enable macro deofuscation in json mode if --deof is given

Christian Herdtweck
1 parent 23ffafb3
Showing 1 changed file with 11 additions and 5 deletions
oletools/olevba.py
@@ -2771,12 +2771,14 @@ class VBA_Parser_CLI(VBA_Parser):
         else:
             print 'No suspicious keyword or IOC found.'
-    def print_analysis_json(self, show_decoded_strings=False):
+    def print_analysis_json(self, show_decoded_strings=False, deobfuscate=False):
         """
         Analyze the provided VBA code, and return the results in json format
         :param vba_code: str, VBA source code to be analyzed
         :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content.
+        :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow)
+
         :return: dict
         """
         # print a waiting message only if the output is not redirected to a file:
@@ -2784,7 +2786,7 @@ class VBA_Parser_CLI(VBA_Parser):
             print 'Analysis...\r',
             sys.stdout.flush()
         return [dict(type=kw_type, keyword=keyword, description=description)
-                for kw_type, keyword, description in self.analyze_macros(show_decoded_strings)]
+                for kw_type, keyword, description in self.analyze_macros(show_decoded_strings, deobfuscate)]
     def process_file(self, show_decoded_strings=False,
                      display_code=True, hide_attributes=True,
@@ -2856,7 +2858,8 @@ class VBA_Parser_CLI(VBA_Parser):
     def process_file_json(self, show_decoded_strings=False,
                           display_code=True, hide_attributes=True,
-                          vba_code_only=False, show_deobfuscated_code=False):
+                          vba_code_only=False, show_deobfuscated_code=False,
+                          deobfuscate=False):
         """
         Process a single file
@@ -2869,6 +2872,7 @@ class VBA_Parser_CLI(VBA_Parser):
         :param global_analysis: bool, if True all modules are merged for a single analysis (default),
                                 otherwise each module is analyzed separately (old behaviour)
         :param hide_attributes: bool, if True the first lines starting with "Attribute VB" are hidden (default)
+        :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow)
         """
         #TODO: fix conflicting parameters (?)
@@ -2907,7 +2911,8 @@ class VBA_Parser_CLI(VBA_Parser):
                     macros.append(curr_macro)
                 if not vba_code_only:
                     # analyse the code from all modules at once:
-                    result['analysis'] = self.print_analysis_json(show_decoded_strings)
+                    result['analysis'] = self.print_analysis_json(show_decoded_strings,
+                                                                  deobfuscate)
                 if show_deobfuscated_code:
                     result['code_deobfuscated'] = self.reveal()
             result['macros'] = macros
@@ -3130,7 +3135,8 @@ def main():
                         vba_parser.process_file_json(show_decoded_strings=options.show_decoded_strings,
                                  display_code=options.display_code,
                                  hide_attributes=options.hide_attributes, vba_code_only=options.vba_code_only,
-                                 show_deobfuscated_code=options.show_deobfuscated_code))
+                                 show_deobfuscated_code=options.show_deobfuscated_code,
+                                 deobfuscate=options.deobfuscate))
                 else:  # (should be impossible)
                     raise ValueError('unexpected output mode: "{0}"!'.format(options.output_mode))
                 count += 1