Triaging MalDocs with Spectra Analyze

This report demonstrates using Spectra Analyze and Spectra Core to triage a malicious Office document (UT.xls) that contains a VBA macro which contacts Dropbox to retrieve a secondary payload and modifies registry settings to bypass macro/security warnings. It covers dynamic sandboxing to extract network indicators (IPs and Dropbox URLs), static analysis of extracted VBA for behavioral strings and registry tampering, construction of advanced searches and YARA-compatible strings for threat hunting, and identification of related samples in a broader campaign.