olevba - Add support for MHT files with macros

[decalage2]

Originally reported by: Philippe Lagadec (Bitbucket: decalage, GitHub: decalage2)

---

Greg (from SpamStopsHere) reported several recent malicious samples using the MHT format (MIME HTML), running VBA macros when opened in Word:

• https://malwr.com/analysis/NTYzYTgxYTQwZmNiNDgzNjk3ZGRhOGE3OTE5N2UxNzc/
• https://malwr.com/analysis/ZTljNDVhOGQ1NWQ3NDRmYmI1MDJjMjY0ZjI3ZGQwOWQ/
• http://blog.malwaretracker.com/2013/08/cve-2012-0158-exploit-evades-av-in-mime.html

These MHT files can be created from Word, using the format "Single File Web Page - .mht (MHTML)". The resulting file is a MIME container, similar to an e-mail. It contains several files as attachements, including the Word document in XML format.

By default, MHT files are opened by Internet Explorer, which does not run macros. But if the file is renamed to ".doc", it will be opened in Word and macros can run as if it was a normal Word document.

If VBA macros are present, they are attached as a binary file named "editdata.mso", encoded in Base 64. This looks very similar to the Word 2003 XML format, already supported by olevba.

It should then be straightforward to add support for MHT files with VBA macros.

---

• Bitbucket: https://bitbucket.org/decalage/oletools/issue/10

[decalage2]

Original comment by Philippe Lagadec (Bitbucket: decalage, GitHub: decalage2):

---

added support for Word MHTML files with macros (Single File Web Page), fixed issue #10