Hello and welcome back to a new section in this new section.
We are going to start looking at how to analyze Microsoft Office documents.
We will start off by looking at the principles of analyzing office documents, office attacks, one
of the many ways in which malware authors are now using in order to infiltrate and in fact, computers.
And they can do so using three methods.
First is by using macros, macros, VBA scripts, which are embedded inside the office document and
will execute the office document is open.
It is one of the most powerful VBA scripting language available and can do almost anything which the
malware onto, which is the second is to use features of the office programs, for example, DDE, that
can also automate certain tasks and execute certain commands.
The third is to take advantage of vulnerabilities within the office programs themselves by using a splice
to do so.
Document analysis consists of looking for certain keywords, certain signs of malicious elements, for
example, scripts, for example, VBA macros, he will look for commands in the documents.
So if you come across any kind of document that you raise suspicion and also you should look out for
embedded files and these embedded files could be binary files or even compressed or encoded obfuscated
files within the Microsoft document.
First degree need to be aware of that is that there are two versions of Microsoft Office, also known
as office document formats.
The first version is the older version, which is before 2007.
And in this version, the Microsoft documents will have these extensions, the D.O.C., the Excel and
PBT PowerPoint.
This story format is also known as structured storage format or as has every shot.
And after 2007, Microsoft released a new format also known as OpenOffice XML format.
And in this format, the Microsoft document itself is actually an archive, a sepak containing XML site.
And if this is a format, then you will see the extension, the O.C. X, dot, x, x and so on.
And in this format, if you see it is done in the U.S. and it means that it has got my crew excited.
However, even me counting macros that may not be permitted to run the smackeroos by certain authors
have ways in which it can be overcome.
So these are the two main office formats you should be aware.
Let's just take a look at the SS effort in the old format structured storage format.
The header of this structure will contain a string in hexadecimal, which is the zero one one easy one,
be one twenty one.
And this is easy to remember because these ossy f i e Duquan hecho speak to denote certain strings,
for example, in this case dogfighter.
And then below that you will have a hierarchy of fast system to start, which is the root storage and
below the RESTARICK you have children, you can have stories as well as streams, and it is in the streams
in which you can find some other data, including inverted files.
And one of the important and useful tool in studying analysing the excessive format for acquisition
of this document is the Setto or E 2s, where it does consist of several scripts, for example, or
Browse, whose function is to view and extract streams or times is used to extract time.
So timestamp and this is useful in order to gain some metadata information about when the malicious
document was created.
We also have or idea, too, which is useful for looking for malicious characteristics.
And this might be the first to use when you are doing triaging.
Similar to what we did when we were studying, analyzing PDA documents, we used PDA ID for triaging.
And then we also have the oil Yuva tool, which is used for extracting VBA scripts.
And VBA could also be used for the new Microsoft Office format, which is the archive.
Is it style format.
And these are some this is a link for further information.
If you wish to look into more details about these tools and these tools also come ranks.
Next, we will look at a new Microsoft Office format, which is the Open Office XML format, as we have
seen at the early stages of this course, this is an open XML format with the file, with the extension
DCX.
And inside it, you have an archive consisting of several files, the XML files and the location in
various directories and also directory directory, which contains the web, a project being far.
If the VBA project beautifies this, it means that this document contains VBA scripts, also known as
macro's.
However, normally we behave, we take being will not be allowed to execute you extension, you don't
see X.
However, as I mentioned earlier, now the others may have ways to overcome this limitation.
And it is important to remember that this format is a binary format.
So we can't open it directly with her editor to look at it.
Any other format is deoxy and when you see em, you can be certain that there is a VBA project being
filed within it.
And therefore he has got the VBA macro's the tools that I use for analyzing Microsoft Office documents,
metadata to use and example EXIF to which we also have used before when we were doing our PDF files
analysis, then we can also use for signature retention Zik done plus YAARA and for studying and extracting
VBA scripts from the office file you can use already VBA.
The overflowing analyzing office documents, when you are faced with an office document, the first
step is to determine whether it is the old format, which is the essay format, or is it a new open
office format.
So we need to determine the document time and we can use for identification tools for that.
Second, we will search for malicious indicators using tools in order to look for keywords, files,
structures, file names and so on and enter.
If you were to find any hidden or embedded files, we will extract those files and continue analysis.
So that is all for the principals analyzing these documents.
Thank you for watching.
I'll see you in the next video.