Office Malware Forensics Lab — REMnux Static Analysis

Static analysis of two malicious Office files, done entirely inside an isolated REMnux VM. Nothing was ever executed — just inspected.

Setup

REMnux VM, no shared folders with the host
Tools: sha256sum, file, unzip, and the oletools suite (oleid, olevba, oledump, mraptor)
Both samples pulled from MalwareBazaar (abuse.ch)

Sample 1: Malicious Word doc (.docx)

SHA-256: 68e82279bff55cf3b9f1f22ec4a165b1b1245a359f7e8d86664b2541d8f8d3fe

What I found:

A file inside the docx (nste.xml) was actually Rich Text Format data pretending to be XML — a mismatch that's a red flag on its own
One embedded object was a 196 KB VBS executable (419876.vbs)
Another embedded object matched CVE-2017-11882 — a known Equation Editor exploit that runs just from opening the file, no macros needed

Verdict: Malicious. This is a real weaponized document using a known RCE to drop an executable.

Sample 2: Malicious Excel file (.xlsx)

SHA-256: dc65419ba5d83b980d7018198a14209fa2f5ebf6f99d47bfe9f586852087befe

What I found:

The file was encrypted (password-protected), which normally hides macro content from AV scanners
It had 4 VBA modules, but all 4 came back empty — mraptor returned "Macro OK" with no AutoExec/Write/Execute flags
One worksheet was hidden
There were hex-encoded strings sitting in an old-style XLM macro stream, separate from the VBA layer
Decoding those strings didn't turn up shellcode or a download URL — just some type-library identifiers

Verdict: Suspicious, but inconclusive. The encryption, hidden sheet, and obfuscated strings all look like evasion tactics, but I couldn't confirm an actual live payload in the VBA layer. The real payload may live in the legacy XLM macro layer (which I didn't fully reverse), or this could be an incomplete/staging sample.

Steps I followed

Hash each file (SHA-256) for chain of custody
Check the real file type with file, compare to the extension
Run oleid for a quick read on encryption/macros/external links
Run oledump to list every embedded object
Run olevba to pull and decode any VBA source
Run mraptor to check for auto-running macro behavior

What this shows

How to spot a file type mismatch used to dodge detection
How CVE-2017-11882 works without needing macros at all
How to actually verify macro behavior instead of assuming it from surface-level indicators
Why encryption + hidden sheets + obfuscated strings don't automatically mean "confirmed malicious" — sometimes the evidence is inconclusive, and that's worth saying plainly

Sources

CVE-2017-11882: Microsoft Equation Editor RCE
oletools: https://github.com/decalage2/oletools
MalwareBazaar: https://bazaar.abuse.ch
REMnux docs: https://docs.remnux.org

Author

Mofolorunsho Adeleke GitHub: https://github.com/Mo200909

Office-Malware-Forensics-Lab-REMnux-Static-Analysis

Más Populares