Yara Rule to Detect Office Files Modified to Hide VBA Modules in Office VBA IDE.

gistfile1.txt

rule vba_hidden_from_editor {

  strings:

    $header_office = { D0 CF 11 E0 }
    $has_macros = "\x0aDocument="
    $s1 = /\x0aDocument=.{3,1000}\x0d?\x0a\w{4,30}=(\{|"|[a-zA-Z])/
    $s2 = /\x0aDocument=This(Docume|Displa)[a-zA-Z](\x00.){10,}/

  condition:

    ($header_office at 0) and $has_macros and not $s1 and not $s2
}