decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.04k stars 185 forks source link

vmonkey does not fully support zipped files (-z option) #57

Open decalage2 opened 5 years ago

decalage2 commented 5 years ago

With the -z option, vmonkey should be able to process files from within a password-protected zip archive. But for now, an error is triggered when parsing document variables or calling xlrd, which expect a plain file:

>vmonkey "New invoice 4M087877.doc.zip" -z infected
 _    ___                 __  ___            __
| |  / (_)___  ___  _____/  |/  /___  ____  / /_____  __  __
| | / / / __ \/ _ \/ ___/ /|_/ / __ \/ __ \/ //_/ _ \/ / / /
| |/ / / /_/ /  __/ /  / /  / / /_/ / / / / ,< /  __/ /_/ /
|___/_/ .___/\___/_/  /_/  /_/\____/_/ /_/_/|_|\___/\__, /
     /_/                                           /____/
vmonkey 0.07 - https://github.com/decalage2/ViperMonkey
THIS IS WORK IN PROGRESS - Check updates regularly!
Please report any issue at https://github.com/decalage2/ViperMonkey/issues

===============================================================================
FILE: New invoice 4M087877.doc in New invoice 4M087877.doc.zip
ERROR    Reading in metadata failed. [Errno 2] No such file or directory: 'New invoice 4M087877.doc'
ERROR    Reading in file as Excel failed. [Errno 2] No such file or directory: 'New invoice 4M087877.doc'
-------------------------------------------------------------------------------
VBA MACRO fqccqJYYpXCuhi.cls
in file: New invoice 4M087877.doc - OLE stream: u'Macros/VBA/fqccqJYYpXCuhi'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[...]
ERROR    Cannot read document variables. [Errno 2] No such file or directory: 'New invoice 4M087877.doc'
ERROR    Cannot read custom doc properties. [Errno 2] No such file or directory: 'New invoice 4M087877.doc'
ERROR    Cannot read document text from New invoice 4M087877.doc. [Errno 2] No such file or directory: 'New invoice 4M087877.doc'