3

So, I was testing a Yara rule which goes like this:

rule macro_auto_run

{
    meta:
        description = "Document with macro that auto runs"
        
    strings:
        $s1 = "AutoOpen"
        $s2 = "Workbook_Open"
        
    condition:
        ($s1 or $s2)
}

I created a Word file, then created a macro in the document with the name, AutoOpen, put some code in it and attempted to test it against this rule.

It did not trigger. Then I ran the utility strings on it. It couldn't find the word "AutoOpen". Used another hex editor like HxD, still nothing. Did a Unicode, Ascii search for the string as well. Nothing! I am wondering why.

Edit: Figured out that I need to unzip the archive and then search within those files.

2
  • 2
    which version of Word? Newer ones are zip files which would need unpacking first. May 6, 2023 at 18:07
  • Ok. It is the OOXML based version. May 7, 2023 at 5:16

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.