Office Malware Forensics Lab — REMnux Static Analysis

Static analysis of two malicious Office files, done entirely inside an isolated REMnux VM. Nothing was ever executed — just inspected.

Setup

• REMnux VM, no shared folders with the host
• Tools: sha256sum, file, unzip, and the oletools suite (oleid, olevba, oledump, mraptor)
• Both samples pulled from MalwareBazaar (abuse.ch)

Sample 1: Malicious Word doc (.docx)

SHA-256: 68e82279bff55cf3b9f1f22ec4a165b1b1245a359f7e8d86664b2541d8f8d3fe

What I found:

• A file inside the docx (nste.xml) was actually Rich Text Format data pretending to be XML — a mismatch that's a red flag on its own
• One embedded object was a 196 KB VBS executable (419876.vbs)
• Another embedded object matched CVE-2017-11882 — a known Equation Editor exploit that runs just from opening the file, no macros needed

Verdict: Malicious. This is a real weaponized document using a known RCE to drop an executable.

Sample 2: Malicious Excel file (.xlsx)

SHA-256: dc65419ba5d83b980d7018198a14209fa2f5ebf6f99d47bfe9f586852087befe

What I found:

• The file was encrypted (password-protected), which normally hides macro content from AV scanners
• It had 4 VBA modules, but all 4 came back empty — mraptor returned "Macro OK" with no AutoExec/Write/Execute flags
• One worksheet was hidden
• There were hex-encoded strings sitting in an old-style XLM macro stream, separate from the VBA layer
• Decoding those strings didn't turn up shellcode or a download URL — just some type-library identifiers

Verdict: Suspicious, but inconclusive. The encryption, hidden sheet, and obfuscated strings all look like evasion tactics, but I couldn't confirm an actual live payload in the VBA layer. The real payload may live in the legacy XLM macro layer (which I didn't fully reverse), or this could be an incomplete/staging sample.

Steps I followed

1. Hash each file (SHA-256) for chain of custody
2. Check the real file type with file, compare to the extension
3. Run oleid for a quick read on encryption/macros/external links
4. Run oledump to list every embedded object
5. Run olevba to pull and decode any VBA source
6. Run mraptor to check for auto-running macro behavior

What this shows

• How to spot a file type mismatch used to dodge detection
• How CVE-2017-11882 works without needing macros at all
• How to actually verify macro behavior instead of assuming it from surface-level indicators
• Why encryption + hidden sheets + obfuscated strings don't automatically mean "confirmed malicious" — sometimes the evidence is inconclusive, and that's worth saying plainly

Sources

• CVE-2017-11882: Microsoft Equation Editor RCE
• oletools: https://github.com/decalage2/oletools
• MalwareBazaar: https://bazaar.abuse.ch
• REMnux docs: https://docs.remnux.org

Author

Mofolorunsho Adeleke GitHub: https://github.com/Mo200909