OfficePurge

VBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents. Documents that only contain source code and no compiled code are more likely to evade AV detection and YARA rules. Read more here.

OfficePurge supports VBA purging Microsoft Office Word (.doc), Excel (.xls), and Publisher (.pub) documents. Original and purged documents for each supported file type with a macro that will spawn calc.exe can be found in sample-data folder.

Author: Andrew Oliveau (@AndrewOliveau)

INSTALLATION/BUILDING

Pre-Compiled

• Use the pre-compiled binary in the Releases section

Building Yourself

Take the below steps to setup Visual Studio in order to compile the project yourself. This requires a couple of .NET libraries that can be installed from the NuGet package manager.

Libraries Used

The below 3rd party libraries are used in this project.

Steps to Build

• This project requires .NET framework 4.7
• Load the Visual Studio project up and go to "Tools" --> "NuGet Package Manager" --> "Package Manager Settings"
• Go to "NuGet Package Manager" --> "Package Sources"
• Add a package source with the URL "https://api.nuget.org/v3/index.json"
• Install the Costura.Fody NuGet package. The older version of Costura.Fody (3.3.3) is needed, so that you do not need Visual Studio 2019.
  • Install-Package Costura.Fody -Version 3.3.3
• Install OpenMcdf to manipulate Microsoft Compound Document Files. OpenMcdf version (2.2.1.3) is needed so that the current code works correctly.
  • Install-Package OpenMcdf -Version 2.2.1.3
• Install Fody
  • Install-Package Fody -Version 4.0.2
• You can now modify and build the project yourself!

ARGUMENTS/OPTIONS

• -d - Document type to VBA purge (word, excel, publisher)
• -f - Document filename to VBA purge
• -m - Module within document to VBA purge (ex. Module1)
• -l - List modules in a document
• -h - Show help menu

EXAMPLES

• OfficePurge.exe -d word -f .\malicious.doc -m NewMacros
• OfficePurge.exe -d excel -f .\payroll.xls -m Module1
• OfficePurge.exe -d publisher -f .\donuts.pub -m ThisDocument
• OfficePurge.exe -d word -f .\malicious.doc -l

REFERENCES

• Didier Steven's VBA purging article here
• EvilClippy for parts of code here