{% load key_tags %} {% if file.office %} {% if file.mmbot %}

Malicious Macro Bot Results

{% for key, value in file.mmbot.items|dictsort:0 %} {% endfor %}
{{key}} {{value}}
{% endif %} {% if file.office.Metadata %} {% if file.office.Metadata.SummaryInformation %}

SummaryInformation Metadata

{% for key, value in file.office.Metadata.SummaryInformation.items|dictsort:0 %} {% endfor %}
{{key}} {{value}}
{% endif %} {% if file.office.Metadata.DocumentSummaryInformation %}

DocumentSummaryInformation Metadata

{% for key, value in file.office.Metadata.DocumentSummaryInformation.items|dictsort:0 %} {% endfor %}
{{key}} {{value}}
{% endif %} {% endif %} {% if file.office.Macro %} {% if file.office.Macro.Analysis %}

File Analysis (Signatures)

{% for detection in file.office.Macro.Analysis %}
{% for indicator, description in file.office.Macro.Analysis|getkey:detection %} {% endfor %}
{{detection}}
{{indicator}} {{description}}
{% endfor %}
{% endif %} {% if file.office.Macro.Code and not file.office.XLMMacroDeobfuscator %}

Extracted Macros

{% for macrodata in file.office.Macro.Code %} {% for name, code in file.office.Macro.Code|getkey:macrodata %}
VBA Filename {{name}} Extracted Macro 
{{code}}
{% endfor %} {% endfor %}
{% endif %} {% endif %} {% endif %} {% if file.office_rtf %}

RTF document details

{% for key, value in file.office_rtf.items %}
Object ID: {{key}}
{% for block in value %} {% if block.sha256 %} {% else %} {% endif %} {% endfor %} {% endfor %}
Filename Size Index Class Name Type Embed CVE
{{block.filename}}{{block.filename}}{{block.size}} {{block.index}} {{block.class_name}} {{block.type_embed}} {{block.CVE}}
{% endif %} {% if file.office_dde %}

DDE Detected

 {{file.office_dde}}
{% endif %}