42 lines
1.4 KiB
Markdown
42 lines
1.4 KiB
Markdown
# API Reference: Analyzing Excel 4.0 Macro Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` parses an extracted XLM macro-sheet formula dump and flags auto-run triggers,
|
|
execution/download primitives, executors, and obfuscation, reconstructing `CHAR()` string chains
|
|
and defanging URLs. It parses text only, never opens the workbook, and executes nothing.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
| oletools | optional | extract the formulas upstream (not required by this script) |
|
|
|
|
## Core functions
|
|
|
|
### `analyze(path)`
|
|
Returns auto-run triggers, execution primitives, download indicators, executors, obfuscation
|
|
techniques, defanged URLs, reconstructed `CHAR()` strings, and a maliciousness flag.
|
|
|
|
### `_reconstruct_char(line)`
|
|
Rebuilds a string from a `CHAR(n)&CHAR(n)…` concatenation chain.
|
|
|
|
## Indicators
|
|
|
|
- Auto-run: `Auto_Open`, `Auto_Close`, `Auto_Activate`.
|
|
- Execution: `EXEC(`, `CALL(`, `REGISTER(` (Win32 import declaration).
|
|
- Download: `URLDownloadToFile`, `MSXML2`, `WinHTTP`.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py analyze macros.txt
|
|
```
|
|
|
|
## Sources
|
|
|
|
- MITRE ATT&CK T1059.005 — https://attack.mitre.org/techniques/T1059/005/
|
|
- Excel 4.0 macro function semantics (EXEC/CALL/REGISTER/FORMULA.FILL) from Microsoft Office docs
|
|
- XLM obfuscation patterns from public maldoc analysis (XLMMacroDeobfuscator methodology)
|