Malicious document analysis is the examination of files such as Office documents and PDFs that attackers use to get code running on a victim’s system. MITRE ATT&CK describes this as Spearphishing Attachment (T1566.001) and User Execution: Malicious File (T1204.002). This e-book, Malicious Document Analysis for SOC Analysts, explains how SOC analysts approach these documents.
What You Will Find In This Book?
Find the answers to “What is” and “How to”
This e-book helps you to understand the malicious document analysis from the beginning. You can give an answer to the, “How do SOC analysts analysis these documents?”, and all other questions.
Look all sides of the topic & enhance your capabilities
“Malicious Document Analysis for SOC Analysts” does not just include the 101 topics. This e-book looks around all sides of the topic and gives you all the knowledge about it.
Gain practical insights from Experts
Brandefense Research Team’s knowledge gives you real-world examples, practical insights, and best practices.Malicious document analysis further empowers SOC analysts to attribute the attack and proactively implement stringent measures.
What does the Malicious Document Analysis for SOC Analysts report cover?
The report has two parts. Part I covers Office documents. Part II covers PDF files. Each part walks through the file structure, the tools, a safe lab, static analysis, dynamic analysis and encrypted or obfuscated content. The report is 53 pages long.
Office documents
The report names three common attack vectors: executing macro code, exploiting an Office document vulnerability and embedded malware. It says a document that asks you to enable content is suspicious, because enabling content makes the macro code active.
The worked example is a Lokibot downloader, an Excel file with the .xls extension. The steps use oleid, mraptor, oledump.py, olevba, oleobj and olemeta. The macro has a Decrypt function. Running it step by step in the debugger shows the file name and domain the macro uses. For behavior, the report uses procexp, procmon, Regshot and FakeNet.
Lab setup and obfuscation
- The report says to cut the network connection of the analysis virtual machine, for example with a host-only or internal network mode.
- It says an entropy of 7 or higher out of 8 is considered encrypted or obfuscated, but not every such file reaches 7.
- It says APT40 is known for base64, gzip compression, garbage characters and steganography, and shows APT32 obfuscation too. Both point to MITRE ATT&CK group pages.
PDF files
The report explains the four parts of a PDF: header, body, cross-reference table and trailer. It lists keywords to look for, such as /JS, /JavaScript, /OpenAction, /Launch and /EmbeddedFile. It names pdfid, pdf-parser and peepdf as tools, and Remnux as a lab.
In the sample, badpdf.pdf, the trail leads to object 13, which holds obfuscated JavaScript. The report decodes it to find a malicious URL. It also notes CVE-2007-5659, an Adobe Collab.collectEmailInfo() buffer overflow, and says Adobe has since fixed it.
Indicators and what comes next
The report lists common indicators of compromise for Office files and PDFs, such as file hashes, URLs, strings, process names, registry keys and extracted shellcode. It says analysts can add them to SIEMs and other detection software. The last chapter looks at future malware trends, machine learning and AI, and ongoing training for analysts.