1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
11
13 """Excel analysis package."""
14
16 office = os.path.join(os.getenv("ProgramFiles"), "Microsoft Office")
17 paths = [
18 os.path.join(office, "EXCEL.EXE"),
19 os.path.join(office, "Office11", "EXCEL.EXE"),
20 os.path.join(office, "Office12", "EXCEL.EXE"),
21 os.path.join(office, "Office14", "EXCEL.EXE"),
22 os.path.join(office, "Office15", "EXCEL.EXE"),
23 ]
24
25 for path in paths:
26 if os.path.exists(path):
27 return path
28
29 return None
30
32 excel = self.get_path()
33 if not excel:
34 raise CuckooPackageError("Unable to find any Microsoft "
35 "Office Excel executable available")
36
37 dll = self.options.get("dll", None)
38 free = self.options.get("free", False)
39 suspended = True
40 if free:
41 suspended = False
42
43 p = Process()
44 if not p.execute(path=excel, args="\"%s\"" % path, suspended=suspended):
45 raise CuckooPackageError("Unable to execute initial Microsoft "
46 "Office Excel process, analysis aborted")
47
48 if not free and suspended:
49 p.inject(dll)
50 p.resume()
51 return p.pid
52 else:
53 return None
54
57
59 if self.options.get("procmemdump", False):
60 for pid in self.pids:
61 p = Process(pid=pid)
62 p.dump_memory()
63
64 return True
65