Hunting malware in documents (lang: EN)
2020-09-01, 16:00–19:00, Workshops stream

Most of cyber attacks and Advanced persistent threats (APT) set users as target and exploit documents to compromise victim machines. This workshop will give you a deep knowledge about these kind of attacks and you will be able to hunting threat actors used malicious documents.


In recent cyber attacks, scams and frauds social engineering was a key attack vector used by cyber criminals. In most social engineering tricks, threat actor has forced victims to open a document to compromise them. This workshop is unique, because at end of it you will be able to analysis infected documents like MS Office or PDFs and find valuable information like: IP addresses, strings, C2 communications, malware type and etc. This workshop will cover the following topics:

Introduction and scenarios:

  • MS-Office structures
  • PDF structures
  • MS-office Static analysis (Hands-on lab)
  • PDF Static analysis (Hands-on lab)
  • MS-Office Dynamic analysis (Hands-on lab)
  • PDF Dynamic analysis (Hands-on lab)

The workshop is fully hands-on with real scenarios and labs.

Most of practical labs and scenarios will be done by REMNUX linux

You can find exercises (Hands-on Lab) for each chapter as below:

  • “Intro” Show some real examples of a malware attack using malicious documents
  • “Spreading Techniques” Show some real examples of threat actors using spreading techniques Related exploits for spreading techniques Related social engineering examples
  • “Attack scenarios” Show real examples, where threat actors using malicious document
  • “IoC and YARA” We will learn the importance of IoC for malware hunters Analyze some malicious documents with YARA YARA rules development for malicious document detection
  • “Office file static analysis” Static analysis on malicious Office document using exiftool, OLEtools etc.
  • “Office file dynamic analysis” Dynamic analysis on malicious Office document using Sandboxing, FakeDNS, VBA emulation, L3 traffic analysis etc.
  • “PDF file static analysis” Static analysis on malicious PDF documents using pdfid, pdf-parser, exiftool and manual code extraction techniques
  • “PDF file dynamic analysis” Dynamic analysis on malicious PDF documents using Windows Shellcode analyzer, PDF dumper, Regshooting, online resources & etc.
  • “Obfuscated files” Code extraction Code beautifyng C2 server detection
  • “Debugging” Warming up with some well-known debuggers (Windbg) Working with a specific debugger for documents (Lazy office Analyzer) Use Vipermonkey to extract interesting things, like URL, operations and so on.

You can purchase tickets here: https://nonamecon.2event.com/