Abstract

This class aims to introduce students to techniques and relevant information for analyzing malicious documents, which are usually found as attack vectors by real world malware threats with potential to compromise an entire company.

Through this course we will teach how to analyze different types of malicious documents to finding their main IOCs like URLs used for downloading the next stage of the chain infection. Due to particular characteristics of this topic, this class adopts a complete practical approach, and we will analyze and solve different samples in real time.

Class attendees will learn how to interpret and analyze different types and formats of maldocs such as:

  • PDF
  • doc/docx
  • xls/xlsx
  • ppt/pptx
  • rtf
  • msi
  • chm
  • eml
  • onenote
  • jpeg, jpg, png and svg
  • and other formats.

During this class attendees will learn practical strategies about how to handle a variety of challenges from malicious documents such as encoding, encryption, overlays, different languages and mainly shellcoding. Furthermore, a range of approaches such as static analysis, dynamic analysis and even indirect emulation make part of available resources deployed to understand complex malicious documents.

Over the time, malicious document have become harder to analyze than most professionals could imagine.

Who Should Attend

This class is planned and organized for any professional who aim to follow a career as incident responder, threat hunter and malware analyst, and is looking for learning comprehensive and practical techniques to use them in practical security investigation. Attendees with an specific objective of triaging unknown files will benefit from this course.

Key Learning Objectives

This class has the following goals:

  • Learn how to manage multiple tricks used by adversaries to conceal malicious code within PDF files.
  • Understand how to handle malicious documents during an analysis.
  • Learn different static and dynamic techniques used for revealing IOCs.
  • Use pratical approaches to decode Javascript, Powershell, VBA encoding.
  • Extract embedded payloads from malicious documents and unpack multiple layers until find the real malware.
  • Leverage emulation techniques to decode shellcodes.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Attendees should be prepared to work on Linux and Windows environments.
  • Students should be ready to use multiple operating system commands such as grep, awk, sed and similar.
  • Students should be comfortable in reading and interpreting pieces of code in PowerShell, JavaScript and VBA.
  • Basic knowledge in shellcode might be useful.
  • Experience on debugging short pieces of code might be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • One virtual machine running Windows (version 8.1, 10 or 11).
  • Microsoft Office 365 installed on the Windows virtual machine.
  • Malwoverview installed on all virtual machines, including necessary public APIs already configured.
  • Visual Studio Code installed on both Windows virtual machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction.
  • Basic information about OLE and PDF Structure.
  • Malicious PDF Analysis.
  • Static analysis of malicious Microsoft Office documents.
  • Dynamic analysis of malicious Microsoft Office documents.
  • Analysis of other types of malicious documents.
  • Additional examples (time restricted).

Note: Topics can be added, merged or removed without prior notice!