Mpju:dZdZddlZddlZddlZddlZej jej jej je Z ej jej je dZ e ej vrej jde ddlmZddlmZddlmZddlmZdd lmZej2d Zd Zd ezZej:d ZdZej:dezZ dZ!ej:de!zZ"Gdde#Z$Gdde#Z%Gdde#Z&Gdde#Z'Gdde#Z(Gdde#Z)dZ*e+dk(re*yy) a mraptor.py - MacroRaptor MacroRaptor is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect malicious macros. Supported formats: - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm) - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) - PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm) - Word/PowerPoint 2007+ XML (aka Flat OPC) - Word 2003 XML (.xml) - Word/Excel Single File Web Page / MHTML (.mht) - Publisher (.pub) Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation MacroRaptor is part of the python-oletools package: http://www.decalage.info/python/oletools z0.56.2Nz..)xglob) tablestream)olevba)TYPE2TAG) log_helpermraptorz,https://github.com/decalage2/oletools/issueszPlease report this issue on %sa(?i)\b(?:Auto(?:Exec|_?Open|_?Close|Exit|New)|Document(?:_?Open|_Close|_?BeforeClose|Change|_New)|NewDocument|Workbook(?:_Open|_Activate|_Close|_BeforeClose)|\w+_(?:Painted|Painting|GotFocus|LostFocus|MouseHover|Layout|Click|Change|Resize|BeforeNavigate2|BeforeScriptExecute|DocumentComplete|DownloadBegin|DownloadComplete|FileDownload|NavigateComplete2|NavigateError|ProgressChange|PropertyChange|SetSecureLockIcon|StatusTextChange|TitleChange|MouseMove|MouseEnter|MouseLeave|OnConnecting))|Auto_Ope\bz;(?:\bOpen\b[^\n]+\b(?:Write|Append|Binary|Output|Random)\b)z(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|VirtualAlloc|RtlMoveMemory|URLDownloadToFileA?|AltStartupPath|WriteProcessMemory|ADODB\.Stream|WriteText|SaveToFile|SaveAs|SaveAsRTF|FileSaveAs|MkDir|RmDir|SaveSetting|SetAttr)\b|z(?:\bDeclare\b[^\n]+\bLib\b)z(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|RUN|CALL|MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro|EXEC|REGISTER|SetTimer)\b|ceZdZdZdZdZy)Result_NoMacrorgreenzNo MacroN__name__ __module__ __qualname__ exit_codecolorname^/mnt/ssd/data/Dropbox/adrian/scripts/msg_venv/lib/python3.12/site-packages/oletools/mraptor.pyr r sI E Drr ceZdZdZdZdZy)Result_NotMSOfficer z Not MS OfficeNr rrrrrsI E DrrceZdZdZdZdZy)Result_MacroOKcyanzMacro OKNr rrrrrsI E DrrceZdZdZdZdZy) Result_Error yellowERRORNr rrrrrsI E DrrceZdZdZdZdZy)Result_Suspiciousred SUSPICIOUSNr rrrr#r#sI E Drr#c"eZdZdZdZdZdZy) MacroRaptorzC class to scan VBA macro code to detect if it is malicious ctj||_d|_d|_d|_d|_d|_d|_d|_ d|_ g|_ y)zg MacroRaptor constructor :param vba_code: string containing the VBA macro code FN) rvba_collapse_long_linesvba_codeautoexecwriteexecuteflags suspiciousautoexec_match write_match execute_matchmatches)selfr,s r__init__zMacroRaptor.__init__sX 66x@     "! rctj|j}|Ed|_|j |_|j j|j tj|j}|Ed|_ |j |_ |j j|j tj|j}|Ed|_ |j |_ |j j|j |jr!|js |jrd|_yyy)zW Scan the VBA macro code to detect if it is malicious :return: NT) re_autoexecsearchr,r-groupr2r5appendre_writer.r3 re_executer/r4r1)r6ms rscanzMacroRaptor.scans   t}} - = DM"#'')D  LL   * OODMM * =DJ wwyD  LL   *   dmm , =DL!"D  LL   * ==dlldjj"DO/9=rcd}||jrdndz }||jrdndz }||jrdz }|Sdz }|S)Nr*A-WX)r-r.r/)r6r0s r get_flagszMacroRaptor.get_flagssO  3.  +  - +.- rN)r rr__doc__r7r@rFrrrr(r(s"#.rr(c  d}d}tj|}|jdddd|jd d d d d d|jdddd dd|jdddd|d|jddddd|j\}}t |dk(rt d t zt d!tzt t|jt d"tttttfD]&}t d#|j|j fz(t#j$t d t zt d!tzt'j(|j*$t-j(t/j0t.j2gd%gd&'}d(}d }t5j6||j8|j:|j<)D]\} } } | r| j?d*r| r| d+| n| } tA| tBret}|jE|j d,d,| g|jFd d d g-|jEd,d,d,tI| gd d d |jFg-n2d.} t-jJ| | | /}tL|jN} |jQrd,} |jS}tU|}|jW|jXrt}nt}|jE|j |j[| | g|jFd d d g-|j\rd|j^rX|jEd,d,d,d0|j\zgn5t}|jE|j d,| | g|jFd d d g-|j|kDs|}|j}t'j`t d,t d1t d2||j fzt#j$|y #tB$rn}t}|jE|j d,| | g|jFd d d g-|jEd,d,d,tI|gd d d |jFg-Yd }~d }~wwxYw#tB$r}t}|jE|j d,tL|jN| g|jFd d d g-|jEd,d,d,tI|gd d d |jFg-Yd }~Gd }~wwxYw)3zH Main function, called when olevba is run from the command line warningz3usage: mraptor [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrNzhif the file is a zip archive, open all files from it, using the provided password (requires Python 2.6+))rNtypedefaultrOz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))rNrMrSrOz-mz --matches show_matcheszShow matched strings.rz5MacroRaptor %s - http://decalage.info/python/oletoolsz4This is work in progress, please report issues at %sz7 An exit code is returned based on the analysis result:z - %d: %s)level)ResultFlagsTypeFile)r8)style header_row column_width)rLrPrT/z in r*)colorsz???)filenamedata containerz Matches: %rz%Flags: A=AutoExec, W=Write, X=ExecutezExit code: %d - %s)1optparse OptionParser add_option parse_argslenprint __version__ URL_ISSUESrG print_helpr rrrr#rrsysexitrenable_loggingrVrr TableStreamTableStyleSlimr iter_filesrLrPrTendswith isinstance Exception write_rowrrQ VBA_ParserrrRdetect_vba_macrosget_vba_code_all_modulesr(r@r1rFr5rX end_logging)DEFAULT_LOG_LEVELrJparseroptionsargsresulttexitcode global_resultrirgrh full_namefiletype vba_parserevba_code_all_modulesrs rmainrs " AE  " " /F d24 '')OWd 4yA~ E ST DzQR g HI%'9>,>!? ?@HHXW & V[["h B$*LL$d#CE RRQ0$($fll#CE !)FKKb(:??2KY W(. dD$'G IKKRSV 4(,dD&,,'G Is2.+Q,S S"A#S  S UA4UU__main__),rGrprsrjreospathnormpathabspathdirname__file___thismodule_dirjoin _parent_dirinsertoletools.thirdparty.xglobroletools.thirdparty.tablestreamroletoolsroletools.olevbaroletools.common.log_helperrget_or_create_silent_loggerlogrq MSG_ISSUEScompiler9 RE_OPEN_WRITEr=RE_DECLARE_LIBr>objectr rrrr#r(rr rrrrs@ ''""277??277??83L#MNggrww||OTBC chhHHOOA{#+7$1 -j,,Y7< - : bjjMN O 2::ln{| } 1 RZZmo}~ V  V 6  1&1ltl zFr