modules.processing.static.OfficeDocument

Package modules :: Package processing :: Module static :: Class OfficeDocument |
[hide private]
[frames] | no frames]

# Class OfficeDocument

source code

    object --+
             |
            OfficeDocument

Static analysis of Microsoft Office documents.

Instance Methods | [hide private]
__init__(self, filepath) x.__init__(...) initializes x; see help(type(x)) for signature | source code
get_macros(self) Get embedded Macros if this is an Office document. | source code
deobfuscate(self, code) Bruteforce approach of regex-based deobfuscation. | source code
unpack_docx(self) Unpacks .docx-based zip files. | source code
extract_eps(self) Extract some information from Encapsulated Post Script files. | source code
run(self) | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| deobf = `[["\\\"(?P<a>.*?)\\\"\\s+\\&\\s+\\\"(?P<b>.*?)\\\"", l`...``
| eps_comments = `"\\(([\\w\\s]+)\\)"`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, filepath) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Overrides: object.__init__ (inherited documentation)

Class Variable Details | [hide private]

  ### deobf Value:
      [["\\\"(?P<a>.*?)\\\"\\s+\\&\\s+\\\"(?P<b>.*?)\\\"", lambda x: '"%s%s"
      ' %(x.group("a"), x.group("b")), 0,],]