Skip to content

ScanDocx

Collects metadata and extracts text from docx files.

Options

extract_text: Boolean that determines if document text should be extracted as a child file. Defaults to False.

Source code in strelka/src/python/strelka/scanners/scan_docx.py 
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
class ScanDocx(strelka.Scanner):
    """Collects metadata and extracts text from docx files.

    Options:
        extract_text: Boolean that determines if document text should be
            extracted as a child file.
            Defaults to False.
    """

    def scan(self, data, file, options, expire_at):
        extract_text = options.get("extract_text", False)
        with io.BytesIO(data) as docx_io:
            try:
                docx_doc = docx.Document(docx_io)
                self.event["author"] = docx_doc.core_properties.author
                self.event["category"] = docx_doc.core_properties.category
                self.event["comments"] = docx_doc.core_properties.comments
                self.event["content_status"] = docx_doc.core_properties.content_status
                if docx_doc.core_properties.created is not None:
                    self.event["created"] = docx_doc.core_properties.created.isoformat()
                self.event["identifier"] = docx_doc.core_properties.identifier
                self.event["keywords"] = docx_doc.core_properties.keywords
                self.event["language"] = docx_doc.core_properties.language
                self.event["last_modified_by"] = (
                    docx_doc.core_properties.last_modified_by
                )
                if docx_doc.core_properties.last_printed is not None:
                    self.event["last_printed"] = (
                        docx_doc.core_properties.last_printed.isoformat()
                    )
                if docx_doc.core_properties.modified is not None:
                    self.event["modified"] = (
                        docx_doc.core_properties.modified.isoformat()
                    )
                self.event["revision"] = docx_doc.core_properties.revision
                self.event["subject"] = docx_doc.core_properties.subject
                self.event["title"] = docx_doc.core_properties.title
                self.event["version"] = docx_doc.core_properties.version
                self.event["font_colors"] = [""]
                self.event["word_count"] = 0
                self.event["image_count"] = 0

                for paragraph in docx_doc.paragraphs:
                    soup = BeautifulSoup(paragraph.paragraph_format.element.xml, "xml")
                    color_list = soup.select("color")

                    for color_xml in color_list:
                        color = color_xml.attrs["w:val"]
                        if color not in self.event["font_colors"]:
                            self.event["font_colors"].append(color)

                    image_list = soup.select("pic")

                    for images in image_list:
                        if images.attrs["xmlns:pic"]:
                            self.event["image_count"] += 1

                    para_words = paragraph.text.split(" ")

                    if "" not in para_words:
                        self.event["word_count"] += len(para_words)

                if "FFFFFF" in self.event["font_colors"]:
                    self.event["white_text_in_doc"] = True

                if extract_text:
                    text = ""
                    for paragraph in docx_doc.paragraphs:
                        text += f"{paragraph.text}\n"

                    # Send extracted file back to Strelka
                    self.emit_file(text.encode("utf-8"), name="text")

            except ValueError:
                self.flags.append("value_error")
            except zipfile.BadZipFile:
                self.flags.append("bad_zip")
            except strelka.ScannerTimeout:
                raise
            except Exception:
                self.flags.append("bad_doc")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature
Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype
Include / Exclude
application/vnd.openxmlformats-officedocument.wordprocessingml.document

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name
Field Type
author
str
category
str
comments
str
content_status
str
created
str
elapsed
str
flags
list
font_colors
list
identifier
str
image_count
int
keywords
str
language
str
last_modified_by
str
modified
str
revision
int
subject
str
title
str
version
str
word_count
int

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "author": "Ryan.OHoro",
        "category": "",
        "comments": "",
        "content_status": "",
        "created": "2022-12-16T16:28:00",
        "identifier": "",
        "keywords": "",
        "language": "",
        "last_modified_by": "Ryan.OHoro",
        "modified": "2022-12-16T16:44:00",
        "revision": 2,
        "subject": "",
        "title": "",
        "version": "",
        "font_colors": ["", "000000"],
        "word_count": 413,
        "image_count": 1,
    }