
    • Other vectors: DDE fields (DDEAUTO, disabled by default in newer Word — still triggered in older versions), external links (/hyperlink), OLE embedded objects (oleobj extract and analyze each one), Excel 4.0 XLM macro sheets (xlmdeobfuscator）
    • when olevba outputs warning VBA stomping , note: what actually executes is P-code rather than the extracted source code (see Pitfall 2)
    • Macro payload → [[re-script-deob]] deobfuscation chain

  4. RTF analysis：

    rtfobj sample.rtf        # 列出嵌入 OLE 对象与 CLSID
    • The entire RTF can be \'XX hex-escape obfuscated — first restore the escapes, then search for keywords
    • Embedded objects (\objdata) after extraction continue via the OLE/CFB branch; vulnerability documents commonly contain \pict embedded data

  5. Template injection and relationship files (OOXML)：

    7z l sample.docx | head -40
7z x sample.docx -oext/
grep -r 'TargetMode="External"' ext/word/_rels/ 2>/dev/null
    • Check all rels files:document.xml.rels in attachedTemplate / externalLink external target = remote template injection
    • Template injection lets a document exhibit outbound behavior even without macros (remote template with macros) — after unpacking, verify each rels one by one

  6. Payload extraction：

    • Extraction items: scripts/URLs/binaries/multi-stage payloads (each layer archive number + sha256, paths and hashes into [[re-analyze/analysis-contract]])
    • Indicator extraction → [[re-ioc]] (URL/domain/hash); preliminary inspection of extracts → [[re-triage]]
    • Multi-stage chain (document → script → downloader → executable) expanded layer by layer, noting the trigger method for each layer

  7. Dynamic verification(sandbox):

    • Open in [[re-sandbox]] with LibreOffice/reader, network isolated (INetSim/fake DNS)
    • Observe: file drops, process chain, network callbacks ([[re-behavior]] linkage); extend the observation window and simulate user interaction to counter delayed execution (see Pitfall 6)
    • For macro execution verification, prefer real Office (LibreOffice does not execute VBA by default, see Tool Preparation)

Cross-domain integration

  • [[re-malware]] gateway: this skill's affiliation (selection tree "Phishing Attachments" branch)
  • [[re-script-deob]]: macro/JS deobfuscation and restoration
  • [[re-sandbox]]: forced prerequisite for dynamic opening
  • [[re-ioc]]: extract indicators
  • [[re-behavior]]: behavior verification linkage
  • [[re-triage]]: hash/preliminary inspection and payload extraction evidence preservation

Common Pitfalls and Traps

  • PDF object stream compression not decompressed: symptom — pdf-parser output has no /JS; cause — the object is inside a FlateDecode-compressed stream or ObjStm; countermeasure —-f force decompression,-O expand the object stream then inspect
  • VBA stomping (execution inconsistent with source code): Symptom—the source code extracted by olevba looks harmless/garbled, but dynamic behavior is abnormal; Cause—Office executes compiled P-code, and the source code is only an archive (can be replaced/truncated); Countermeasure—when olevba warns, rely on dynamic behavior, and if necessary use pcodedmp to disassemble the P-code for comparison
  • Macro is obfuscated: Symptom—after olevba extraction the screen is full of concatenation/encoding; Cause—macro obfuscation; Countermeasure—--decode/--reveal/--deobf decode layer by layer, [[re-script-deob]] deobfuscation chain
  • Document vulnerability version characteristics: Symptom—structural characteristics do not match a known CVE; Cause—the exploit code targets a specific version; Countermeasure—compare against exploit patterns by structural characteristics (not version number), and note version assumptions
  • MOTW blocks macros (sandbox execution fails): Symptom—opening the document in the sandbox does not trigger macros; Cause—the downloaded file carries Mark-of-the-Web (Zone.Identifier), and Office 2016+ blocks its macros by default; Countermeasure—on the Windows side Unblock-File(PowerShell) or delete the Zone.Identifier ADS before opening; for detection-type documents see gotcha 6
  • Sandbox detection document (delayed execution): Symptom—no behavior in the sandbox; Cause—the document detects the environment and does not trigger or delays triggering; Countermeasure—extend the observation window, simulate user interaction (scrolling/clicking/Office version checking)
  • Template injection is easily missed: Symptom—macros are normal but there is still external communication; Cause—/word/_rels remote template; Countermeasure—after unpacking, check all rels files (step 5)
  • Tool differences and more edge cases (oledump usage, RTF counterexamples, LibreOffice macro settings) see [[gotchas]] and [[decision-tree]]