Introduction

What is a Malicious Document?

A malicious document is a seemingly normal file, such as a Word document, PDF, Excel spreadsheet, or any other type of file, that does not typically execute code by default but has been weaponized with harmful code. When this type of document is opened, the embedded malicious code is executed, potentially leading to various harmful outcomes, such as stealing data, compromising system security, or gaining unauthorized access to a network.

How a Document Executes Code?

When a malicious document is opened, it typically leverages various methods to run its embedded malicious code. The process usually begins when a user opens a malicious document, often delivered via email or downloaded from a compromised website.

STEP 1 - Initial Document Opening

• User Interaction: The first step is usually the user interaction. The user opens the malicious document, often delivered via email or downloaded from a compromised website. Common malicious document types include Microsoft Office files that can contain macros (e.g., .docm, .xlsm and .pptm), PDF files, or other format such as RTF (Rich Text Format) that support embedded scripts.

STEP 2 - Exploitation of Embedded Code

• Macros/VBA Scripts (Office Documents): In Microsoft Office documents, malicious macros (written in Visual Basic for Applications, VBA) or embedded scripts can be automatically executed if macros are enabled. Attackers often employ social engineering techniques to trick users into enabling macros, such as by saying, "Please enable macros to view the content correctly".

• Embedded Objects: The document may contain embedded objects, such as OLE (Object Linking and Embedding) objects, that can execute code when interacted with.

• JavaScript (PDF Files): In PDF documents, JavaScript can be embedded and automatically executed when the document is opened, leading to the execution of malicious code.

STEP 3 - Shellcode or Exploit Execution

• Shellcode Injection: The embedded script may inject shellcode directly into the current process's memory or another process's memory, effectively bypassing some security mechanisms.

• Exploitation of Vulnerabilities: The document may exploit a known vulnerability in the application used to open it (e.g., a buffer overflow in Adobe Reader) to gain control over the execution flow and run arbitrary code.

STEP 4 - Dropping and Executing Payload

• Payload Download: The script may download additional malware from a remote server, often using HTTP, HTTPS, or DNS communication.

• Payload Execution: The document may drop an executable file on the disk or load the payload directly into memory. This payload could be a backdoor, ransomware, keylogger, or another type of malware.

• Process Injection: The malicious document may inject its payload into a legitimate process to evade detection and run with the privileges of that process (e.g., explorer.exe).

STEP 5 - Establishing Persistence

• Persistence Mechanisms: The malware may establish persistence on the victim’s machine by modifying the registry, creating scheduled tasks, or placing files in startup directories.

• Command and Control (C2) Communication: The malware often communicates with a remote C2 server to receive further instructions, exfiltrate data, or download additional components.

STEP 6 - Execution and Lateral Movement

• Execution of Malicious Activities: Once the payload is executed, it carries out its intended malicious activities, such as data exfiltration, file encryption, or spying on the user.

• Lateral Movement: If the malware aims to move laterally within a network, it may leverage credentials obtained from the infected system to access other machines.

The diagram shown below provides an overview of the different documents and tools used to examine them:

Real World Case studies

Several adversary groups leverage malicious document attachments in phishing emails as a common attack vector. These documents, often crafted to appear legitimate, contain embedded scripts, macros, or exploits that execute malware upon opening.

Malicious Office Document (APT36)

APT36 (or Transparent Tribe) is a threat group (that has been active since at least 2013) which is known to leverage spearphishing with malicious Office document attachments for initial compromise. Here's an example of a procedure where APT36 used Office documents with macros for initial access.

Malicious CHM File (TAG-74)

Recorded Future's Insikt Group, which is tracking the activity under the alias TAG-74, said it is a state-sponsored adversary and poses a significant threat to academic, aerospace and defense, government, military, and political entities in South Korea, Japan, and Russia.". Their tactics, techniques, and procedures (TTPs) include the use of malicious .chm files that trigger a DLL search order hijacking execution chain to gain access to the victim.

Malicious RTF File (LokiBot)

First reported in 2015, LokiBot is a well-known information-stealing malware often distributed through spam campaigns that target various sectors, including finance, technology, and government. It is classified as a credential harvester, infostealer, and remote access trojan (RAT). It employs Trojan malware to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials.

These threat groups demonstrate how effective malicious document attachments can be in phishing campaigns. Each of these examples highlights different document types—Office documents, CHM files, and RTF files—as effective tools in phishing campaigns for cyber espionage and financial theft. By leveraging these document formats, threat actors can exploit user trust and gain initial access to targeted systems.