312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ363

Tools/Systems/Programs

During an email-attachment review at a consulting firm in Texas, the team finds a document that scans clean for signatures but contains embedded scripts flagged for possible auto-execution, creating concerns about hidden downloads from external sources. To parse the file and highlight indicators such as obfuscated strings or download commands without executing it, which tool should investigators deploy next after the initial structure mapping?

  • A Detect it Easy
  • B olevba
  • C oleid
  • D oledump
Explanation

olevba statically parses OLE and OpenXML Office documents, extracts VBA macro source, detects auto-executable macros and suspicious keywords, deobfuscates common string encodings and VBA expressions, and identifies indicators such as URLs and executable filenames. This directly supports safe identification of concealed download behavior.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!