maldoc_analyze
Analyze suspicious Office documents to extract VBA macros, identify auto-execution triggers, detect obfuscation patterns, and find malicious indicators without executing payloads.
Instructions
Full malware document analysis pipeline.
oledump.py — list OLE streams, identify macro-containing streams (marked 'M')
olevba — extract VBA macro code
Identify auto-execution triggers (Document_open, AutoOpen, Workbook_Open)
Look for obfuscation patterns and base64 payloads
Search for PowerShell, WMI, and shell execution indicators
Returns: {"ole_streams": str, "vba_macros": str, "auto_exec_triggers": [str], "suspicious_strings": [str], "iocs": [str]}.
Side effects: Read-only file analysis. Does NOT execute any payloads.
Errors: Requires oledump.py and olevba (pip install oletools).
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"file_path": "<file_path>"
},
"name": "maldoc_analyze"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to the suspicious OLE document (.doc, .xls, .bin) |