decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.04k stars 185 forks source link

anti emulation tricks + geofencing alert #80

Open decalage2 opened 5 years ago

decalage2 commented 5 years ago

The macro described in this article uses specific Excel functions to break emulation, and to only run on Japanese systems: https://www.fortinet.com/blog/threat-research/excel-variable-targeting-japanese-users.html

It would be great to support those functions in vmonkey (if it's not already the case), and also to alert the user when a macro uses a geofencing trick (e.g. xlDate). In the latter case, maybe the vmonkey user could have an option to decide which country to emulate, or to run multiple emulations to test different countries in a row. (to find out which country is targeted)