Last week I researched how to detect signed VBA code in Word .doc files. For .docm files, it's easier. .docx and .docm files are actually ZIP files, and a .docm file (Word document with VBA macros) contains file vbaProjectSignature.bin when the VBA code is signed.
Didier Stevens |
DidierStevens 520 Posts ISC Handler Feb 18th 2018 |
Thread locked Subscribe |
Feb 18th 2018 2 years ago |
Sign Up for Free or Log In to start participating in the conversation!