Introduction

The MalDoc101 Lab focuses on the analysis of a malicious Microsoft Office document designed to exploit VBA macros and obfuscation techniques to deliver a potentially harmful payload. This lab provides an opportunity to dive into static analysis, a critical skill for blue team analysts, enabling the extraction of meaningful indicators of compromise (IOCs) without executing the malicious file. The challenge highlights the importance of understanding document structures, macro behaviors, encoding methods, and the tools required to analyze such artifacts effectively.

Throughout this lab, you will explore how threat actors use living-off-the-land (LOTL) techniques to execute malicious code, often transitioning from macro-based automation to more advanced attack vectors. The document's streams and macros reveal how attackers employ obfuscation tactics, such as base64 encoding with embedded noise, to conceal malicious payloads. Furthermore, user-forms and auto-execution triggers highlight the sophistication and creativity of attackers in crafting their delivery mechanisms.

This walkthrough leverages powerful tools such as oledump for stream analysis, olevba for macro inspection, and online threat intelligence platforms like VirusTotal to contextualize the findings.

Analysis

Q1 Multiple streams contain macros in this document. Provide the number of highest one.

To begin analyzing the malicious document, we focus on using static analysis tools to inspect its structure and contents. The file provided is a Microsoft Office document stored in the Compound File Binary (CFB) format, a widely used structure for Office files.

This format organizes data into streams and storages, making it possible to embed elements such as VBA macros, which are often exploited by attackers to deliver malicious payloads.

The analysis starts by using the file command to identify the type and structure of the provided file.

The command reveals tha…