DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
570 stars 115 forks source link

Add functionality to manually load files and set environment variables during execution #69

Open stevengoossensB opened 3 years ago

stevengoossensB commented 3 years ago

In many cases, The maldoc macro's will spawn a cmd shell to create or download a file to disk. After that, they will check whether that file exists before continuing with the execution.

It would be good to preload files (potentially also with content) to make sure the macro will find them and continues the execution. If that's impossible, a workaround could be to create a flag which neglects these checks and runs further (e.g. return always true for the FILES excel formula)