Yara rule - xlsm_with_xlm_macro

rule xlsm_with_xlm_macro{
		meta:
				description = "Finding XLSM files containing XLM macros"
				Author = "DissectMalware"
				Sample = "01558388b33abe05f25afb6e96b0c899221fe75b037c088fa60fe8bbf668f606"
		strings:
                $zip_marker = "PK"
                $xlsx_marker = {5B 43 6F 6E 74 65 6E 74 5F 54 79 70 65 73 5D 2E 78 6D 6C}
                $macrosheet_marker = {6D 61 63 72 6F 73 68 65 65 74 73}
        condition:
        		$zip_marker at 0 and $xlsx_marker and $macrosheet_marker
}