search

decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.05k stars 185 forks source link

vb2py #9

Open den-run-ai opened 7 years ago

den-run-ai commented 7 years ago

I thought that this parser and converter from vba to python would be handy, I tried it on a very large code base:

https://github.com/reingart/vb2py http://vb2py.sourceforge.net

decalage2 commented 7 years ago

Nice find, I didn't know about that project.

BTW, one of my plans was also to use ViperMonkey to convert the VBA code into Python, instead of emulating the VBA runtime.

den-run-ai commented 7 years ago

Installation is a bit difficult with PythonCard and SimpleParse dependencies. So let me know if you test it and it does not work.

On Thu, Oct 6, 2016 at 12:24 PM, Philippe Lagadec notifications@github.com wrote:

Nice find, I didn't know about that project.

BTW, one of my plans was also to use ViperMonkey to convert the VBA code into Python, instead of emulating the VBA runtime.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/decalage2/ViperMonkey/issues/9#issuecomment-252031216, or mute the thread https://github.com/notifications/unsubscribe-auth/AHgZ5byECwWhpp1VNjVLT0eDF0VIXHffks5qxS7HgaJpZM4KQMmE .

decalage2 commented 7 years ago

Did you actually manage to run VBA and/or VBScript malware code with vb2py?

And did it give good results?

den-run-ai commented 7 years ago

no I just ran good code with it :)

On Thu, Oct 6, 2016 at 3:51 PM, Philippe Lagadec notifications@github.com wrote:

Did you actually manage to run VBA and/or VBScript malware code with vb2py?

And did it give good results?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/decalage2/ViperMonkey/issues/9#issuecomment-252084714, or mute the thread https://github.com/notifications/unsubscribe-auth/AHgZ5eFtEjx3L42VKpNRuHbC7k6A9U1Yks5qxV81gaJpZM4KQMmE .