search

decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.04k stars 185 forks source link

Missing calls from condition of loop with empty body #93

Open B-Schmidt opened 4 years ago

B-Schmidt commented 4 years ago

ViperMonkey skips loops with an empty body. This makes it possible to hide calls by simply using them as the condition of such a loop. Example:

Private Sub Document_open()
    Do Until Shell("cmd.exe /S /C" & "echo Hello World > C:\Users\Admin\test.txt")
    Loop
End Sub

ViperMonkey will ignore this, only reporting that a loop has been skipped. Office, on the other hand, will execute it.

Expected behavior would be for these calls to be evaluated and (if applicable) logged as an interesting function call.