Hello and welcome back.
In the previous video, we did the static analysis on the PDF document in this video, we are going
to continue with her office document, which gave her the and in the previous lesson.
So let's change directory see these days to go back to the parent directory and then see the office
will go into the new folder and then release the contents by typing unless we can see the document.
Let's clear the screen.
This document called the conduct of the U.S. So we are going to use the metadata analysis by using excessive
tool followed by the name of the document and enter.
Here we see the result that you can use to scroll, to screw up and down, to look at the result.
So we analyzed the output, we will see that this document was created through twenty seventeen, December
13 looking known for there you can see that it is Russian or Russian origin language called.
And then further down.
We can see there is no author suggested and then a template here indicates he is a dot and template.
So whenever you see a dot and then blue, it means that there is a macro inside it, meaning that this
coffee document can embedded scripts inside it and can execute.
Screening down for the you see that day some, I believe, Cirilli Russian tanks, I'm not sure.
And over here to hating bears as well as they could be safe in those Cyrillic.
If you look further down here and the question of the worst is seven to three, meaning that he needs
the Oval Office document format, which is not a format.
So in that case, you are going to do a you are asking.
We do not need to use it.
No.
So next thing we do, we are going to do is to use YARE to scan.
So let's clear the screen first.
And the entire Yaara give it the best of you to suppress warnings.
Put in the home.
Dale Dale character, followed by the malware Far Beyond our rules directory and the name of your index
file.
And lastly, followed by the target document, we are going to scan.
So hit enter.
So looking at the result of the are asking me here that it contains VBA Macro.
So and you can also open to open and execute the macro when the document is open.
This is not surprising because this macro thing is used very often in nourishes Microsoft documents.
So this is how we do static analysis for PDF as well as Microsoft Office documents.
So that's all for this video.
Thank you for watching.