Malicious Office Document Analysis

[omergunal]

Malicious Office document is one of the most popular malware used by attackers. SOC Analysts need to understand how to analyze it.

Steps:

1. Prepare a table of contents
2. Create lesson for each title (video or text-based, video would be better)
3. If possible, create at least 3 practical questions for each lesson. (Some theoretical lessons like "Introduction to Malicious Office Documents" doesn't need a question)
   3.1. Example question: What is the command&control server of "MalwareSample.exe"?
4. Prepare a walkthrough about questions
5. Upload everything on Google Drive and send the link to us as a comment or to [email protected]
6. LetsDefend team will review your materials. If necessary, will do some edits for a better format then release it.

Sample Table of Content for this course:

• Introduction to Malicious Office Documents
• Office file formats
• Installing the analysis tools
• Malicious VBA Macros
• Static Analysis
• Dynamic Analysis
• Summary

Useful Links:

• https://www.intezer.com/blog/malware-analysis/analyze-malicious-microsoft-office-files/
• https://www.youtube.com/watch?v=tmrfZKRwNZk
• https://www.youtube.com/watch?v=POLJs-B_-kk

Sample courses:

• https://app.letsdefend.io/training/lessons/windows-fundamentals
• https://app.letsdefend.io/training/lesson_detail/malware-traffic-analysis-with-wireshark-1