Rajesh,
I don't use it but wouldn't it be easy to apply?
# wget -O
/usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/OLEMacro.pm
https://raw.githubusercontent.com/fmbla/spamassassin-olemacro/master/OLEMacro.pm
# chmod 444
/usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/OLEMacro.pm
Add the below line to /etc/spamassassin/local.cf
loadplugin Mail::SpamAssassin::Plugin::OLEMacro
# spamassassin --lint -D &> sadump.txt
search sadump.txt for OLEMacro
Eric
------ Original Message ------
From: "Rajesh M" <24x7ser...@24x7server.net>
To: qmailtoaster-list@qmailtoaster.com
Sent: 8/4/2017 10:57:35 PM
Subject: [qmailtoaster] detect macros in ms documents
hi
there are rising number of incidences with ms .doc and .xls being
transmitted with embedded macro virus
i found a tool here which will detect such files containing macro virus
and mark them as spam
https://github.com/fmbla/spamassassin-olemacro/blob/master/OLEMacro.pm
i dont wish rely on antivirus -- in the last incident sophos, kaspersky
(i am seeing it fail for the first time) and clam did not detect it.
does anybody use the above spamassassin module or something equivalent
?
rajesh
