Commit 694cdd020cfb496dda0869833657753b62aa35b2
1 parent
14225907
olevba: added autoexec keyword InkPicture_Painted (issue #80), detect_autoexec n…
…ow returns the exact keyword found
Showing
1 changed file
with
9 additions
and
2 deletions
oletools/olevba.py
| @@ -178,6 +178,8 @@ https://github.com/unixfreak0037/officeparser | @@ -178,6 +178,8 @@ https://github.com/unixfreak0037/officeparser | ||
| 178 | # 2016-06-12 v0.50 PL: - fixed small bugs in VBA parsing code | 178 | # 2016-06-12 v0.50 PL: - fixed small bugs in VBA parsing code |
| 179 | # 2016-07-01 PL: - fixed issue #58 with format() to support Python 2.6 | 179 | # 2016-07-01 PL: - fixed issue #58 with format() to support Python 2.6 |
| 180 | # 2016-07-29 CH: - fixed several bugs including #73 (Mac Roman encoding) | 180 | # 2016-07-29 CH: - fixed several bugs including #73 (Mac Roman encoding) |
| 181 | +# 2016-08-31 PL: - added autoexec keyword InkPicture_Painted | ||
| 182 | +# - detect_autoexec now returns the exact keyword found | ||
| 181 | 183 | ||
| 182 | __version__ = '0.50' | 184 | __version__ = '0.50' |
| 183 | 185 | ||
| @@ -450,6 +452,9 @@ AUTOEXEC_KEYWORDS = { | @@ -450,6 +452,9 @@ AUTOEXEC_KEYWORDS = { | ||
| 450 | ('Auto_Open', 'Workbook_Open', 'Workbook_Activate'), | 452 | ('Auto_Open', 'Workbook_Open', 'Workbook_Activate'), |
| 451 | 'Runs when the Excel Workbook is closed': | 453 | 'Runs when the Excel Workbook is closed': |
| 452 | ('Auto_Close', 'Workbook_Close'), | 454 | ('Auto_Close', 'Workbook_Close'), |
| 455 | + 'Runs when the file is opened (using InkPicture ActiveX object)': | ||
| 456 | + # ref:https://twitter.com/joe4security/status/770691099988025345 | ||
| 457 | + (r'\w+_Painted',), | ||
| 453 | 458 | ||
| 454 | #TODO: full list in MS specs?? | 459 | #TODO: full list in MS specs?? |
| 455 | } | 460 | } |
| @@ -1709,9 +1714,11 @@ def detect_autoexec(vba_code, obfuscation=None): | @@ -1709,9 +1714,11 @@ def detect_autoexec(vba_code, obfuscation=None): | ||
| 1709 | for keyword in keywords: | 1714 | for keyword in keywords: |
| 1710 | #TODO: if keyword is already a compiled regex, use it as-is | 1715 | #TODO: if keyword is already a compiled regex, use it as-is |
| 1711 | # search using regex to detect word boundaries: | 1716 | # search using regex to detect word boundaries: |
| 1712 | - if re.search(r'(?i)\b' + keyword + r'\b', vba_code): | 1717 | + match = re.search(r'(?i)\b' + keyword + r'\b', vba_code) |
| 1718 | + if match: | ||
| 1713 | #if keyword.lower() in vba_code: | 1719 | #if keyword.lower() in vba_code: |
| 1714 | - results.append((keyword, description + obf_text)) | 1720 | + found_keyword = match.group() |
| 1721 | + results.append((found_keyword, description + obf_text)) | ||
| 1715 | return results | 1722 | return results |
| 1716 | 1723 | ||
| 1717 | 1724 |