Peter M. Groen / oletools

Commit d2cb1b4accb532d97d9ddc884c199115f131dc67

Authored by Philippe Lagadec
1 parent f15af87a

olevba: added Workbook_Activate to suspicious keywords

Inline Side-by-side
Showing 1 changed file with 2 additions and 1 deletions
oletools/olevba.py
  View file @d2cb1b4
... ... @@ -162,6 +162,7 @@ https://github.com/unixfreak0037/officeparser
162 162 # - fixed issue #32 by monkeypatching email.feedparser
163 163 # 2016-02-07 PL: - KeyboardInterrupt is now raised properly
164 164 # 2016-02-20 v0.43 PL: - fixed issue #34 in the VBA parser and vba_chr
  165 +# 2016-02-29 PL: - added Workbook_Activate to suspicious keywords
165 166  
166 167 __version__ = '0.43'
167 168  
... ... @@ -334,7 +335,7 @@ AUTOEXEC_KEYWORDS = {
334 335  
335 336 # MS Excel:
336 337 'Runs when the Excel Workbook is opened':
337   - ('Auto_Open', 'Workbook_Open'),
  338 + ('Auto_Open', 'Workbook_Open', 'Workbook_Activate'),
338 339 'Runs when the Excel Workbook is closed':
339 340 ('Auto_Close', 'Workbook_Close'),
340 341  
... ...