Office-Malware-Forensics-Lab-REMnux-Static-Analysis — Static analysis of 2 malicious Office documents on REMnux using oletools; identified CVE-2017-11882 and obfuscated macros. | Kitploit
Tools / GitHub / mo200909 / office-malware-forensics-lab-remnux-static-analysis
mo200909/office-malware-forensics-lab-remnux-static-analysis
Office-Malware-Forensics-Lab-REMnux-Static-Analysis Static analysis of 2 malicious Office documents on REMnux using oletools; identified CVE-2017-11882 and obfuscated macros.
Discover the most used tools by our community.
Last 7 Days Last 30 Days
Office Malware Forensics Lab — REMnux Static Analysis
Overview
Static forensic analysis of two malicious Microsoft Office documents
using REMnux and the oletools suite. No files were executed — all
analysis performed statically within an isolated REMnux VM.
Environment
OS: REMnux (isolated VM, no shared folders to host machine)
Tools: sha256sum, file, unzip, oletools (oleid, olevba, oledump, mraptor)
Sample source: MalwareBazaar (bazaar.abuse.ch) — curated malware
repository maintained by abuse.ch for security research
Analysis type: Static only — no samples executed at any point
Samples Analyzed
Sample 1 — Malicious Word Document (.docx)
SHA-256: 68e82279bff55cf3b9f1f22ec4a165b1b1245a359f7e8d86664b2541d8f8d3fe
File type: ZIP archive (Office Open XML container)
Key Findings:
nste.xml identified as Rich Text Format data embedded inside XML
container — anomalous file type mismatch indicating evasion attempt
OLE Object 0: Embedded VBS executable (419876.vbs, 196KB)
labeled EXECUTABLE FILE — MD5: a1142366224a45e8b241403a6868187b
OLE Object 1: Equation.3 exploit — CVE-2017-11882
(Microsoft Equation Editor Remote Code Execution)
CLSID: 20E02C00-0000-0000-0C00-000000000004 Verdict: Malicious — weaponized Office document exploiting
CVE-2017-11882 to drop VBS payload without requiring macros
Sample 2 — Malicious Excel File (.xlsx) SHA-256: dc65419ba5d83b980d7018198a14209fa2f5ebf6f99d47bfe9f586852087befe
File type: Composite Document File V2 (legacy OLE format despite
.xlsx extension) — Microsoft Excel 97-2003
Created: Sep 16 2006 | Last saved: Jun 15 2026
File encrypted (FILEPASS record) — conceals macro contents
from signature-based scanners
VBA macros present across 4 streams (Sheet1–3, ThisWorkbook)
mraptor flags: A=AutoExec, W=Write, X=Execute — macro executes
automatically on open, writes and executes code
One hidden sheet detected
Hex-encoded strings present — obfuscation to evade detection
VBA macro source empty post-decryption — consistent with
payload delivery via XLM macro layer
Verdict: Malicious — encrypted Excel file with auto-executing
macro, write/execute capability, hidden sheet, and obfuscated payload
Methodology
SHA-256 hash generated for chain-of-custody verification
file command used to identify true file type vs. declared extensionoleid used for high-level indicator triage (encryption, macros,
external relationships)oledump used to enumerate OLE streams and embedded objectsolevba used to extract and deobfuscate VBA macro source codemraptor used to detect AutoExec, Write, Execute macro behavior
Key Concepts Demonstrated
Office document forensics methodology
OLE container structure analysis
CVE identification from static indicators (CVE-2017-11882)
VBA macro triage and behavioral flag detection
File type mismatch as malware evasion technique
Encryption and hex-string obfuscation as AV evasion techniques
Chain-of-custody via cryptographic hashing
Sample Source Both samples sourced from MalwareBazaar (bazaar.abuse.ch), a
curated threat intelligence platform operated by abuse.ch for
security research purposes.
References 
mo200909/office-malware-forensics-lab-remnux-static-analysis
