MS Office macro analysis

Microsoft Office has a way for automating simple tasks such as creating formatted tables or inserting letterheads. This is called an MS office macro. MS Office macro makes use of the Visual Basic for Application language, which uses the same language as Visual Basic scripts. However, these can be abused to do more like download a file, create files, make registry entries, and even delete files. 

First off, we need static tools to read information and extract the macro source from a given Office file. To open MS Office documents, we need to have Microsoft Office installed. The other tool that we could use would be OLE tools, which can be downloaded from http://www.decalage.info/en/python/oletools. These set of tools ...

Get Mastering Reverse Engineering now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.