Last active
August 10, 2020 18:51
-
-
Save michaelweber/7d89f01d04dc8174c4cb4bf4db525861 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule msxls_zloader_formula_ptg_ref_num_op_count | |
{ | |
meta: | |
description = "Finding XLS2003 documents with a large number of PtgRef->PtgNum->PtgOperator entries" | |
Author = "Michael Weber (@BouncyHat)" | |
strings: | |
$ole_marker = {D0 CF 11 E0 A1 B1 1A E1} | |
$ref_num_op_formula = { 06 00 ?? 00 ?? ?? ?? 00 0F [15] ?? 00 44 ?? ?? ?? ?? 1F ?? ?? ?? ?? ?? ?? ?? ( ?? | ?? 15 ) ( 01 | 02 | 03 | 04 | 05 | 06 | 07 ) } | |
condition: | |
$ole_marker at 0 and #ref_num_op_formula > 1000 | |
} |
Latest samples updated to handle multiple operators instead of just addition:
Formula[EQ42931]: GU16753-(781.39)
00000000 B2 A7 92 00 0F 00 85 EB 51 B8 1E 0B 86 C0 00 00 ²�?···?ëQ,··?A··
00000010 AF A7 92 FF 10 00 44 70 41 CA 00 1F 85 EB 51 B8 _�?ÿ··DpAE··?ëQ,
00000020 1E 6B 88 40 15 04 ·k?@··
Formula[BM42934]: GU16754-(376.32)
00000000 B5 A7 40 00 0F 00 85 EB 51 B8 1E F5 7B C0 00 00 µ�@···?ëQ,·o{A··
00000010 B2 A7 40 FF 10 00 44 71 41 CA 00 1F 85 EB 51 B8 ²�@ÿ··DqAE··?ëQ,
00000020 1E 85 77 40 15 04 ·?w@··
Formula[EQ42935]: GU16757-(783.26)
00000000 B6 A7 92 00 0F 00 AE 47 E1 7A 14 22 86 C0 00 00 ��?···rGáz·"?A··
00000010 B2 A7 92 FF 10 00 44 74 41 CA 00 1F AE 47 E1 7A ²�?ÿ··DtAE··rGáz
00000020 14 7A 88 40 15 04
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Based off of formula entries from 6fc69f553c079f20ec20e3e95eb342658dbeef6349acbe50578c550deb3d16b6: