From d2cb1b4accb532d97d9ddc884c199115f131dc67 Mon Sep 17 00:00:00 2001 From: Philippe Lagadec Date: Mon, 29 Feb 2016 19:36:46 +0100 Subject: [PATCH] olevba: added Workbook_Activate to suspicious keywords --- oletools/olevba.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/oletools/olevba.py b/oletools/olevba.py index 21e0f32..afea47f 100755 --- a/oletools/olevba.py +++ b/oletools/olevba.py @@ -162,6 +162,7 @@ https://github.com/unixfreak0037/officeparser # - fixed issue #32 by monkeypatching email.feedparser # 2016-02-07 PL: - KeyboardInterrupt is now raised properly # 2016-02-20 v0.43 PL: - fixed issue #34 in the VBA parser and vba_chr +# 2016-02-29 PL: - added Workbook_Activate to suspicious keywords __version__ = '0.43' @@ -334,7 +335,7 @@ AUTOEXEC_KEYWORDS = { # MS Excel: 'Runs when the Excel Workbook is opened': - ('Auto_Open', 'Workbook_Open'), + ('Auto_Open', 'Workbook_Open', 'Workbook_Activate'), 'Runs when the Excel Workbook is closed': ('Auto_Close', 'Workbook_Close'), -- libgit2 0.21.4