{
    "id": "515d5675-2499-43fd-a94a-18b2e9402bae",
    "name": "Analyzing Microsoft Office Documents",
    "slug": "analyzing-microsoft-office-documents",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "225b7429-bd2e-433e-9168-318d861e97cf"
        ],
        "pta_sdn": "62",
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-03-30T02:53:09.689187Z",
    "modified": "2024-04-30T14:41:35.198335Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": null,
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Scenario\n\nPeter, your friend, is an assistant professor who teaches at a local university in your town.\nOne day he came to you with a big problem; it seems that someone has been stealing the exams questions from his laptop.\n\nEven though he isn't a computer professional, he knows the basic security practices. He never lets strangers use his laptop, always locks his machine when he leaves his desk, and he never downloads applications and .exe files from untrusted sources.\n\nPeter, however, doesn't know that .exe files aren't the only source of threat. He usually accepts students' homework via e-mail.\n\nNaturally, he downloads the homework files on his machine so he can evaluate them. After you told Peter that malicious content could hide in a Microsoft Office file, he remembered that the incidents started after he downloaded an excel homework file on his machine from two of his students.\n\nPeter gave you the file and asked you to prove that the file is malicious so that he can take the appropriate procedures against the suspected students.\n\n# Goals\n\n-   Familiarity with profiling a malicious Office document.\n\n# What you will learn\n\n-   Examine an Office file metadata\n-   Looking for scripts and malicious signature within an office document\n-   Extracting and analyzing malicious objects from an office file\n\n# Recommended tools\n\n-   **Exiftool**\n-   **Officemalscanner**\n-   **DisView**\n-   **Malhost-Setup**",
    "description_html": "<h1>Scenario</h1>\n<p>Peter, your friend, is an assistant professor who teaches at a local university in your town.\nOne day he came to you with a big problem; it seems that someone has been stealing the exams questions from his laptop.</p>\n<p>Even though he isn't a computer professional, he knows the basic security practices. He never lets strangers use his laptop, always locks his machine when he leaves his desk, and he never downloads applications and .exe files from untrusted sources.</p>\n<p>Peter, however, doesn't know that .exe files aren't the only source of threat. He usually accepts students' homework via e-mail.</p>\n<p>Naturally, he downloads the homework files on his machine so he can evaluate them. After you told Peter that malicious content could hide in a Microsoft Office file, he remembered that the incidents started after he downloaded an excel homework file on his machine from two of his students.</p>\n<p>Peter gave you the file and asked you to prove that the file is malicious so that he can take the appropriate procedures against the suspected students.</p>\n<h1>Goals</h1>\n<ul>\n<li>Familiarity with profiling a malicious Office document.</li>\n</ul>\n<h1>What you will learn</h1>\n<ul>\n<li>Examine an Office file metadata</li>\n<li>Looking for scripts and malicious signature within an office document</li>\n<li>Extracting and analyzing malicious objects from an office file</li>\n</ul>\n<h1>Recommended tools</h1>\n<ul>\n<li><strong>Exiftool</strong></li>\n<li><strong>Officemalscanner</strong></li>\n<li><strong>DisView</strong></li>\n<li><strong>Malhost-Setup</strong></li>\n</ul>",
    "tasks": "# Tasks\n\n## Task1: Extracting metadata \n\nYou can find the under investigation Office document at **C:\\\\DFP\\\\Labs\\\\Module3\\\\Lab6\\\\test.xls**. \nUse **Exiftool** to examine the excel file metadata and extract the author.\n\n## Task 2: Scanning for Malicious content \n\nUse **Officemalscanner** to scan the excel file for macro scripts, known exploits, encrypted content and PE headers. \n\nWrite down the index where the Malicious object was found. \n\n## Task 3: Examining the malicious embedded code\n\nUse **Disview** to display the malicious object's assembly code. Then, extract it using MalHost-Setup to an exe file. Scan the file with Antivirus to check the malware type.",
    "tasks_html": "<h1>Tasks</h1>\n<h2>Task1: Extracting metadata</h2>\n<p>You can find the under investigation Office document at <strong>C:\\DFP\\Labs\\Module3\\Lab6\\test.xls</strong>. \nUse <strong>Exiftool</strong> to examine the excel file metadata and extract the author.</p>\n<h2>Task 2: Scanning for Malicious content</h2>\n<p>Use <strong>Officemalscanner</strong> to scan the excel file for macro scripts, known exploits, encrypted content and PE headers. </p>\n<p>Write down the index where the Malicious object was found. </p>\n<h2>Task 3: Examining the malicious embedded code</h2>\n<p>Use <strong>Disview</strong> to display the malicious object's assembly code. Then, extract it using MalHost-Setup to an exe file. Scan the file with Antivirus to check the malware type.</p>",
    "published_date": "2020-10-20T15:32:26Z",
    "solutions": "# SOLUTIONS\n\n## Task 1: Extracting metadata\n\nYou can find the under investigation files at **C:\\\\DFP\\\\Labs\\\\Module3\\\\Lab6\\\\test.xls**.\n\nFor a general overview of the file, we can use the **exiftool.exe** at [C:\\DFP\\Tools\\Metadata]. After running the command and passing the file name as a parameter.\n\n```\n# cd C:\\DFP\\Tools\\Metadata\n# \"exiftool(-k).exe\" C:\\DFP\\Labs\\Module3\\Lab6\\test.xls\n```\n\n![0](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/0.png)\n\n## Task 2: Scanning for Malicious content\n\nThe **Officemalscanner.exe** located at [C:\\DFP\\Tools\\Metadata\\Docs\\] is a tool commonly used to perform an in-depth scan on Microsoft office documents. The tool can scan the file for VB scripts and known exploit signatures.\n\nIt can also scan the document looking for PE headers even if they are encoded. We'll use the **Info** option to scan for VB-Macro Scripts.\n\n```\n# cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# OfficeMalScanner.exe C:\\DFP\\Labs\\Module03\\Lab6\\test.xls info\n```\n\n![1](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/1.png)\n\nIt is important to remember that many of the tools we mentioned actually open the file in order to extract the requested data from it. This means that precautions should be taken before starting the analysis.\n\nThe document doesn't seem to contain VB-Macro scripts.\n\nWe'll use the **scan** option to look for known malicious signatures and PE header.\n\n```\n# OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan\n```\n\n![2](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/2.png)\n\nWe can see that the tool found something malicious within. One of the tool's features is that it assigns a malicious index to each file. This index indicates what the possible content is. Anything above 10 is considered dangerous. If the number is between 10 and 20, it means a code signature has been found inside. If it is above 20, then it means a whole executable is probably embedded within.\n\nBased on that and the previous output, it seems that the tool has found a code within the document.\n\nEven though we found what we're looking for, it is worth checking if there is any encrypted content.\nBy using the **brute** flag, we can ask the scanner to try different decoders and see if any of them works.\n\n```\n# OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan brute\n```\n\n![3](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/3.png)\n\nIn order to tell what the hidden payload is, we need to extract it first. The report mentioned that the suspicious code was found at the index **0x23C**. To extract the complete code, we can add the **debug** option instead of going and extracting it manually.\n\n```\n# OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan debug\n```\n\n![4](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/4.png)\n\n## Task 3: Examining the malicious embedded code\n\nWe can use the **DisView.exe** tool which comes alongside officemalscanner.exe. All we have to do is to provide the file name and the offset where the suspicious code was found.\n\n```\n# cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# DisView.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls 0x23c\n```\n\n![5](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/5.png)\n\nThe easiest way to analyze the file without tracing the assembly code is to turn it into an exe file. Scanning an exe file may sometimes be easier than tracing assembly code.\n\nWe can use the **Malhost-Setup.exe** tool to perform this task. The tool also comes in the same package with officemalscanner.exe. To run the tool, we need to invoke it, pass the output exe file and the offset of the shell code as parameters.\n\n```\n# cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# MalHost-Setup.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls malcode.exe 0x23c\n```\n\n![6](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/6.png)\n\nThe tool will generate the exe file in its local directory.\n\n![7](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/7.png)\n\nNow that we have extracted the suspicious code, we can either analyze it with ClamWin AV.\n\n![8](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/8.png)\n\n![9](https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/9.png)\n\nThe AV detects the malware as a Trojan.",
    "solutions_html": "<h1>SOLUTIONS</h1>\n<h2>Task 1: Extracting metadata</h2>\n<p>You can find the under investigation files at <strong>C:\\DFP\\Labs\\Module3\\Lab6\\test.xls</strong>.</p>\n<p>For a general overview of the file, we can use the <strong>exiftool.exe</strong> at [C:\\DFP\\Tools\\Metadata]. After running the command and passing the file name as a parameter.</p>\n<pre class=\"codehilite\"><code># cd C:\\DFP\\Tools\\Metadata\n# \"exiftool(-k).exe\" C:\\DFP\\Labs\\Module3\\Lab6\\test.xls</code></pre>\n\n<p><img alt=\"0\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/0.png\" /></p>\n<h2>Task 2: Scanning for Malicious content</h2>\n<p>The <strong>Officemalscanner.exe</strong> located at [C:\\DFP\\Tools\\Metadata\\Docs] is a tool commonly used to perform an in-depth scan on Microsoft office documents. The tool can scan the file for VB scripts and known exploit signatures.</p>\n<p>It can also scan the document looking for PE headers even if they are encoded. We'll use the <strong>Info</strong> option to scan for VB-Macro Scripts.</p>\n<pre class=\"codehilite\"><code># cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# OfficeMalScanner.exe C:\\DFP\\Labs\\Module03\\Lab6\\test.xls info</code></pre>\n\n<p><img alt=\"1\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/1.png\" /></p>\n<p>It is important to remember that many of the tools we mentioned actually open the file in order to extract the requested data from it. This means that precautions should be taken before starting the analysis.</p>\n<p>The document doesn't seem to contain VB-Macro scripts.</p>\n<p>We'll use the <strong>scan</strong> option to look for known malicious signatures and PE header.</p>\n<pre class=\"codehilite\"><code># OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan</code></pre>\n\n<p><img alt=\"2\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/2.png\" /></p>\n<p>We can see that the tool found something malicious within. One of the tool's features is that it assigns a malicious index to each file. This index indicates what the possible content is. Anything above 10 is considered dangerous. If the number is between 10 and 20, it means a code signature has been found inside. If it is above 20, then it means a whole executable is probably embedded within.</p>\n<p>Based on that and the previous output, it seems that the tool has found a code within the document.</p>\n<p>Even though we found what we're looking for, it is worth checking if there is any encrypted content.\nBy using the <strong>brute</strong> flag, we can ask the scanner to try different decoders and see if any of them works.</p>\n<pre class=\"codehilite\"><code># OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan brute</code></pre>\n\n<p><img alt=\"3\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/3.png\" /></p>\n<p>In order to tell what the hidden payload is, we need to extract it first. The report mentioned that the suspicious code was found at the index <strong>0x23C</strong>. To extract the complete code, we can add the <strong>debug</strong> option instead of going and extracting it manually.</p>\n<pre class=\"codehilite\"><code># OfficeMalScanner.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls scan debug</code></pre>\n\n<p><img alt=\"4\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/4.png\" /></p>\n<h2>Task 3: Examining the malicious embedded code</h2>\n<p>We can use the <strong>DisView.exe</strong> tool which comes alongside officemalscanner.exe. All we have to do is to provide the file name and the offset where the suspicious code was found.</p>\n<pre class=\"codehilite\"><code># cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# DisView.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls 0x23c</code></pre>\n\n<p><img alt=\"5\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/5.png\" /></p>\n<p>The easiest way to analyze the file without tracing the assembly code is to turn it into an exe file. Scanning an exe file may sometimes be easier than tracing assembly code.</p>\n<p>We can use the <strong>Malhost-Setup.exe</strong> tool to perform this task. The tool also comes in the same package with officemalscanner.exe. To run the tool, we need to invoke it, pass the output exe file and the offset of the shell code as parameters.</p>\n<pre class=\"codehilite\"><code># cd C:\\DFP\\Tools\\Metadata\\Docs\\\n# MalHost-Setup.exe C:\\DFP\\Labs\\Module3\\Lab6\\test.xls malcode.exe 0x23c</code></pre>\n\n<p><img alt=\"6\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/6.png\" /></p>\n<p>The tool will generate the exe file in its local directory.</p>\n<p><img alt=\"7\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/7.png\" /></p>\n<p>Now that we have extracted the suspicious code, we can either analyze it with ClamWin AV.</p>\n<p><img alt=\"8\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/8.png\" /></p>\n<p><img alt=\"9\" src=\"https://assets-ine-com.s3.amazonaws.com/content/ptp/lab_6_analyzing_microsoft_office_documents/9.png\" /></p>\n<p>The AV detects the malware as a Trojan.</p>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}