+------------------------------------------+
| OfficeMalScanner v0.61 |
| Frank Boldewin / www.reconstructer.org |
+------------------------------------------+
Usage:
--------
OfficeMalScanner <PPT, DOC or XLS file> <scan | info> <brute> <debug>
Options:
scan - scan for several shellcode heuristics and encrypted PE-Files
info - dumps OLE structures, offsets+length and saves found VB-Macro code
inflate - decompresses Ms Office 2007 documents, e.g. docx, into a temp dir
Switches: (only enabled if option "scan" was selected)
brute - enables the "brute force mode" to find encrypted stuff
debug - prints out disassembly resp hexoutput if a heuristic was found
If you use ubuntu with wine on it then type following command in terminal "wine cmd.exe" to reach a window prompt from where you can run OfficeMalScanner
OfficeMalScanner Output
 |
| OfficeMalScanner in Scan Mode |
 |
| OfficeMalScanner in Scan and Brute Mode |
 |
| OfficeMalScanner in Info Mode |
 |
| OfficeMalScanner in Scan ,Debug Mode |
Click Here to download test.doc
Comments
Post a Comment