Need help with OfficePurge?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

mandiant
209 Stars 48 Forks Apache License 2.0 7 Commits 2 Opened issues

Services available

!
?

Need anything else?

Contributors list

OfficePurge

VBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents. Documents that only contain source code and no compiled code are more likely to evade AV detection and YARA rules. Read more here.

OfficePurge supports VBA purging Microsoft Office Word (.doc), Excel (.xls), and Publisher (.pub) documents. Original and purged documents for each supported file type with a macro that will spawn calc.exe can be found in

sample-data
folder.

Author: Andrew Oliveau (@AndrewOliveau)

INSTALLATION/BUILDING

Pre-Compiled

  • Use the pre-compiled binary in the Releases section

Building Yourself

Take the below steps to setup Visual Studio in order to compile the project yourself. This requires a couple of .NET libraries that can be installed from the NuGet package manager.

Libraries Used

The below 3rd party libraries are used in this project.

| Library | URL | License | | ------------- | ------------- | ------------- | | OpenMCDF | https://github.com/ironfede/openmcdf | MPL-2.0 License | | Fody | https://github.com/Fody/Fody | MIT License | | Kavod.Vba.Compression | https://github.com/rossknudsen/Kavod.Vba.Compression | MIT License |

Steps to Build

  • This project requires .NET framework 4.7
  • Load the Visual Studio project up and go to "Tools" --> "NuGet Package Manager" --> "Package Manager Settings"
  • Go to "NuGet Package Manager" --> "Package Sources"
  • Add a package source with the URL "https://api.nuget.org/v3/index.json"
  • Install the Costura.Fody NuGet package. The older version of Costura.Fody (3.3.3) is needed, so that you do not need Visual Studio 2019.
    • Install-Package Costura.Fody -Version 3.3.3
  • Install OpenMcdf to manipulate Microsoft Compound Document Files. OpenMcdf version (2.2.1.3) is needed so that the current code works correctly.
    • Install-Package OpenMcdf -Version 2.2.1.3
  • Install Fody
    • Install-Package Fody -Version 4.0.2
  • You can now modify and build the project yourself!

ARGUMENTS/OPTIONS

  • -d - Document type to VBA purge (word, excel, publisher)
  • -f - Document filename to VBA purge
  • -m - Module within document to VBA purge (ex. Module1)
  • -l - List modules in a document
  • -h - Show help menu

EXAMPLES

  • OfficePurge.exe -d word -f .\malicious.doc -m NewMacros
  • OfficePurge.exe -d excel -f .\payroll.xls -m Module1
  • OfficePurge.exe -d publisher -f .\donuts.pub -m ThisDocument
  • OfficePurge.exe -d word -f .\malicious.doc -l

REFERENCES

  • Didier Steven's VBA purging article here
  • EvilClippy for parts of code here

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.