saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/analyzing-macro-malware-in-office-documents/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.9 KiB
Raw Blame History

API Reference: Office Macro Malware Analysis Tools

olevba - VBA Macro Extraction (oletools)

CLI Syntax

olevba document.docm                   # Full analysis
olevba --decode --deobf document.docm  # Decode + deobfuscate
olevba --code document.docm            # Extract VBA source only
olevba --json document.docm            # JSON output
olevba --reveal document.docm          # Reveal hidden content

Output Sections

Section Content
AutoExec Auto-execution triggers (AutoOpen, Document_Open)
Suspicious Dangerous functions (Shell, WScript, CreateObject)
IOC Extracted indicators (URLs, IPs, file paths)
Hex String Decoded hex-encoded strings

Python API

from oletools.olevba import VBA_Parser
vba = VBA_Parser("document.docm")
if vba.detect_vba_macros():
    for (fn, stream, vba_fn, code) in vba.extract_macros():
        print(code)
    for (kw_type, keyword, desc) in vba.analyze_macros():
        print(f"{kw_type}: {keyword}")
vba.close()

oleid - Document Capability Identification

CLI Syntax

oleid document.docm

Indicators

Indicator Risk Values
VBA Macros True/False
XLM Macros True/False
External Relationships True/False
ObjectPool True/False
Flash True/False

oledump.py - OLE Stream Analysis

CLI Syntax

oledump.py document.docm                    # List streams
oledump.py -s 8 -v document.docm           # Extract stream 8
oledump.py -p plugin_vba_dco document.docm  # VBA decompile
oledump.py -p plugin_msg.py document.msg    # MSG file parsing

Stream Markers

Marker Meaning
M Contains VBA macros
m Contains macro attributes
O Contains OLE objects

XLMDeobfuscator - Excel 4.0 Macros

CLI Syntax

xlmdeobfuscator -f document.xlsm
xlmdeobfuscator -f document.xlsm --output-format json

Dangerous XLM Functions

Function Purpose
EXEC() Execute shell command
CALL() Call DLL function
REGISTER() Register DLL function
URLDownloadToFileA Download file from URL

VBA Auto-Execution Triggers

Trigger Application
Auto_Open / AutoOpen Word
Document_Open Word
Workbook_Open Excel
Auto_Close Word
AutoExec Word

VBA Suspicious Functions

Function Risk
Shell() Command execution
WScript.Shell Windows scripting
CreateObject() COM object instantiation
URLDownloadToFile File download
MSXML2.XMLHTTP HTTP requests
ADODB.Stream Binary file writing
CallByName Indirect method invocation
Environ() Environment variable access

ViperMonkey - VBA Emulation

Syntax

vmonkey document.docm
vmonkey --iocs document.docm   # Extract IOCs only