diff --git a/oletools/olevba.py b/oletools/olevba.py index 52ffd512..49d78e28 100644 --- a/oletools/olevba.py +++ b/oletools/olevba.py @@ -3645,7 +3645,7 @@ def analyze_macros(self, show_decoded_strings=False, deobfuscate=False): log.debug('adding VBA stomping to suspicious keywords') keyword = 'VBA Stomping' description = 'VBA Stomping was detected: the VBA source code and P-code are different, '\ - 'this may have been used to hide malicious code' + 'this may have been used to hide malicious code (option --show-pcode to show disassembled P-code)' scanner.suspicious_keywords.append((keyword, description)) scanner.results.append(('Suspicious', keyword, description)) if self.contains_xlm_macros: