GREM · Domain 3
Malicious Document Analysis
About 25% of the exam
Document attack surface
- Macro code
- runs when the user enables it
- Legacy sheet macros
- formulas hidden in old sheets
- Embedded object
- executable or script inside the file
- Exploit payload
- malformed structure targets the parser
- Remote template
- content fetched when opened
- Link action
- launches an external program
Container formats
- Modern office files are compressed archives
- Legacy office files are compound streams
- Rich text embeds objects as encoded blobs
- Documents can carry any file type inside
- Extension rarely proves the real format
- Inspect the container before executing anything
Macro triage
- List the macro modules and their names
- Look for automatic execution entry points
- Flag shell and object creation calls
- String reversal hides suspicious names
- Payload bytes may sit in form controls
- Character arrays rebuild strings at runtime
Source hidden in form properties is a classic way to slip past tools that read only code modules
Script components
- Script host
- runs standalone script files
- Object creation
- reaches system automation interfaces
- File system object
- reads and writes files
- Binary stream object
- saves downloaded binary content
- Shell execute
- launches the dropped payload
- Management instrumentation
- process creation and persistence
Document analysis workflow
Identify
- Confirm the real container format
- List internal streams or archive parts
- Hash the document and every extract
- Note remote references in the relationships
Extract
- Pull macro source and form data
- Extract embedded objects recursively
- Decode each encoding layer in turn
- Save extracted scripts for separate review
Interpret
- Rebuild the intended command line
- Identify the download and execute chain
- Record every host and path referenced
- Decide whether execution is even needed
Static extraction usually answers the question, and it never risks running the payload by accident
Portable document tells
- Script keyword
- embedded code inside the document
- Automatic action
- runs on open without interaction
- Launch action
- starts an external program
- Embedded file
- attachment carried inside
- Rich media
- player components with old vulnerabilities
- Object streams
- content split and encoded across objects
Obfuscation in documents
- Encoding layers stacked on each other
- Strings reversed or built character by character
- Payload stored as an encrypted number array
- Content split across many objects
- Whitespace and comments padding the code
- Random variable names defeating simple rules
Living off the land binaries
- Certificate utility downloads and decodes files
- Scripting hosts execute delivered code
- Task scheduler creates recurring persistence
- Management tooling spawns remote processes
- Signed binaries proxy the execution
- Command lines matter more than file names
The malicious part is often the argument, not the binary, so log and read full command lines
Delivery chain
- Lure email
- Document opened
- Macro or exploit runs
- Payload fetched
- Loader executes
- Persistence installed
Each stage is a separate detection opportunity, so record indicators for every link in the chain
Defensive context
Platform controls
- Protected view blocks content from untrusted sources
- Macros from the internet blocked by policy
- Scan interface inspects scripts at runtime
- Attack surface rules block child processes
How attackers respond
- Persuade the user to enable content
- Move to container formats that strip the mark
- Patch or bypass the scan interface
- Switch to shortcut and installer lures
Detection ideas
- Office application spawning a shell
- Script host launched from a document
- Encoded command line arguments
- Outbound request right after document open
Network indicators from documents
- Download hosts and full request paths
- Remote template locations in the relationships
- User agent used by the fetching component
- Second stage domains inside the payload
- Certificates presented by the staging server
- Timing between open and first request
Reporting document cases
- State whether user interaction was required
- Show the reconstructed command line
- Distinguish exploit from social engineering
- List every extracted object and its hash
- Give detection ideas at each stage
- Note what remained unresolved
Key artifacts
- Automatic entry point
- macro that runs on open
- Form control payload
- data hidden outside code modules
- Embedded object stream
- file carried inside the document
- Relationship entry
- reference to a remote resource
- Encoded command
- argument that decodes to script
- Mark of origin
- flag that the file came externally
Know the order
- Identify the container
- Enumerate the parts
- Extract statically
- Decode layer by layer
- Reconstruct the command
- Detonate only if needed
Detonation is the last resort in document work, because static extraction is safer and usually sufficient
Reference strip: documents and scripts
Formats
- Compressed archive office files
- Compound stream legacy files
- Rich text with encoded objects
- Portable documents with object streams
Execution paths
- Automatic macro entry points
- Legacy sheet macro formulas
- Embedded object double click
- Parser exploits in old components
Script capabilities
- File creation and download
- Process creation through automation
- Persistence through tasks and services
- Registry writes for configuration
Obfuscation
- Stacked encoding layers
- Reversed and rebuilt strings
- Encrypted numeric arrays
- Payload split across objects
Detection
- Document spawning a shell
- Encoded command line arguments
- Request immediately after open
- Unexpected child of an office process
Quick exam traps
- Trap: A document with no macros cannot be malicious
- Trap: Protected view blocks every path to execution
- Trap: Blocking one scripting host removes the risk
- Trap: Extracted scripts are safe to run for convenience
- Trap: A document must be detonated to identify its payload
- Trap: Signed system binaries in a command line are always benign
cybercertprep.com · original revision sheet written from the public body of knowledge