Lion Cipher Lab
Analyze a malicious Office macro statically — extract and deobfuscate VBA with olevba and oledump
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A macro-enabled Word or Excel file is one of the most common ways an attacker gets their first foothold on a network. It arrives as an ordinary-looking attachment on a phishing email, and the moment someone opens it and clicks 'Enable Content,' a hidden program runs — usually to pull down and launch the real malware. MITRE ATT&CK tracks this as User Execution: Malicious File (T1204.002), and the code inside is Visual Basic for Applications, ATT&CK's T1059.005. The defender's job is to answer one question — 'what would this document do if someone opened it?' — WITHOUT ever opening it. That is…
What you'll learn
- static analysis of VBA macros (read, never run)
- extracting macro source with olevba
- reading olevba's AutoExec / Suspicious / IOC / obfuscation flags
- deobfuscating strings with olevba --reveal and --decode
- reading OLE stream structure and decompressing macros with oledump
- mapping findings to MITRE ATT&CK (T1204.002, T1059.005)
- reaching a maldoc verdict without executing anything
Steps in this lab
- What a macro is, and why one Office file can take over a machine
- Static vs dynamic: you are going to READ the code, not RUN it
- Set up a throwaway VM and install the two tools
- Build your own inert test document — the safe way to have a macro
- First pass with olevba: extract the source and read the flag table
- Deobfuscate: make olevba reveal what the macro really says
- Cross-check the structure with oledump — a second tool, a second view
- Reach a verdict, map it to ATT&CK, and respect the limits
- The habit this builds