olevba - display a hint when --deobf should be used

[decalage2]

Originally reported by: Philippe Lagadec (Bitbucket: decalage, GitHub: decalage2)

---

Display a message to use the option --deobf when some VBA keywords are found in the code: Chr*, StrReverse, etc.

---

• Bitbucket: https://bitbucket.org/decalage/oletools/issue/40

[Maijin]

That's already happening e.g.

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |AutoOpen            |Runs when the Word document is opened        |
|Suspicious|Shell               |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Run                 |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Chr                 |May attempt to obfuscate specific strings    |
|          |                    |(use option --deobf to deobfuscate)          |
|Suspicious|ChrW                |May attempt to obfuscate specific strings    |
|          |                    |(use option --deobf to deobfuscate)          |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|Suspicious|Dridex Strings      |Dridex-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+

[yoshimo]

Is there a reason why it is behind an extra option and isn't just decoded automatically?

[decalage2]

@yoshimo: this is because the deobfuscation algorithm is implemented using a partial VBA language parser built with pyparsing, and on some samples it may take a very long time to process. So it is optional until we find a much faster way to implement it.