Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def get_vba(workbook):
vba_parser = VBA_Parser(workbook)
vba_modules = vba_parser.extract_all_macros() if vba_parser.detect_vba_macros() else []
modules = {}
for _, _, _, content in vba_modules:
decoded_content = content.decode('latin-1')
lines = []
if '\r\n' in decoded_content:
lines = decoded_content.split('\r\n')
else:
lines = decoded_content.split('\n')
if lines:
name = lines[0].replace('Attribute VB_Name = ', '').strip('"')
content = [line for line in lines[1:] if not (
line.startswith('Attribute') and 'VB_' in line)]
non_empty_lines_of_code = len([c for c in content if c])
def parse_vba(self, save_path):
save = False
vbaparser = VBA_Parser(__sessions__.current.file.path)
# Check for Macros
if not vbaparser.detect_vba_macros():
self.log('error', "No Macro's Detected")
return
self.log('info', "Macro's Detected")
# try:
if True:
an_results = {
'AutoExec': [],
'Suspicious': [],
'IOC': [],
'Hex String': [],
'Base64 String': [],
'Dridex string': [],
'VBA string': []
}
def parse_vba(self, save_path):
save = False
vbaparser = VBA_Parser(__sessions__.current.file.path)
# Check for Macros
if not vbaparser.detect_vba_macros():
self.log('error', "No Macro's Detected")
return
self.log('info', "Macro's Detected")
# try:
if True:
an_results = {'AutoExec': [], 'Suspicious': [], 'IOC': [], 'Hex String': [], 'Base64 String': [], 'Dridex string': [], 'VBA string': []}
for (filename, stream_path, vba_filename, vba_code) in vbaparser.extract_macros():
self.log('info', "Stream Details")
self.log('item', "OLE Stream: {0}".format(string_clean(stream_path)))
self.log('item', "VBA Filename: {0}".format(string_clean(vba_filename)))
# Analyse the VBA Code
vba_scanner = VBA_Scanner(vba_code)
analysis = vba_scanner.scan(include_decoded_strings=True)
for kw_type, keyword, description in analysis:
def scan(self, data, file, options, expire_at):
analyze_macros = options.get('analyze_macros', True)
self.event['total'] = {'files': 0, 'extracted': 0}
try:
vba = olevba3.VBA_Parser(filename=file.name, data=data)
if vba.detect_vba_macros():
extract_macros = list(vba.extract_macros())
self.event['total']['files'] = len(extract_macros)
for (filename, stream_path, vba_filename, vba_code) in extract_macros:
extract_file = strelka.File(
name=f'{vba_filename}',
source=self.name,
)
for c in strelka.chunk_string(vba_code):
self.upload_to_coordinator(
extract_file.pointer,
c,
expire_at,
)
async def scan(self, payload: Payload, request: Request) -> WorkerResponse:
results: Dict = {}
filename = payload.results.payload_meta.extra_data.get(
'filename', payload.results.payload_id
)
vba_parser = olevba.VBA_Parser(filename=filename, data=payload.content)
if vba_parser.detect_vba_macros():
vba_modules: List[str] = [
vba_code[3] for vba_code in vba_parser.extract_all_macros()
]
mraptor = MacroRaptor('\n'.join(vba_modules))
mraptor.scan()
flags = [
self.FLAGS[flag] for flag in mraptor.get_flags() if flag in self.FLAGS
]
results = {
'suspicous': mraptor.suspicious,
'flags': flags,
'filetype': vba_parser.type,
'matches': mraptor.matches,
}
def get_result(filename):
try:
behavior = {}
vbaparser = VBA_Parser(filename)
if vbaparser.detect_vba_macros():
results = vbaparser.analyze_macros()
for item in results:
details = re.sub(r'\(.*\)', '', str(item[2]))
details = details.replace('strings', 'str')
details = re.sub(r' $', '', details)
if item[0] == 'AutoExec':
behavior.update({item[1]: details})
if item[0] == 'Suspicious':
behavior.update({item[1]: details})
macro = vbaparser.reveal()
attributes = re.findall(r'Attribute VB.*', macro, flags=re.MULTILINE)
macro = re.sub(r'Attribute VB.*', '', macro)