1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
12 """Word analysis package."""
13
15 ms_office = os.path.join(os.getenv("ProgramFiles"), "Microsoft Office")
16 paths = [
17 os.path.join(ms_office, "WINWORD.EXE"),
18 os.path.join(ms_office, "Office11", "WINWORD.EXE"),
19 os.path.join(ms_office, "Office12", "WINWORD.EXE"),
20 os.path.join(ms_office, "Office14", "WINWORD.EXE"),
21 os.path.join(ms_office, "Office15", "WINWORD.EXE"),
22 os.path.join(ms_office, "WORDVIEW.EXE"),
23 os.path.join(ms_office, "Office11", "WORDVIEW.EXE")
24 ]
25
26 for path in paths:
27 if os.path.exists(path):
28 return path
29
30 return None
31
33 word = self.get_path()
34 if not word:
35 raise CuckooPackageError("Unable to find any Microsoft "
36 "Office Word executable available")
37
38 dll = self.options.get("dll", None)
39 free = self.options.get("free", False)
40 suspended = True
41 if free:
42 suspended = False
43
44 p = Process()
45 if not p.execute(path=word, args="\"%s\"" % path, suspended=suspended):
46 raise CuckooPackageError("Unable to execute initial Microsoft "
47 "Office Word process, analysis aborted")
48
49 if not free and suspended:
50 p.inject(dll)
51 p.resume()
52 return p.pid
53 else:
54 return None
55
58
60 if self.options.get("procmemdump", False):
61 for pid in self.pids:
62 p = Process(pid=pid)
63 p.dump_memory()
64
65 return True
66