DissectMalware/XLMMacroDeobfuscator

Problem handling a defined name to a value in XLSM

DissectMalware opened this issue · 1 comments

Sample: 61005CAB010BDE9798CB5C7EE05497C08BA71D638644F05A1B5E58C8EAC67CA1

fff=REGISTER.ID("She"&"ll32","Shel"&"lExe"&"cuteA","JJC"&"CCJJ")

the formula does not starts with = sign and causes problem

Such a formula has a bx attribute

image

To fix this, the code is rewritten with SET.NAME

SET.NAME("fff",REGISTER.ID("She"&"ll32","Shel"&"lExe"&"cuteA","JJC"&"CCJJ"))