Open the Avira file and below content can be seenĪs soon as the document is opened ad user enabled macros, Auto_Open() will be executed. It dumps the parsed contents of sample.doc in. Supply the info parameter asĪnd OfficeMalScanner creates a directory and dump its findings into that directory. OfficeMalScanner extracts the VBA code embedded in the macro. In the below section we will see how we can use the OfficeMalScanner to analyze such malicious documents. This is a great utility as it removes the dependency on Microsoft Office on the system. To analyze such malicious documents, a very popular toolkit known as OfficeMalScanner is available. Malware Author’s will ide the contents of a document until the user clicks on “Enable Content.” As soon as the user clicks on “Enable Content,” he might see some known information in the document but if the document is malicious then at the malicious backend code will start running. One can also get the sense from this that this type of attacks needs the user’s involvement to get infected. The user must explicitly enable the macros. It must be noted that although all modern versions of Microsoft office support VBA macro, they are disabled by default. These Microsoft applications are exploited by malicious authors either by embedding shellcode in the document which is executed by exploiting a vulnerability or by macro code embedded as a macro in the document which in turn is executed when the user clicks ‘ok.’ Since these applications are often used by enterprise users and end users, malicious authors target these documents to infect more users and extract valuable information from them. Microsoft office applications such as Word, Excel and PowerPoint all have a history of being exploited by malicious authors from time to time.

Malicious pdf sample