Peter M. Groen / oletools

Commit 694cdd020cfb496dda0869833657753b62aa35b2

Authored by decalage2
1 parent 14225907

olevba: added autoexec keyword InkPicture_Painted (issue #80), detect_autoexec n… 

…ow returns the exact keyword found
Inline Side-by-side
Showing 1 changed file with 9 additions and 2 deletions
oletools/olevba.py
  View file @694cdd0
... ... @@ -178,6 +178,8 @@ https://github.com/unixfreak0037/officeparser
178 178 # 2016-06-12 v0.50 PL: - fixed small bugs in VBA parsing code
179 179 # 2016-07-01 PL: - fixed issue #58 with format() to support Python 2.6
180 180 # 2016-07-29 CH: - fixed several bugs including #73 (Mac Roman encoding)
  181 +# 2016-08-31 PL: - added autoexec keyword InkPicture_Painted
  182 +# - detect_autoexec now returns the exact keyword found
181 183  
182 184 __version__ = '0.50'
183 185  
... ... @@ -450,6 +452,9 @@ AUTOEXEC_KEYWORDS = {
450 452 ('Auto_Open', 'Workbook_Open', 'Workbook_Activate'),
451 453 'Runs when the Excel Workbook is closed':
452 454 ('Auto_Close', 'Workbook_Close'),
  455 + 'Runs when the file is opened (using InkPicture ActiveX object)':
  456 + # ref:https://twitter.com/joe4security/status/770691099988025345
  457 + (r'\w+_Painted',),
453 458  
454 459 #TODO: full list in MS specs??
455 460 }
... ... @@ -1709,9 +1714,11 @@ def detect_autoexec(vba_code, obfuscation=None):
1709 1714 for keyword in keywords:
1710 1715 #TODO: if keyword is already a compiled regex, use it as-is
1711 1716 # search using regex to detect word boundaries:
1712   - if re.search(r'(?i)\b' + keyword + r'\b', vba_code):
  1717 + match = re.search(r'(?i)\b' + keyword + r'\b', vba_code)
  1718 + if match:
1713 1719 #if keyword.lower() in vba_code:
1714   - results.append((keyword, description + obf_text))
  1720 + found_keyword = match.group()
  1721 + results.append((found_keyword, description + obf_text))
1715 1722 return results
1716 1723  
1717 1724  
... ...