Support office documents and check for macros

[wichmannpas]

[IV1T3]

• Analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging: https://github.com/decalage2/oletools
• Remove active content (scripts, macros, etc): https://github.com/decalage2/exefilter
  • Since oletools does not support input modification, decalge2 recommended exefilter: Is oletools has the ability to remove macro from the malicious document? decalage2/oletools#377

[IV1T3]

Started analyzing with commit 6509f41

[IV1T3]

Automatic (Malicious) Macro detection implemented with quicksand in commit 3254923. However, Macro removal still has to be implemented.

[IV1T3]

Added multiple YARA rules for detecting Office Documents with Macros.

A few selected rules:

• rule office_document_vba : maldoc
• Contains_VBA_macro_code (Detect a MS Office document with embedded VBA macro code - by evild3ad)
• rule macrocheck : maldoc (Identify office documents with the MACROCHECK credential stealer in them. - by Fireeye Labs)
• rule Contains_hidden_PE_File_inside_a_sequence_of_numbers : maldoc (https://www.welivesecurity.com/2016/01/04/blackenergy-trojan-strikes-again-attacks-ukrainian-electric-power-industry/ - by evild3ad)