Peter M. Groen / oletools

Commit 879c3fb44448a0b7176ff317f6c8737837c39436

Authored by decalage2
1 parent 82c4a54d

olevba: added keywords for Mac-specific macros (issue #130)

Inline Side-by-side
Showing 1 changed file with 10 additions and 1 deletions
oletools/olevba.py
  View file @879c3fb
... ... @@ -189,6 +189,7 @@ from __future__ import print_function
189 189 # 2016-10-25 PL: - fixed raise and print statements for Python 3
190 190 # 2016-11-03 v0.51 PL: - added EnumDateFormats and EnumSystemLanguageGroupsW
191 191 # 2017-02-07 PL: - temporary fix for issue #132
  192 +# - added keywords for Mac-specific macros (issue #130)
192 193  
193 194 __version__ = '0.51dev1'
194 195  
... ... @@ -526,6 +527,11 @@ SUSPICIOUS_KEYWORDS = {
526 527 'May run an executable file or a system command':
527 528 ('Shell', 'vbNormal', 'vbNormalFocus', 'vbHide', 'vbMinimizedFocus', 'vbMaximizedFocus', 'vbNormalNoFocus',
528 529 'vbMinimizedNoFocus', 'WScript.Shell', 'Run', 'ShellExecute'),
  530 + # MacScript: see https://msdn.microsoft.com/en-us/library/office/gg264812.aspx
  531 + 'May run an executable file or a system command on a Mac':
  532 + ('MacScript',),
  533 + 'May run an executable file or a system command on a Mac (if combined with libc.dylib)':
  534 + ('system', 'popen', r'exec[lv][ep]?'),
529 535 #Shell: http://msdn.microsoft.com/en-us/library/office/gg278437%28v=office.15%29.aspx
530 536 #WScript.Shell+Run sample: http://pastebin.com/Z4TMyuq6
531 537 'May run PowerShell commands':
... ... @@ -556,8 +562,11 @@ SUSPICIOUS_KEYWORDS = {
556 562 'May enumerate application windows (if combined with Shell.Application object)':
557 563 ('Windows', 'FindWindow'),
558 564 'May run code from a DLL':
559   - #TODO: regex to find declare+lib on same line
  565 + #TODO: regex to find declare+lib on same line - see mraptor
560 566 ('Lib',),
  567 + 'May run code from a library on a Mac':
  568 + #TODO: regex to find declare+lib on same line - see mraptor
  569 + ('libc.dylib', 'dylib'),
561 570 'May inject code into another process':
562 571 ('CreateThread', 'VirtualAlloc', # (issue #9) suggested by Davy Douhine - used by MSF payload
563 572 'VirtualAllocEx', 'RtlMoveMemory',
... ...