search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 116 forks source link

Problem handling a defined name to a value in XLSM #94

Closed DissectMalware closed 2 years ago

DissectMalware commented 2 years ago

Sample: 61005CAB010BDE9798CB5C7EE05497C08BA71D638644F05A1B5E58C8EAC67CA1

fff=REGISTER.ID("She"&"ll32","Shel"&"lExe"&"cuteA","JJC"&"CCJJ")

the formula does not starts with = sign and causes problem

DissectMalware commented 2 years ago

Such a formula has a bx attribute

image

To fix this, the code is rewritten with SET.NAME

SET.NAME("fff",REGISTER.ID("She"&"ll32","Shel"&"lExe"&"cuteA","JJC"&"CCJJ"))