CTF Challenge

MalDoc

Name: MalDoc
Brand: CodeRed

This challenge requires performing static malware analysis on a suspicious Word document using various forensic tools (exiftool, yara, oletools) to identify malicious indicators, embedded macros, and IOCs.

1 Hour

Intermediate

Validation of Completion Included

Buy this course now

$19.00

Overview What You Will Learn Curriculum Instructor

Challenge Overview

As a security analyst, you are tasked with analyzing a suspicious Word document that has raised concerns about its potential malicious nature. Your objective is to conduct a comprehensive investigation using various tools and techniques to assess the document's security risks and gather critical information. You begin by isolating the document from the network and performing a thorough scan using antivirus and anti-malware tools to identify known malware signatures or suspicious behavior. Employing static analysis techniques, you examine macros, embedded objects, and hidden content. Throughout the investigation, you meticulously document your findings, including malicious code, network communication details, and identified exploit techniques. The compiled report provides valuable insights, recommended mitigation strategies, and enhances the organization's overall security posture. In this exciting CTF challenge, you are presented with a task to download a file from an FTP server hosted on a Windows machine with the IP address 10.10.1.71. The downloaded file is a suspected malicious Word document (doc file) that requires thorough analysis. Using a range of powerful tools such as exiftool, yara rules, oleid, oletimes, and olevba, you will meticulously examine the document's metadata, structure, embedded objects, and macro code. Your objective is to identify any malicious indicators, detect potential exploits, and gain insights into the document's behavior. By successfully completing this challenge, you will enhance your skills in analyzing malicious Word documents, leveraging advanced tools and techniques commonly employed by security professionals. This hands-on experience will further deepen your knowledge of document forensics and help strengthen your ability to detect and mitigate potential cyber threats.

What You Will Learn

Performing in-depth analysis of a suspicious Microsoft Word document without executing it.
Using tools like ExifTool to extract document metadata and uncover hidden indicators.
Applying YARA rules to detect known malicious patterns and signatures.
Leveraging oletools (oleid, oletimes, olevba) to inspect embedded objects, identify malicious macros, and extract suspicious VBA code.
Identifying indicators of compromise (IOCs), exploit techniques, and documenting findings to produce a structured forensic report with mitigation recommendations.

Program Curriculum

Buy this course now

$19.00

Get Immediate access for one year today!

Upgrade to Pro Plans and Get Full Access Today!

Get this course, along with 900+ courses and 70+ learning paths and more in one subscription. Learn more

Unlock All Access

Plans start from $33/mo. Cancel anytime.

Join over 1 Million professionals from the most renowned Companies in the world!

Choose the Pro Plan That Fits Your Learning Journey

Invest in your future with flexible Pro subscription plans. Whether you're starting your cybersecurity journey or expanding your expertise, choose the membership duration that works for you and gain access to our complete learning platform.

Monthly Plans

Annual Plans

Save 20% with our annual plans!

Pro

Ideal for continuous learning, offering extensive resources with 900+ courses and diverse Learning Paths to enhance your skills.

^$ 599.00

Billed annually or $69.00 billed monthly

Get Started Now

Start your 7-day trial for $1

What is included

Access to 900+ Premium Short Courses
70+ Structured Learning Paths
Validation of Completion with All Courses and Learning Paths
New Courses Added Every Month

Early Access Offer

Pro +

Experience immersive learning with Practice Labs and CTF Challenges for comprehensive skill-building.

^$ 699.00

Billed annually or $79.00 billed monthly

Get Started Now

Start your 7-day trial for $1

Everything in Pro and

500+ Practice Labs with Guided Instructions
400+ CTF Challenges with Detailed Walkthroughs
New Practice Labs and Challenges Added Every Month

Related CTF Challenges

Scheduled Shadows

This challenge focuses on Windows digital forensics and incident response. Participants analyze Security, System, and Task Scheduler event logs to identify attacker activity, trace a persistence mechanism involving scheduled tasks and services, correlate user activity with logon sessions, and reconstruct the attack timeline.

This challenge focuses on Windows digital forensics and incid...

$19.00

Hello
PacketHeist

This challenge focuses on network forensic analysis and investigating data exfiltration. Participants will use Wireshark to inspect a packet capture file, filter for HTTP traffic, and export transferred HTTP objects. The objective is to safely extract and analyze exfiltrated PDF documents to uncover a hidden flag.

This challenge focuses on network forensic analysis and inves...

$19.00

Hello
Autopsied

This challenge provides a guided walkthrough of disk forensics and image analysis using Autopsy. Participants must load the forensic disk image, analyze web server logs to uncover malicious encoded payloads, identify anti-forensic techniques such as file extension mismatches, and perform file carving to recover deleted files.

This challenge provides a guided walkthrough of disk forensic...

$19.00

Hello
Collision

As a cryptographic engineer at BrownLine IT Tech Solutions in Atlanta, your mission is to crack a vulnerable password-based authentication system created by a colleague. Use your skills to break the code, log in, and capture the flag.

As a cryptographic engineer at BrownLine IT Tech Solutions in...

$19.00

Hello
Sambal

This challenge focuses on service exploitation and system misconfiguration using various tools. Participants will demonstrate SMB password cracking, Hydra, and ssh2john techniques, along with evaluating SSH private key passwords. The exercise also includes SSH key brute-forcing and SMB enumeration to identify and exploit system vulnerabilities effectively.

This challenge focuses on service exploitation and system mis...

$19.00

Hello
Tesler

This challenge focuses on web and service exploitation using various tools to identify and exploit vulnerabilities. You will enhance network scanning skills to gather critical target information and apply SSH cracking techniques to uncover and exploit weaknesses. The exercise emphasizes essential penetration testing methods, including credential brute-forcing and service misconfiguration analysis.

This challenge focuses on web and service exploitation using ...

$19.00

Hello
RogueChatOps 1

This challenge involves scanning and enumerating a ChatOps web app to find flaws. Intercept WebSocket traffic with Burp Suite, modify JSON payloads, and exploit a weak password reset to take over a supervisor account. Log in with elevated access and retrieve the flag.

This challenge involves scanning and enumerating a ChatOps we...

$19.00

Hello
Boot_Me

This challenge involves cryptography and a creative Linux privilege escalation path. Participants must first decrypt a VigenÃ¨re cipher found on a web page to obtain SSH credentials for initial access. Privilege escalation is then achieved by exploiting a combination of sudo permissions for the reboot command and a user-writable systemd service file to trigger a reverse shell upon reboot.

This challenge involves cryptography and a creative Linux pri...

$19.00

Hello