A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
Issue #1: Unhide modules puts all code, except Classes, in modules, i.e. Sheets, forms, etc.
Issue #2: Ribbon callbacks, i.e. iRibbonControls, are discarded when Unhide Modules is performed. iRibbonControls appear in the VBA, _VBA_Project section of vbaProject.bin, but nowhere else apparently. When you look for them in the Developer Macros ribbon command of the unhidden modules workbook, they appear with a link to the workbook with modules hidden.
Issue #1: Unhide modules puts all code, except Classes, in modules, i.e. Sheets, forms, etc. Issue #2: Ribbon callbacks, i.e. iRibbonControls, are discarded when Unhide Modules is performed. iRibbonControls appear in the VBA, _VBA_Project section of vbaProject.bin, but nowhere else apparently. When you look for them in the Developer Macros ribbon command of the unhidden modules workbook, they appear with a link to the workbook with modules hidden.