Explode VBA LaikaBoss Module

explode_vba.py

# Explode VBA LaikaBoss Module
# Based off of default explode_ole.py from https://github.com/lmco/laikaboss

from oletools import olevba
from laikaboss.objectmodel import ModuleObject, ExternalVars, QuitScanException, \
                                GlobalScanTimeoutError, GlobalModuleTimeoutError
from laikaboss.util import log_module
from laikaboss.si_module import SI_MODULE

class EXPLODE_VBA(SI_MODULE):
    def __init__(self,):
        self.module_name = "EXPLODE_VBA"
        self.global_search = "GLOBAL_SEARCH"
    def _run(self, scanObject, result, depth, args):
        moduleResult = []
        minFileSize = 0 #Explode everything!
        useUnvalidatedFilenames = 0
        if 'minFileSize' in args:
            try:
                minFileSize = int(args['minFileSize'])
            except (QuitScanException, GlobalScanTimeoutError, GlobalModuleTimeoutError):
                raise
            except:
                pass
        if 'useUnvalidatedFilenames' in args:
            try:
                minFileSize = int(args['useUnvalidatedFilenames'])
            except (QuitScanException, GlobalScanTimeoutError, GlobalModuleTimeoutError):
                raise
            except:
                pass

        vba = olevba.VBA_Parser(filename=scanObject.filename, data=scanObject.buffer)

        #extract macros
        macros = vba.extract_all_macros()
        for m in macros:
            try:
                m_filename, m_stream_path, m_vba_name, m_vba_code = m
                friendly_name = m_stream_path.replace("/","_") + "_" + m_vba_name
                moduleResult.append(ModuleObject(buffer=m_vba_code, externalVars=ExternalVars(filename=friendly_name)))
            except (QuitScanException, GlobalScanTimeoutError, GlobalMOduleTimeoutError):
                raise
            except:
                log_module("MSG", self.module_name, 0, scanObject, result, "ERROR EXTRACTING MACRO: %s" % m[2])

        #extract revealed macros
        try:
            revealed_macro = vba.reveal()
            filename = "REVEALED_VBA_%s" % scanObject.filename
            moduleResult.append(ModuleObject(buffer=revealed_macro, externalVars=ExternalVars(filename=filename)))
        except (QuitScanException, GlobalScanTimeoutError, GlobalMOduleTimeoutError):
            raise
        except:
            log_module("MSG", self.module_name, 0, scanObject, result, "ERROR REVEALING MACRO")

        vba.close()
        return moduleResult