mraptor, olevba: add VBA trigger using customUI

[decalage2]

customUI provides an alternate way to trigger VBA macros.

See https://www.netero1010-securitylab.com/evasion/execution-of-remote-vba-script-in-excel

Different cases:

• customUI/onLoad
• customUI/command/onAction (with idMso matching a command)
• and each case can have either a namespace for Office 2007 or 2010

List of values for command/idMso:

• Word: https://docs.microsoft.com/en-us/openspecs/office_standards/ms-customui/a9f90d73-6e69-4bb7-8e38-4f268cd42038
  • FileCloseOrExit
  • FileClose
• Excel: https://docs.microsoft.com/en-us/openspecs/office_standards/ms-customui/bb5bb594-ec8c-45f6-8424-f98e8308b25a
• PowerPoint: https://docs.microsoft.com/en-us/openspecs/office_standards/ms-customui/f2a8e3c0-14cb-4ad3-88cd-a8b5b1b9a8a0