Password Protected ZIP with Maldoc

Published: 2018-12-17
Last Updated: 2018-12-17 20:07:44 UTC
by Didier Stevens (Version: 1)
1 comment(s)

Reader Jason submitted a malicious document that he analyzed completely. A small problem encountered by Jason was the following: the malicious document, emailed to his users, was contained in a password protected ZIP file.

The password was included in the email, and the sandbox used it to extract the malicious document before analysis. But when Jason obtained the maldoc from the sandbox, he had not way to get thet password too.

Jason used fcrackzip and the rockyou password list to recover the password:

#fcrackzip -v -D -u -p rockyou.txt
#found file 'information.doc', (size cp/uc  54053/ 88576, flags 1, chk e466)

#PASSWORD FOUND!!!!: pw == 1234567

IOCs shared by Jason:

Zip hash:

Doc Hash:

URL Download:

Executable hash:

Thanks for the tip Jason!

I would like to add a couple of remarks., my Python tool to analyze ZIP files and their content, supports passwords and password recovery. By default, zipdump will try password "infected". If that fails, you can provide another password with option -p, or a password list (like rockyou) with option -P. zipdump also has a small build-in list of popular passwords, that can be used by typing a dot (.) as option P value:

The ZIP file contains a .doc file, that can be selected for further processing (since the password was recovered with -P ., the content can be extracted):

This ole file can then be analyzed with, for example:

The simple string analysis method I explained in diary entry "Quickie: String Analysis is Still Useful" doesn't give the expected result:

The DOSfuscated PowerShell command is split over 2 strings. That's because, unfortunetaly for us, the malicious command is stored in 2 stream sectors that are not contiguous.


There is however an easy workaround: let dump all the streams (-s a) and extract the strings (-S):



And now this can be deobfuscated as explained in diary entry "De-DOSfuscation Example":





Didier Stevens
Senior handler
Microsoft MVP

Keywords: maldoc password zip
1 comment(s)
ISC Stormcast For Monday, December 17th 2018


Diary Archives