Office Malware Forensics Lab — REMnux Static Analysis

Overview

Static forensic analysis of two malicious Microsoft Office documents using REMnux and the oletools suite. No files were executed — all analysis performed statically within an isolated REMnux VM.

Environment

• OS: REMnux (isolated VM, no shared folders to host machine)
• Tools: sha256sum, file, unzip, oletools (oleid, olevba, oledump, mraptor)
• Sample source: MalwareBazaar (bazaar.abuse.ch) — curated malware repository maintained by abuse.ch for security research
• Analysis type: Static only — no samples executed at any point

Samples Analyzed

Sample 1 — Malicious Word Document (.docx)

SHA-256: 68e82279bff55cf3b9f1f22ec4a165b1b1245a359f7e8d86664b2541d8f8d3fe File type: ZIP archive (Office Open XML container)

Key Findings:

• nste.xml identified as Rich Text Format data embedded inside XML container — anomalous file type mismatch indicating evasion attempt
• OLE Object 0: Embedded VBS executable (419876.vbs, 196KB) labeled EXECUTABLE FILE — MD5: a1142366224a45e8b241403a6868187b
• OLE Object 1: Equation.3 exploit — CVE-2017-11882 (Microsoft Equation Editor Remote Code Execution) CLSID: 20E02C00-0000-0000-0C00-000000000004

Verdict: Malicious — weaponized Office document exploiting CVE-2017-11882 to drop VBS payload without requiring macros

---

Sample 2 — Malicious Excel File (.xlsx)

SHA-256: dc65419ba5d83b980d7018198a14209fa2f5ebf6f99d47bfe9f586852087befe File type: Composite Document File V2 (legacy OLE format despite .xlsx extension) — Microsoft Excel 97-2003 Created: Sep 16 2006 | Last saved: Jun 15 2026

Key Findings:

• File encrypted (FILEPASS record) — conceals macro contents from signature-based scanners
• VBA macros present across 4 streams (Sheet1–3, ThisWorkbook)
• mraptor flags: A=AutoExec, W=Write, X=Execute — macro executes automatically on open, writes and executes code
• One hidden sheet detected
• Hex-encoded strings present — obfuscation to evade detection
• VBA macro source empty post-decryption — consistent with payload delivery via XLM macro layer

Verdict: Malicious — encrypted Excel file with auto-executing macro, write/execute capability, hidden sheet, and obfuscated payload

---

Methodology

1. SHA-256 hash generated for chain-of-custody verification
2. file command used to identify true file type vs. declared extension
3. oleid used for high-level indicator triage (encryption, macros, external relationships)
4. oledump used to enumerate OLE streams and embedded objects
5. olevba used to extract and deobfuscate VBA macro source code
6. mraptor used to detect AutoExec, Write, Execute macro behavior

Key Concepts Demonstrated

• Office document forensics methodology
• OLE container structure analysis
• CVE identification from static indicators (CVE-2017-11882)
• VBA macro triage and behavioral flag detection
• File type mismatch as malware evasion technique
• Encryption and hex-string obfuscation as AV evasion techniques
• Chain-of-custody via cryptographic hashing

Sample Source

Both samples sourced from MalwareBazaar (bazaar.abuse.ch), a curated threat intelligence platform operated by abuse.ch for security research purposes.

References

• CVE-2017-11882: Microsoft Equation Editor RCE
• oletools by Philippe Lagadec: https://github.com/decalage2/oletools
• MalwareBazaar: https://bazaar.abuse.ch
• REMnux documentation: https://docs.remnux.org