Scribd
Upload
121 views13 pages

Malware Analysis Fundamentals Files Tools

The document discusses how to handle different types of files during malware analysis, including generic files, email files, Microsoft Office files from 1997-2003 and 2007+, RTF files, LNK files, MSI files, PDF files, and PE files. It provides tips on tools like python-oletools and references additional resources for analyzing malicious documents. The document is authored by Marc Ochsenmeier and focuses on fundamentals of analyzing files during malware analysis.

Uploaded by

apolelel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
121 views13 pages

Malware Analysis Fundamentals Files Tools

The document discusses how to handle different types of files during malware analysis, including generic files, email files, Microsoft Office files from 1997-2003 and 2007+, RTF files, LNK files, MSI files, PDF files, and PE files. It provides tips on tools like python-oletools and references additional resources for analyzing malicious documents. The document is authored by Marc Ochsenmeier and focuses on fundamentals of analyzing files during malware analysis.

Uploaded by

apolelel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 13

Malware Analysis Fundamentals - Files > Tools

March 23, 2020


Marc Ochsenmeier
@ochsenmeier
www.winitor.com
Malware Analysis Fundamentals - Files > Tools 2

Handling an unknown | generic File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 3

Handling an email File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 4

Handling a MS Office 97-2003 File

applies to following files: doc, xls, ppt, msg

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 5

Handling a protected MS Office 97-2003 File

applies to following files: doc, xls, ppt, msg

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 6

Handling a MS Office 2007+ File

applies to following files: docx, xlsx, xlsb, xlsm, pptx

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 7

Handling a protected MS Office 2007+ File

applies to following files: docx, xlsx, xlsb, xlsm, pptx

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 8

Handling an RTF File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 9

Handling an LNK File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 10

Handling an MSI File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 11

Handling a PDF file

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 12

Handling a PE File

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020


Malware Analysis Fundamentals - Files > Tools 13

More Information
• python-oletools
https://github.com/decalage2/oletools
• Didier Stevens
https://blog.didierstevens.com/didier-stevens-suite/
• Analyzing Malicious Documents Cheat Sheet
https://zeltser.com/media/docs/analyzing-malicious-document-files.pdf

Marc Ochsenmeier | @ochsenmeier | www.winitor.com March 23, 2020

You might also like