312-49V11 · Question #22
You are a forensic investigator working for a cybersecurity firm tasked with analyzing a suspicious Microsoft Office document named "infected_doc." The document was discovered in an email attachment…
The correct answer is A. Execute the command oleid "" on a Linux workstation to review all components for suspicious. This question aligns with CHFI v11 objectives under Malware Forensics and Static Malware Analysis of Suspicious Documents. When analyzing potentially malicious Microsoft Office documents, CHFI v11 emphasizes that investigators should always begin with static analysis before…
Question
You are a forensic investigator working for a cybersecurity firm tasked with analyzing a suspicious Microsoft Office document named "infected_doc." The document was discovered in an email attachment sent to multiple employees at a large corporation. Concerns have been raised about potential malware embedded within the document, particularly involving VBA macros. As a forensic investigator examining the "infected_doc" Microsoft Office document, what initial step would you take to identify suspicious or malicious components within the file?
Options
- AExecute the command oleid "" on a Linux workstation to review all components for suspicious
- BOpen the document in a sandbox environment to observe any unusual behavior.
- CRun the command analyze_doc "" to scan the document for potential threats.
- DUtilize a browser-based tool to inspect the document's metadata for any anomalies.
How the community answered
(26 responses)- A81% (21)
- B4% (1)
- C12% (3)
- D4% (1)
Explanation
This question aligns with CHFI v11 objectives under Malware Forensics and Static Malware Analysis of Suspicious Documents. When analyzing potentially malicious Microsoft Office documents, CHFI v11 emphasizes that investigators should always begin with static analysis before attempting any form of execution. This approach minimizes risk and helps identify embedded threats such as VBA macros, OLE objects, exploits, and obfuscation techniques without activating the payload. The oleid tool (part of the oletools suite) is specifically designed for the initial inspection of OLE- based Microsoft Office documents. It quickly identifies indicators of compromise such as the presence of macros, embedded objects, suspicious file formats, encryption, and known exploit characteristics. CHFI v11 highlights oleid as a safe, non-intrusive first step to triage Office documents and determine whether deeper analysis (e.g., macro extraction or sandbox execution)
Topics
Community Discussion
No community discussion yet for this question.