How to Analyze

Attackers rarely deliver a plain executable. They hide payloads inside the everyday file types that pass through every inbox and endpoint: shortcuts, documents, installers, and email attachments. Each format has its own structure, its own abuse techniques, and its own set of tools for pulling it apart.

This section walks through the file types most commonly used to deliver malware, explaining the format first and then showing how to identify and analyze malicious samples with open-source and free tools.

• LNK Files - The Shell Link Binary format, the indicators that give away a malicious shortcut, and how to inspect one with LnkParse3.
• Microsoft Office Files - OLE, OOXML, and RTF internals, plus macros, DDE abuse, template injection, and the known vulnerabilities attackers still exploit.
• PDF Files - The four parts of the PDF structure, how JavaScript and embedded streams are used to deliver malware, and two worked examples using peepdf and pdf-parser.
• Phishing Emails - Reading email headers, spotting spoofed senders, and inspecting the attachments and links that phishing campaigns rely on.
• MSI Installer Files - The MSI database format, the tables worth checking first, and a hands-on analysis of a malicious installer using msitools and msidiff.