From f56062def0e72718201c50392d866c2cdbeb3b7e Mon Sep 17 00:00:00 2001 From: decalage2 Date: Thu, 4 Apr 2019 20:31:52 +0200 Subject: [PATCH] mraptor: added ExecuteExcel4Macro and ShellExecuteA (fixes #374) --- oletools/mraptor.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/oletools/mraptor.py b/oletools/mraptor.py index e6ac23e..e0612f0 100644 --- a/oletools/mraptor.py +++ b/oletools/mraptor.py @@ -23,7 +23,7 @@ http://www.decalage.info/python/oletools # === LICENSE ================================================================== -# MacroRaptor is copyright (c) 2016-2018 Philippe Lagadec (http://www.decalage.info) +# MacroRaptor is copyright (c) 2016-2019 Philippe Lagadec (http://www.decalage.info) # All rights reserved. # # Redistribution and use in source and binary forms, with or without modification, @@ -58,8 +58,9 @@ http://www.decalage.info/python/oletools # 2016-12-21 v0.51 PL: - added more ActiveX macro triggers # 2017-03-08 PL: - fixed absolute imports # 2018-05-25 v0.53 PL: - added Word/PowerPoint 2007+ XML (aka Flat OPC) issue #283 +# 2019-04-04 v0.54 PL: - added ExecuteExcel4Macro and ShellExecuteA -__version__ = '0.53' +__version__ = '0.54dev14' #------------------------------------------------------------------------------ # TODO: @@ -132,7 +133,7 @@ re_write = re.compile(r'(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|' RE_DECLARE_LIB = r'(?:\bDeclare\b[^\n]+\bLib\b)' re_execute = re.compile(r'(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|' - + r'MacScript|FollowHyperlink|CreateThread|ShellExecute)\b|' + RE_DECLARE_LIB) + + r'MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro)\b|' + RE_DECLARE_LIB) # === CLASSES ================================================================= -- libgit2 0.21.4