|iu: dZdZddlZddlZddlZddlZejejej e Z ejej e dZ e ejvrejde ddlmZddlmZddlmZddlmZdd lmZejd Zd Zd ezZejd ZdZejdezZ dZ!ejde!zZ"Gdde#Z$Gdde#Z%Gdde#Z&Gdde#Z'Gdde#Z(Gdde#Z)dZ*e+dkr e*dSdS) a mraptor.py - MacroRaptor MacroRaptor is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect malicious macros. Supported formats: - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm) - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) - PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm) - Word/PowerPoint 2007+ XML (aka Flat OPC) - Word 2003 XML (.xml) - Word/Excel Single File Web Page / MHTML (.mht) - Publisher (.pub) Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation MacroRaptor is part of the python-oletools package: http://www.decalage.info/python/oletools z0.56.2Nz..)xglob) tablestream)olevba)TYPE2TAG) log_helpermraptorz,https://github.com/decalage2/oletools/issueszPlease report this issue on %sa(?i)\b(?:Auto(?:Exec|_?Open|_?Close|Exit|New)|Document(?:_?Open|_Close|_?BeforeClose|Change|_New)|NewDocument|Workbook(?:_Open|_Activate|_Close|_BeforeClose)|\w+_(?:Painted|Painting|GotFocus|LostFocus|MouseHover|Layout|Click|Change|Resize|BeforeNavigate2|BeforeScriptExecute|DocumentComplete|DownloadBegin|DownloadComplete|FileDownload|NavigateComplete2|NavigateError|ProgressChange|PropertyChange|SetSecureLockIcon|StatusTextChange|TitleChange|MouseMove|MouseEnter|MouseLeave|OnConnecting))|Auto_Ope\bz;(?:\bOpen\b[^\n]+\b(?:Write|Append|Binary|Output|Random)\b)z(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|VirtualAlloc|RtlMoveMemory|URLDownloadToFileA?|AltStartupPath|WriteProcessMemory|ADODB\.Stream|WriteText|SaveToFile|SaveAs|SaveAsRTF|FileSaveAs|MkDir|RmDir|SaveSetting|SetAttr)\b|z(?:\bDeclare\b[^\n]+\bLib\b)z(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|RUN|CALL|MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro|EXEC|REGISTER|SetTimer)\b|ceZdZdZdZdZdS)Result_NoMacrorgreenzNo MacroN__name__ __module__ __qualname__ exit_codecolorname>C:\PYTHON\_runtimes\venv\Lib\site-packages\oletools/mraptor.pyr r sI E DDDrr ceZdZdZdZdZdS)Result_NotMSOfficer z Not MS OfficeNr rrrrrsI E DDDrrceZdZdZdZdZdS)Result_MacroOKcyanzMacro OKNr rrrrrsI E DDDrrceZdZdZdZdZdS) Result_Error yellowERRORNr rrrrrsI E DDDrrceZdZdZdZdZdS)Result_Suspiciousred SUSPICIOUSNr rrrr#r#sI E DDDrr#c$eZdZdZdZdZdZdS) MacroRaptorzC class to scan VBA macro code to detect if it is malicious ctj||_d|_d|_d|_d|_d|_d|_d|_ d|_ g|_ dS)zg MacroRaptor constructor :param vba_code: string containing the VBA macro code FN) rvba_collapse_long_linesvba_codeautoexecwriteexecuteflags suspiciousautoexec_match write_match execute_matchmatches)selfr,s r__init__zMacroRaptor.__init__s\ 6x@@     "! rct|j}|Ld|_||_|j|t|j}|Ld|_ ||_ |j|t|j}|Ld|_ ||_ |j||jr|j s|j r d|_dSdSdS)zW Scan the VBA macro code to detect if it is malicious :return: NT) re_autoexecsearchr,r-groupr2r5appendre_writer.r3 re_executer/r4r1)r6ms rscanzMacroRaptor.scans*   t} - - = DM"#''))D  L   * * * OODM * * =DJ wwyyD  L   * * *   dm , , =DL!"D  L   * * * = #dl #dj #"DOOO # # # #rc^d}||jrdndz }||jrdndz }||jrdndz }|S)Nr*A-WX)r-r.r/)r6r0s r get_flagszMacroRaptor.get_flagssK  .3.  ++  -#- rN)r rr__doc__r7r@rFrrrr(r(sK"###.rr(c  d}d}tj|}|dddd|d d d d d d|dddd dd|dddd|d|ddddd|\}}t |dkrt d t zt d!tzt t| t d"tttttfD] }t d#|j|jfz!t#jt d t zt d!tzt'j|j$t-jt/jt.jgd%gd&'}d(}d }t5j||j|j|j)D]\} } } | r| d*r| r| d+| n| } tA| tBrct}|"|jd,d,| g|j#d d d g-|"d,d,d,tI| gd d d |j#g-n0d.} t-j%| | | /}tL|j'} ny#tB$rl}t}|"|jd,| | g|j#d d d g-|"d,d,d,tI|gd d d |j#g-Yd }~@d }~wwxYw|(rEd,} |)}n#tB$r|}t}|"|jd,tL|j'| g|j#d d d g-|"d,d,d,tI|gd d d |j#g-Yd }~d }~wwxYwtU|}|+|j,rt}nt}|"|j|-| | g|j#d d d g-|j.r(|j/r!|"d,d,d,d0|j.zgn0t}|"|jd,| | g|j#d d d g-|j|kr |}|j}t'j0t d,t d1t d2||jfzt#j|d S)3zH Main function, called when olevba is run from the command line warningz3usage: mraptor [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrNzhif the file is a zip archive, open all files from it, using the provided password (requires Python 2.6+))rNtypedefaultrOz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))rNrMrSrOz-mz --matches show_matcheszShow matched strings.rz5MacroRaptor %s - http://decalage.info/python/oletoolsz4This is work in progress, please report issues at %sz7 An exit code is returned based on the analysis result:z - %d: %s)level)ResultFlagsTypeFile)r8)style header_row column_width)rLrPrT/z in r*)colorsz???)filenamedata containerz Matches: %rz%Flags: A=AutoExec, W=Write, X=ExecutezExit code: %d - %s)1optparse OptionParser add_option parse_argslenprint __version__ URL_ISSUESrG print_helpr rrrr#rrsysexitrenable_loggingrVrr TableStreamTableStyleSlimr iter_filesrLrPrTendswith isinstance Exception write_rowrrQ VBA_ParserrrRdetect_vba_macrosget_vba_code_all_modulesr(r@r1rFr5rX end_logging)DEFAULT_LOG_LEVELrJparseroptionsargsresulttexitcode global_resultrirgrh full_namefiletype vba_parserevba_code_all_modulesrs rmainrs" AE  " / / /F d2444 ''))OWd 4yyA~~ E STTT DzQRRR g HIII%'9>!? ?@@@HXs2)K;; M1A!M,,M1 N!! P'+A1P""P'__main__),rGrprsrjreospathnormpathabspathdirname__file___thismodule_dirjoin _parent_dirinsertoletools.thirdparty.xglobroletools.thirdparty.tablestreamroletoolsroletools.olevbaroletools.common.log_helperrget_or_create_silent_loggerlogrq MSG_ISSUEScompiler9 RE_OPEN_WRITEr=RE_DECLARE_LIBr>objectr rrrr#r(rr rrrrs@ '""27??27??83L3L#M#MNNgrw||OTBBCC chHOOA{###++++++777777$$$$$$111111 -j,Y77< - : bjMNN O 2:ln{| } } 1 RZmo}~ V  V 6  11111&111ltttl zDFFFFFr