So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams.
I've read most parts of the Office VBA File Format Structure, from which it seems to me that the correct way of detecting the beginning of the compressed code is by parsing the dir
stream which contains the PROJECTMODULES Record
and which contains the MODULEOFFSET Record
whose element TextOffset
contains the actual offset to the compressed source code inside the appropriate ModuleStream
. I've also found a project officeparser which performs the VBA code detection in the following way, but according to the project site on Github, there hasn't been any work on the project in the last few years.
However, I've also found two other projects that deal with the same problem in a different way and which are more up to date. The projects are oledump and oletools and the way they detect the beginning of the compressed VBA code inside a stream is by searching for the pattern \x00Attribut
and then positioning 3 bytes back from that position. I haven't found any official documentation on this method so what I would like to know is if this method is some heuristic way of searching for the compressed code or am I missing some parts of the documentation?