Welcome everyone to another video off Malware Analysis and reverse engineering course. 1
So in the previous video we understood how we can analyze email headers to understand whether a given 2
e-mail is spam or not. 3
We also noticed that those e-mails consisted of malicious attachments as well. 4
So starting from this video we're going to dive deeper into understanding those attached file format 5
and we'll try and see how we can uncover the malicious characterstices of those file attachments. 6
We want to start with understanding Microsoft Office file formats because it is one of the most popular 7
file formats that is used by everyone. By Microsoft Office file formats, 8
I'm referring to common files like Microsoft Word Microsoft PowerPoint Microsoft Excel. 9
These are one of the most common everyday tools that are used in enterprises. 10
So Microsoft Office format has two different file formats. 11
One is the OLE compound file and the second one is the Open Office. 12
XML or simply open XML format. 13
So first let us look into the OLE compound file. so OLE stands for object linking and embedding. In 14
this file format a document would consist of different objects which are linked with each other thus 15
forming a complete container of the document. 16
It is the hierarchial collection of stream and storage objects. It consists of a root storage object 17
with optional storage objects and stream objects in a nested hierarchy. 18
It supports older versions ranging from Microsoft Windows 97 to 2003. 19
The Forth point lists a bunch of hexadecimal characters. I want to leave this as an exercise for you 20
to go in figuring out what exactly those hex characters mean. 21
You can definitely find the answer to this question in the discussant section as well but I would highly 22
encourage that go and figured out what exactly these hex characters mean. 23
So here is a pictorial representation of the OLE compound file formats and this will make things a 24
lot more clearer to you. 25
So as we saw in the previous slide, there is storage and the root storage consist of stream and storage 26
in a hierarchy. 27
Now the storage can be further sub-classified into either storage or stream objects. Now a stream 28
is basically a collection of data that is present inside the document and the storage can further contain 29
either stream or storage objects. 30
So if you look at the diagram on the right hand side there will be a root storage and within that storage 31
there is another storage called macro. Within that macro, 32
There is another storage called VBA and there are a bunch of streams like one table, Compobject, 33
summary information, word document. 34
So if you create a Word file, there will be a root storage at the top and if that word file contains 35
macros there, will be a storage called macros. 36
Now whatever text that you type inside that word document gets recorded into the stream that 37
is called Word document. 38
The one here at the last. 39
So these streams basically contains the data about the particular document. 40
Now if your document also contains macros there will be a storage folder called macros. 41
Within that there will be an another storage folder called VBA and within that VBA there will be a bunch 42
of streams that will contain the data. 43
And by the data on what I mean is that they will contain the actual VBA code. 44
So this was an overview of the OLE compound file format. Moving on to office open XML format. This is for 45
the newer versions of Microsoft Office ranging from 2007 onwards. 46
It's much more simpler than the OLE compound file because it's simply a zip file format where you basically 47
collect a bunch of linked files and you kind of zip them and create a toplevel file format for the 48
particular document. It represents document in the form of markups which is definitely the property of 49
XML. 50
So how do you analyze a DOCX file. 51
It's very simple once you have our DOCX file, all you can do is just remove the DOCX extension 52
from behind and replace it with zip. 53
And you can just right click and unzip and it will give you the entire content of that 54
DOCX file 55
So I want to specify that DocX is the extension of the newer versions of Microsoft Office like Docx, 56
Xlsx, Pptx. 57
These are the newer versions of Microsoft Office. the older versions, the OLE compound file versions 58
they have file extensions as Doc, Ppt, Xls etc.. 59
So coming back to the doc X-File package Lets say you right click and unzip the entire package you'll 60
see a bunch of different file names. 61
You'll have records doc prop's word. Inside word 62
You will again have relations. 63
So the relation is nothing but a lookup for each item that is reference inside the document. 64
You'll have another file called Document.xml 65
This is basically the text of the document where the entire text is there within the document file will 66
be present. 67
Then you have header and footer that will contain the information of the header and footer that you 68
create inside your document. 69
You have styles, media, themes, chart and so on. 70
So this is how the newer docx file formats are created by Microsoft office. 71
So that was all about the two different file formats that Microsoft Office supports. 72
Starting from next videos will start doing a deep dive into actual files to understand how we can uncover 73
the malicious traits out of them. 74
That's all for this video. 75
If you have any questions or if you want to understand more please do write in the discussion section 76
and we can discuss more about these file formats. 77
Thanks a lot for watching. 78
Buh-Bye.