Lion Cipher Lab
Inspect a suspicious document, safely
- Digital Forensics & IR (DFIR)
- Beginner
- ~40 min
- Free · no account required
Why it matters
Malicious documents are one of the most common ways attackers get their first foothold. A Word file or a PDF looks ordinary in an inbox, but it can carry a macro, an embedded object, or an exploit that runs the instant someone opens it — which is exactly why phishing so often ships a document rather than a bare program. The defender's job is to answer "is this document safe to open?" without opening it. Static triage does that: purpose-built free tools parse the file's structure and surface the active content — VBA macros and their auto-run triggers in Office files, JavaScript and OpenAction…
What you'll learn
- safe document triage
- spotting VBA macros with oleid and olevba
- recognising auto-exec entry points
- finding PDF JavaScript and OpenAction with pdfid
- reading a document with pdf-parser
- reading static indicators
- working inside an isolated VM
Steps in this lab
- The golden rule: a disposable, network-isolated VM
- Why documents are a top delivery method
- Install the tools inside your VM
- Create a benign PDF test file
- Triage the PDF: pdfid, then pdf-parser
- Create a benign macro-bearing Office document
- Triage the Office document: oleid, then olevba
- Reading the indicators — and why clean is not proof