URL unpacker from documents with malicious macros sent by Emotet

emotet-doc.py

"""
Needs oledump.py in the same directory (download from https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py)
and olefile (pip install olefile)

Usage: python2 emotet-doc.py [doc path]
"""

import base64
import re
import sys

import oledump
import olefile

base64_regex = r"([0-9A-Za-z+/]{64,}={0,2})"
url_regex = r"(https?://[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]{2,})+(?:[/?][a-zA-Z-0-9?/:&+_\-=.]+)?)"

filename = sys.argv[1]
ole = olefile.OleFileIO(open(filename, 'rb').read())
for _, _, _, stream in oledump.OLEGetStreams(ole):
    try:
        b64data = re.findall(base64_regex, stream)
        if not b64data:
            continue
        data = base64.b64decode(b64data[0])
        data = data.decode("utf16")
        for url in re.findall(url_regex, data):
            print url
    except Exception as e:
        import traceback
        traceback.print_exc(e)