I recorded a video for the maldoc analysis I did in diary entries "VBA Maldoc & UTF7 (APT-C-35)" and "Update: VBA Maldoc & UTF7 (APT-C-35)".

The analysis of shellcode is a bit different in the video, compared to the 2 diary entries I wrote. There's often more than one solution when doing maldoc analysis :-) .

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com