OfficePurge: VBA purges malicious Office documents

OfficePurge

VBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents. Documents that only contain source code and no compiled code are more likely to evade AV detection and YARA rules. Read more here.

OfficePurge supports VBA purging Microsoft Office Word (.doc), Excel (.xls), and Publisher (.pub) documents. Original and purged documents for each supported file type with a macro that will spawn calc.exe can be found in the sample-data folder.

Use

Example

Download

Copyright (C) 2020 Andrew Oliveau (@AndrewOliveau)