Analysing Scripts And Macros

Prerequisites

• Target system, dependencies and environment configured.

Usage

Purpose

A large share of real-world attacks start not with a compiled binary but with a script — a malicious Office macro, an obfuscated PowerShell command, a JavaScript dropper in an email. These are the initial-access and dropper stages, and they're heavily obfuscated to evade detection and human eyes. This skill covers analysing and deobfuscating script-based malware to reveal what it actually does — usually download and run the next stage.

When to use it

Analysing phishing attachments and droppers (the most common thing a SOC/IR analyst faces), or any script-based sample. It's often more immediately relevant than binary reversing, because scripts are where most intrusions begin. Do it in the isolated lab, and read scripts statically rather than running them where you can.

Procedure

1. Extract the script from its container. Office documents are containers — macros live inside the OLE/OOXML structure. oletools (olevba) pulls VBA macros out without opening the document in Office (which would run them):

   olevba suspicious.docm            # extract + flag VBA macros, no Office needed
   oleid suspicious.docm             # quick risk indicators
   

   For other types: extract the script from the email, HTML, or archive.
2. Read it statically first — don't run it. The whole point is to understand it without execution. Malicious scripts are obfuscated but ultimately have to deobfuscate themselves to run, so the logic is there to be followed.
3. Deobfuscate in layers. Script obfuscation is usually layered: base64/hex encoding, string concatenation and reversal, character-code arithmetic, and eval/Invoke-Expression of a reconstructed string. Peel each layer:
   • decode base64/hex (CyberChef is ideal for chaining decode operations);
   • resolve string concatenation and reversal;
   • substitute variables to see the reconstructed command.

   # CyberChef: chain From Base64 -> decode -> etc. to unwrap layers
   

4. Find the payload action. After deobfuscation, most droppers reveal the same thing: a URL to download the next stage, a command to run it, and often a persistence step. That downloaded URL and the executed command are your key indicators.
5. For PowerShell specifically, watch for -EncodedCommand (base64), IEX/Invoke-Expression, download cradles (New-Object Net.WebClient).DownloadString, and -WindowStyle Hidden -NoProfile — the hallmarks of a download-and-execute cradle. Decode the encoded command to read it.
6. Extract indicators and pivot — the URLs, dropped filenames, and commands feed IoC extraction and detection; the downloaded next stage (if retrievable safely) becomes the next sample to analyse.

Cheatsheet

extract WITHOUT opening/running
  Office macros:  olevba doc.docm   /  oleid doc.docm   (oletools)
  other: pull script from email / HTML / archive

read STATICALLY, deobfuscate in LAYERS (CyberChef chains the steps)
  base64 / hex decode
  string concat + reversal
  char-code arithmetic
  eval / Invoke-Expression of the rebuilt string -> the real command

PowerShell red flags
  -EncodedCommand (base64) | IEX / Invoke-Expression
  (New-Object Net.WebClient).DownloadString  (download cradle)
  -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass

the payload is usually: download URL (next stage) + run command + persistence
  -> these are your key IoCs (feeds extracting-iocs)

Reading the script

• A deobfuscated download-and-execute cradle = the classic dropper; the URL it fetches and the command it runs are your primary indicators and the pivot to the next stage. This is the payoff of deobfuscation.
• Heavy layered obfuscation (base64 inside string-reversal inside char-code math) = intentional evasion, not complexity for its own sake; peel it layer by layer — CyberChef makes chaining the decodes manageable.
• Invoke-Expression/eval of a reconstructed string = the moment the script runs its real payload; whatever is passed to it, deobfuscated, is the actual command.
• A macro with AutoOpen/Document_Open = auto-execution on document open — how the macro fires without further user action beyond enabling macros.
• A URL and a dropped filename = the indicators IR needs to block and hunt, often obtainable without ever running the script.
• A fully deobfuscated script = you understand the initial-access stage and have its IoCs — frequently more actionable, faster, than reversing a binary.

Pitfalls

• Opening the document in Office to "see the macro". That runs it. Extract with olevba/oletools instead, statically.
• Running the script to deobfuscate it. Tempting (let it decode itself), but that's execution — do it in the lab only, and prefer manual/CyberChef deobfuscation. Never run a dropper on your workstation.
• Stopping at the first layer. Obfuscation is layered; decoding one base64 blob often reveals another. Keep peeling until you reach the real command.
• Missing the auto-execution trigger. AutoOpen/Document_Open (macros) or the entry logic is how it fires; understand what triggers it.
• Ignoring the next stage. The dropper's value is the URL/command it reveals; extract those and pivot — the downloaded payload is the real malware.

References

• oletools (olevba, oleid) documentation
• CyberChef (gchq.github.io/CyberChef) for layered deobfuscation
• Practical Malware Analysis and SANS FOR610 (script analysis)
• The extracting-iocs, dynamic-analysis-sandboxing, and phishing-email-analysis skills
• MITRE ATT&CK — T1059 (Command and Scripting Interpreter), T1566 (Phishing)

Inputs

• Relevant source code, logs, network traces, or system specifications.

Outputs

• Analysis findings, security audit report, or generated code artifacts.