Analyze Suspicious Script Or Document
Overview
Recover the execution chain as data. Use parsers and text extraction in isolation, avoid native handlers, and make each decoding transformation reproducible.
Read references/script-document-analysis.md for language and document-specific checks.
Workflow
- Preserve the original and identify the real container/type.
- Extract without activation.
- List document members and relationships; extract text, metadata, macros, JavaScript, forms, links, embedded files, and external references with non-executing tooling.
- Render URLs and commands as inert text.
- Normalize one layer at a time.
- Decode base64/hex/URL escapes, string concatenation, compression, character arithmetic, environment substitution, and generated commands.
- Record input, operation, tool, and output hash for every layer.
- Reconstruct control and data flow.
- Identify entry conditions, interpreter, downloaded content, execution methods, persistence, credential/file access, network destinations, cleanup, and environment gates.
- Separate capability from execution.
- State which branches are present, which inputs activate them, and which behaviors remain inferred.
- Route payloads.
- Send recovered binaries to static/reverse analysis and use dynamic analysis only inside chosen isolation.
Guardrails
- Do not paste decoded commands into an executing shell.
- Do not enable macros, install profiles, follow links, or import shortcuts during static analysis.
- Do not use a cloud document parser for private content without approval.
Output
Return container identity, recovered layers, execution chain, indicators, activation conditions, likely impact, uncertainty, and safe next step.
1---2name: analyze-suspicious-script-or-document3description: Decode and analyze suspicious scripts and active documents without triggering them. Use for shell, AppleScript, JavaScript, Python, PowerShell, shortcuts, Office files, PDFs, profiles, macros, embedded objects, and staged payloads.4---56# Analyze Suspicious Script Or Document78## Overview910Recover the execution chain as data. Use parsers and text extraction in isolation, avoid native handlers, and make each decoding transformation reproducible.1112Read [references/script-document-analysis.md](references/script-document-analysis.md) for language and document-specific checks.1314## Workflow15161. Preserve the original and identify the real container/type.172. Extract without activation.18 - List document members and relationships; extract text, metadata, macros, JavaScript, forms, links, embedded files, and external references with non-executing tooling.19 - Render URLs and commands as inert text.203. Normalize one layer at a time.21 - Decode base64/hex/URL escapes, string concatenation, compression, character arithmetic, environment substitution, and generated commands.22 - Record input, operation, tool, and output hash for every layer.234. Reconstruct control and data flow.24 - Identify entry conditions, interpreter, downloaded content, execution methods, persistence, credential/file access, network destinations, cleanup, and environment gates.255. Separate capability from execution.26 - State which branches are present, which inputs activate them, and which behaviors remain inferred.276. Route payloads.28 - Send recovered binaries to static/reverse analysis and use dynamic analysis only inside chosen isolation.2930## Guardrails3132- Do not paste decoded commands into an executing shell.33- Do not enable macros, install profiles, follow links, or import shortcuts during static analysis.34- Do not use a cloud document parser for private content without approval.3536## Output3738Return container identity, recovered layers, execution chain, indicators, activation conditions, likely impact, uncertainty, and safe next step.
gaelic-ghost