added several improvements based on our tests: https://www.certego.ne…

[Gabriele-Pippi]

Following some internal tests carried out mainly olevba, we at Certego have decided to propose some improvements for your public project.

Although the article is public it has not yet been shared with anyone before you. https://www.certego.net/en/news/advanced-vba-macros

These are the results on the analyzed samples of olevba with this commit:

Document_ContentControlOnEnter.doc

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Document_ContentCont|Runs when the file is opened and ActiveX     |
|          |rolOnEnter          |objects trigger events                       |
|Suspicious|ControlPanelItem    |May run a dll                                |
|Suspicious|GetObject           |May get an OLE object with a running instance|
|Suspicious|CopyHere            |May copy a file                              |
+----------+--------------------+---------------------------------------------+

Worksheet_FollowHyperlink.xlsm

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Worksheet_FollowHype|Runs when the file is opened and ActiveX     |
|          |rlink               |objects trigger events                       |
|Suspicious|GetObject           |May get an OLE object with a running instance|
|Suspicious|InvokeVerbEx        |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|CopyHere            |May copy a file                              |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|Hex String|'\x00\x02\x08 '     |00020820                                     |
|Hex String|'\x00\x00\x00\x00\x0|000000000046                                 |
|          |0F'                 |                                             |
|Hex String|'\x00\x02\x08\x19'  |00020819                                     |
+----------+--------------------+---------------------------------------------+

Worksheet_Calculate.xlsm

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Worksheet_Calculate |May runs when an Excel WorkSheet is open     |
|Suspicious|GetObject           |May get an OLE object with a running instance|
|Suspicious|DoIt                |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|CopyHere            |May copy a file                              |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|Hex String|'\x00\x02\x08 '     |00020820                                     |
|Hex String|'\x00\x00\x00\x00\x0|000000000046                                 |
|          |0F'                 |                                             |
|Hex String|'\x00\x02\x08\x19'  |00020819                                     |
+----------+--------------------+---------------------------------------------+

[decalage2]

Great job! Reading your article, I would also add some CLSIDs like 13709620-C279-11CE-A49E-444553540000 as a synonym of Shell.Application.

[Gabriele-Pippi]

Great job! Reading your article, I would also add some CLSIDs like 13709620-C279-11CE-A49E-444553540000 as a synonym of Shell.Application.

Thanks to you for the great project that you are maintaining, we hope to collaborate again to improve it.

All the obfuscatable strings were not included in the pull request, feel free to add them as well.