Ziu:SrSrSSKrSSKrSSKrSSKr\R R\R R\R R\ 555r \R R\R R\ S55r \ \R ;a\R RS\ 5 SSKJr SSKJr SSKJr SSKJr SS KJr \R2"S 5rS rS \-r\R:"S 5rSr\R:"S\-5r Sr!\R:"S\!-5r""SS\#5r$"SS\#5r%"SS\#5r&"SS\#5r'"SS\#5r("SS\#5r)Sr*\+S:Xa\*"5 gg) a mraptor.py - MacroRaptor MacroRaptor is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect malicious macros. Supported formats: - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm) - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) - PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm) - Word/PowerPoint 2007+ XML (aka Flat OPC) - Word 2003 XML (.xml) - Word/Excel Single File Web Page / MHTML (.mht) - Publisher (.pub) Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation MacroRaptor is part of the python-oletools package: http://www.decalage.info/python/oletools z0.56.2Nz..)xglob) tablestream)olevba)TYPE2TAG) log_helpermraptorz,https://github.com/decalage2/oletools/issueszPlease report this issue on %sa(?i)\b(?:Auto(?:Exec|_?Open|_?Close|Exit|New)|Document(?:_?Open|_Close|_?BeforeClose|Change|_New)|NewDocument|Workbook(?:_Open|_Activate|_Close|_BeforeClose)|\w+_(?:Painted|Painting|GotFocus|LostFocus|MouseHover|Layout|Click|Change|Resize|BeforeNavigate2|BeforeScriptExecute|DocumentComplete|DownloadBegin|DownloadComplete|FileDownload|NavigateComplete2|NavigateError|ProgressChange|PropertyChange|SetSecureLockIcon|StatusTextChange|TitleChange|MouseMove|MouseEnter|MouseLeave|OnConnecting))|Auto_Ope\bz;(?:\bOpen\b[^\n]+\b(?:Write|Append|Binary|Output|Random)\b)z(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|VirtualAlloc|RtlMoveMemory|URLDownloadToFileA?|AltStartupPath|WriteProcessMemory|ADODB\.Stream|WriteText|SaveToFile|SaveAs|SaveAsRTF|FileSaveAs|MkDir|RmDir|SaveSetting|SetAttr)\b|z(?:\bDeclare\b[^\n]+\bLib\b)z(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|RUN|CALL|MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro|EXEC|REGISTER|SetTimer)\b|c \rSrSrSrSrSrSrg)Result_NoMacrorgreenzNo MacroN__name__ __module__ __qualname____firstlineno__ exit_codecolorname__static_attributes__r j/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/mraptor.pyr r sI E Drr c \rSrSrSrSrSrSrg)Result_NotMSOfficer z Not MS Officer Nrr rrrrsI E Drrc \rSrSrSrSrSrSrg)Result_MacroOKcyanzMacro OKr Nrr rrrrsI E Drrc \rSrSrSrSrSrSrg) Result_Error yellowERRORr Nrr rrr#r#sI E Drr#c \rSrSrSrSrSrSrg)Result_Suspiciousred SUSPICIOUSr Nrr rrr)r)sI E Drr)c*\rSrSrSrSrSrSrSrg) MacroRaptorz; class to scan VBA macro code to detect if it is malicious c[R"U5UlSUlSUlSUlSUlSUlSUlSUl SUl /Ul g)zO MacroRaptor constructor :param vba_code: string containing the VBA macro code FN) rvba_collapse_long_linesvba_codeautoexecwriteexecuteflags suspiciousautoexec_match write_match execute_matchmatches)selfr4s r__init__MacroRaptor.__init__sX 66x@     "! rc[RUR5nUbESUlUR 5UlUR RUR 55 [RUR5nUbESUl UR 5Ul UR RUR 55 [RUR5nUbESUl UR 5Ul UR RUR 55 UR(a+UR(dUR(aSUlggg)z? Scan the VBA macro code to detect if it is malicious :return: NT) re_autoexecsearchr4r5groupr:r=appendre_writer6r; re_executer7r<r9)r>ms rscanMacroRaptor.scans   t}} - = DM"#'')D  LL   * OODMM * =DJ wwyD  LL   *   dmm , =DL!"D  LL   * ==dlldjj"DO/9=rcSnXR(aSOS- nXR(aSOS- nXR(aS- nU$S- nU$)Nr2A-WX)r5r6r7)r>r8s r get_flagsMacroRaptor.get_flagssI 3. + - +.- r) r5r:r7r<r8r=r9r4r6r;N) rrrr__doc__r?rIrPrr rrr/r/s"#.rr/c  SnSn[R"US9nURSSSSS9 URS S S S S SS9 URSSSS SSS9 URSSSSUSS9 URSSSSSS9 UR5up4[ U5S:Xa[ S [ -5 [ S![-5 [ [5 UR5 [ S"5 [[[[[4H'n[ S#URUR 4-5 M) ["R$"5 [ S [ -5 [ S![-5 [&R("UR*S$9 [,R("5 [.R0"[.R2/S%Q/S&QS'9nS(nS n[4R6"XCR8UR:UR<S)9GHupn U (aU R?S*5(aM&U (a U <S+U <3OU n [AU [B5(a_[nUREUR S,S,U /URFS S S /S-9 URES,S,S,[IU 5/S S S URF/S-9 GO;S.n [,RJ"XU S/9n[LURNn URQ5(aS,nURS5n[UU5nURW5 URX(a[nO[nUREUR UR[5X/URFS S S /S-9 UR\(a3UR^(a"URES,S,S,S0UR\-/5 O1[nUREUR S,X/URFS S S /S-9 URU:dGMUnURnGM [&R`"5 [ S,5 [ S15 [ S2XxR 4-5 ["R$"U5 g ![Bahn[nUREUR S,X/URFS S S /S-9 URES,S,S,[IU5/S S S URF/S-9 S nAGMS nAff=f![Bazn[nUREUR S,[LURNU /URFS S S /S-9 URES,S,S,[IU5/S S S URF/S-9 S nAGM\S nAff=f)3z@ Main function, called when olevba is run from the command line warningz3usage: mraptor [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrNzhif the file is a zip archive, open all files from it, using the provided password (requires Python 2.6+))rYtypedefaultrZz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))rYrXr^rZz-mz --matches show_matcheszShow matched strings.rz5MacroRaptor %s - http://decalage.info/python/oletoolsz4This is work in progress, please report issues at %sz7 An exit code is returned based on the analysis result:z - %d: %s)level)ResultFlagsTypeFile)r%8)style header_row column_width)rWr[r_/z in r2)colorsz???)filenamedata containerz Matches: %rz%Flags: A=AutoExec, W=Write, X=ExecutezExit code: %d - %s)1optparse OptionParser add_option parse_argslenprint __version__ URL_ISSUESrR print_helpr rrr#r)rrsysexitrenable_loggingrarr TableStreamTableStyleSlimr iter_filesrWr[r_endswith isinstance Exception write_rowrr\ VBA_Parserrr]detect_vba_macrosget_vba_code_all_modulesr/rIr9rPr=rc end_logging)DEFAULT_LOG_LEVELrUparseroptionsargsresulttexitcode global_resultrtrrrs full_namefiletype vba_parserevba_code_all_modulesrs rmainrs" AE  " " /F d24 '')OW 4yA~ E ST DzQR g HI%'9>,>!? ?@HHXW & V[["hB$*LL$d#CE RRQ0$($fll#CE !)FKKb(:??2KY W(. dD$'G IKKRSV 4(,dD&,,'G Is2*(Q#*S# S-ASS U"A.UU__main__),rRr{r~rureospathnormpathabspathdirname__file___thismodule_dirjoin _parent_dirinsertoletools.thirdparty.xglobroletools.thirdparty.tablestreamroletoolsroletools.olevbaroletools.common.log_helperrget_or_create_silent_loggerlogr| MSG_ISSUEScompilerB RE_OPEN_WRITErFRE_DECLARE_LIBrGobjectr rrr#r)r/rrr rrrs@ ''""277??277??83L#MNggrww||OTBC chhHHOOA{#+7$1 ,,Y7< - : jjMN O ::ln{| } 1 ZZmo}~ V  V 6  1&1ltl zFr