Malware analysis is the process of examining malicious software to understand what it does, how it works, how it communicates, and how it can be detected or contained. Two especially important areas are document forensics and network forensics.
1. Document Forensics Analysis
Document forensics focuses on suspicious files, such as PDFs, Microsoft Office documents, RTF files, and other file formats, to determine whether they contain malicious content.
An analyst will usually look at:
File identification: Confirming the real file type, format, size, hashes, and relevant timestamps.
Metadata: Reviewing details such as author information, creation and modification dates, document properties, and embedded objects.
Internal structure: Looking for suspicious elements such as macros, scripts, JavaScript, embedded files, unusual streams, or malformed objects.
Macro analysis: Examining VBA or other scripting code that may download files, run commands, or change system settings.
Embedded content: Extracting and investigating attachments, images, archives, executables, and other objects hidden inside the document.
Static analysis: Studying the document without opening or executing it.
Dynamic analysis: Running the document in a controlled, isolated environment and monitoring its behavior.
Indicators of Compromise (IOCs): Collecting useful artifacts such as hashes, filenames, domains, IP addresses, URLs, registry keys, and other detection clues.
Network forensics examines traffic generated by malware or activity connected to a suspected infection. Its goal is to understand how the malware communicates, where it sends data, and whether it is contacting malicious external infrastructure.
Investigators commonly analyze:
Source and destination IP addresses
DNS requests and responses
HTTP and HTTPS traffic
TLS certificate and connection details
TCP and UDP connections
Protocols and ports used
Downloaded files or payloads
Command-and-control (C2) communication
Beaconing patterns, such as regular connections to the same external server
Large or unusual data transfers that may indicate data exfiltration
Common evidence sources include PCAP files, firewall logs, DNS logs, proxy logs, IDS/IPS alerts, and endpoint network telemetry.
Useful tools include:
Wireshark: Detailed packet inspection and protocol analysis.
Zeek: Network security monitoring and network metadata generation.
Suricata: Intrusion detection, prevention, and traffic analysis.
tcpdump: Command-line packet capture.
NetworkMiner: Network artifact extraction and traffic investigation.v
steghide:
tshark:
3. Combining Documents and Network Evidence
The strongest malware investigations connect document findings with network activity. This helps analysts understand the full attack chain, from the initial infection to the malware’s external communication.
For example:
A suspicious email arrives with an attachment.
The document contains a malicious macro.
The macro starts a process on the victim’s system.
That process sends a DNS request.
A connection is established with an external server.
An additional payload is downloaded.
Network traffic reveals communication with a command-and-control server.
By correlating this evidence, investigators can build a clear timeline and link the initial infection vector, endpoint activity, and network behavior.
4. Typical Malware-Forensics Report
A well-organized malware-forensics report may include:
Executive summary
Evidence collected
File identification and hashes
Document structure and extracted artifacts
Malware behavior
Process and system activity
Network communications
Timeline of events
Indicators of Compromise
Detection opportunities
Containment and remediation recommendations
Technical appendix
Suspicious documents and malware should always be handled in an isolated analysis environment, preferably using virtual machines, snapshots, and no access to sensitive production systems. This helps prevent an investigation from accidentally causing a real infection or spreading malware through the organization.