Document and script triage: macros, PDFs, PowerShell
You examine suspicious Office files with oletools and PDFs with pdfid and pdf-parser without opening them, and decode obfuscated JavaScript, VBScript and PowerShell in a safe lab to extract indicators.
Level 301 · 17 lessons · 15 practice labs
Lessons
Working safely
- Examining documents without opening them: isolation, read-only and password-protected archives
- OLE and OOXML: inside Office files
- Short task: tell which of five attachments contain macros
Office documents
- Extracting VBA macros and suspicious keywords with olevba
- Examining streams with oledump
- Excel 4.0 macros and remote template injection traces
- RTF and embedded OLE objects: rtfobj
- Short task: find the URL a macro downloads from and the file it drops
PDFs and archives
- Counting risky elements in a PDF with pdfid
- Opening objects and streams with pdf-parser
- Attachments delivered through LNK, ISO and HTML smuggling
- Short task: extract the embedded JavaScript from a PDF
Deobfuscating scripts
- Principles of deobfuscation: understanding without running
- PowerShell hidden with Base64, compression and string joins
- Unpicking JavaScript and VBScript loaders step by step
- Repeatable decoding with CyberChef recipes
- Capstone: unravel a phishing attachment’s full chain and report the indicators
Practice labs
- Which attachments contain macros: Examine five inert attachments without opening them and identify those containing macros.
- Open up an OOXML document: Open an Office file as an archive, inspect the relationship files and find the external link.
- Set up a safe examination routine: Write a workflow script that stores attachments in a password-protected archive, examines read-only and hashes them.
- Extract the macro with olevba: Extract a document's VBA code and list the suspicious keywords flagged.
- Find the address the macro downloads from: Read the macro code without running it and find the download address and dropped file path.
- Inspect the streams with oledump: List the streams, open the one carrying the macro and rejoin the address hidden by string splitting.
- Find the remote template trace: Find the remote template address in the document's settings relationships.
- Read Excel 4.0 macros: Reveal the old-style macro cells on a hidden sheet and order the formulas.
- Extract the embedded object in an RTF: Extract the embedded OLE object with rtfobj, identify its type and hash it.
- Count the risky elements with pdfid: Count the JavaScript, auto-action and embedded file elements in three PDFs.
- Extract the embedded JavaScript from a PDF: Find the relevant object with pdf-parser, decompress the stream and write the script to a file.
- Examine an attachment delivered as LNK and ISO: Decode the target command of the shortcut inside an ISO without running it and identify the next step of the chain.
- Decode a command hidden with Base64: Decode an encoded PowerShell string and write it in readable form.
- Repeatable decoding with a CyberChef recipe: Build a recipe that unwraps compression and Base64 layers and show it works on two samples.
- Decode the full chain of a phishing attachment: Decode the document, macro and script layers of an inert attachment without running them and report the indicators.
About this course
You examine suspicious Office files with oletools and PDFs with pdfid and pdf-parser without opening them, and decode obfuscated JavaScript, VBScript and PowerShell in a safe lab to extract indicators.
What you will learn
- Working safely
- Office documents
- PDFs and archives
- Deobfuscating scripts
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.