According to the CHFI v11 objectives under Malware Forensics and Static and Dynamic Malware Analysis , Microsoft Office documents are one of the most common delivery mechanisms for malware, especially through malicious macros, embedded scripts, and exploit-laden objects . Attackers frequently weaponize Word, Excel, and PowerPoint files to execute malicious code when a user opens the document or enables macros.
The primary forensic purpose of analyzing suspicious Microsoft Office documents is to identify embedded malware or malicious code and understand how it executes. Investigators examine macro code (VBA), embedded objects, OLE streams, and document metadata to detect indicators such as obfuscated scripts, PowerShell execution commands, shellcode loaders, or downloader functionality. CHFI v11 emphasizes that this analysis helps determine the infection chain , execution triggers, and potential impact on the compromised system.
Options A, B, and D are not valid forensic goals in this context. Identifying the document author (Option A) may be supplementary but does not address the core threat. Formatting optimization (Option B) and performance improvement (Option D) are unrelated to forensic or security investigations.
The CHFI Exam Blueprint v4 explicitly includes analyzing suspicious Word, Excel, and PDF documents as part of malware investigations, highlighting the need to detect hidden malicious logic and prevent further compromise. Therefore, identifying embedded malware or malicious code is the correct and exam-aligned objective
