Commit 1af6975e9c5336da0a4051b3202c8610747784ac
1 parent
db842e43
olevba: added hint when to use option --deobf - issue #40
Showing
1 changed file
with
1 additions
and
1 deletions
oletools/olevba.py
| @@ -546,7 +546,7 @@ SUSPICIOUS_KEYWORDS = { | @@ -546,7 +546,7 @@ SUSPICIOUS_KEYWORDS = { | ||
| 546 | 'May attempt to obfuscate malicious function calls': | 546 | 'May attempt to obfuscate malicious function calls': |
| 547 | ('CallByName',), | 547 | ('CallByName',), |
| 548 | #CallByName: http://msdn.microsoft.com/en-us/library/office/gg278760%28v=office.15%29.aspx | 548 | #CallByName: http://msdn.microsoft.com/en-us/library/office/gg278760%28v=office.15%29.aspx |
| 549 | - 'May attempt to obfuscate specific strings': | 549 | + 'May attempt to obfuscate specific strings (use option --deobf to deobfuscate)': |
| 550 | #TODO: regex to find several Chr*, not just one | 550 | #TODO: regex to find several Chr*, not just one |
| 551 | ('Chr', 'ChrB', 'ChrW', 'StrReverse', 'Xor'), | 551 | ('Chr', 'ChrB', 'ChrW', 'StrReverse', 'Xor'), |
| 552 | #Chr: http://msdn.microsoft.com/en-us/library/office/gg264465%28v=office.15%29.aspx | 552 | #Chr: http://msdn.microsoft.com/en-us/library/office/gg264465%28v=office.15%29.aspx |