Hello everyone. 1
Welcome back to another video of expert Malware analysis and reverse engineering. 2
Starting from this video we'll start analyzing a bunch of malicious document files. In the previous video, 3
We looked at some spam emails and we understood how those spam emails can be identified, in the next 4
step 5
We try and analyze the malicious attachments that comes with those spam emails. 6
So we'll begin with we understood the file structure of document files and starting from this video 7
we'll start dissecting them into much more details as to understand how we can uncover malicious macros 8
or malicious scripts that are hidden in those document files. 9
So this snapshot is basically the Hex representation of doc file. 10
So you can basically use any hex editor to open a document file to view the content of the file in hexadecimal 11
format. 12
Now if you look at the first few characters this basically is something that we discussed in the previous 13
video where I said that I'll leave this as an exercise for you all to figure out. 14
So basically the first few bites represents the magic number of any given file format and in the doc 15
file the magic number is 16
So this was the exercise which I quickly wanted to point out. 17
You can use any popular Hex editor. 18
There are a bunch of very good free ex-editor as well. 19
My personal favorite is 010 editor. 20
It's really powerful and it has a bunch of file analysis templates as well, which makes it very easy 21
to separate different sections of the file by just marking the locations in the text in the hexadecimal 22
formats. 23
OK so what are the tools for analyzing malicious documents. 24
We'll be covering two of them. 25
One is Oledump and the other one is Oletools. 26
Let's quickly look into OLEdump. 27
So it's anOLE file parsing tool that is Didier Stevens. 28
It allows you to analyze data streams and embedded macros. 29
It supports Doc, ppt and xls. You can get more details on website. 30
The Steven's website. 31
That is the link has been mentioned here. 32
So setting up Oledump is pretty straightforward. 33
You can download the zip from the official website and you can just run the python file. 34
You need to have Python already present on your machine. 35
You would also require dependency called OlefileIO which is a python library that helps in parsing 36
of OLE compound file formats. The tool is 37
Crossplatform Hence we can use it both on Windows as the last Linux we as well. 38
For example we can use it in Remnux as well which we discussed in the first section where we talked 39
about Remnux distro, which is a single distro for malware analysis. 40
The good thing is that Oledump gets installed with Flare as well. 41
And we talked about Flare as well when we were setting up the lab. 42
So if you have followed those steps you should already have the proper environment set up and ready 43
for using. 44
Oledumb. If not you can obviously follow the steps to have a really dumb set up on your virtual 45
machine. 46
OK. 47
So let's jump to our virtual machine. 48
Here is the website 49
From there you can download or Oledumb. 50
There is a quick tutorial as well. 51
It's very helpful. 52
You can quickly read through it to get an idea of how oledump works. To begin using it, 53
Let's come to our Flare tools folder here you'll see a folder called office. 54
If you go inside it you'll see that there is already oledump present here. 55
There are a bunch of different tools here will predominantly be using oledump.py. My analysis 56
files are prison in a folder called course files here. 57
I have payment.doc and statement.docx 58
These are the two files that we'll be analyzing now.