So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams.
I've read most parts of the Office VBA File Format Structure, from which it seems to me that the correct way of detecting the beginning of the compressed code is by parsing the
dir stream which contains the
PROJECTMODULES Record and which contains the
MODULEOFFSET Record whose element
TextOffset contains the actual offset to the compressed source code inside the appropriate
ModuleStream. I've also found a project officeparser which performs the VBA code detection in the following way, but according to the project site on Github, there hasn't been any work on the project in the last few years.
However, I've also found two other projects that deal with the same problem in a different way and which are more up to date. The projects are oledump and oletools and the way they detect the beginning of the compressed VBA code inside a stream is by searching for the pattern
\x00Attribut and then positioning 3 bytes back from that position. I haven't found any official documentation on this method so what I would like to know is if this method is some heuristic way of searching for the compressed code or am I missing some parts of the documentation?