You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Running olevba on this file yields an error in PCODE extraction wherein the tool tries to access a file it cannot find. A workaround is to simply extract the file before executing olevba, which results in successful extraction of PCODE.
Additionally, running olevba with loglevel debug yields the expected PCODE.
(Will attach as well, zip password is "threat") How To Reproduce the bug
Run:
olevba [samplename]
Result:
Mac:
[Errno 2] No such file or directory: 'word\vbaProject.bin'.
Windows:
Error: [Errno 2] No such file or directory: 'word/vbaProject.bin'.
Run:
7z [samplename]
olevba [samplename]
Result:
correct output here, including full pcodedmp
Expected behavior
olevba [samplenamehere] results in full PCODE dump for stomped sample instead of shell error regarding missing file.
Version information:
OS: Mac
OS version: 10.14.6
Python version: 2.7/3.6 - 32/64 bits -> Both!
oletools version: 0.55.1
Also confirmed on Windows, same Python/oletools versions.
Additional context
I think this is due to the file being OOXML XML format. But OLETOOLS is a huge project and I have not been able to identify where in the code this issue exists.
The text was updated successfully, but these errors were encountered:
Affected tool:
olevba
Describe the bug
Running olevba on this file yields an error in PCODE extraction wherein the tool tries to access a file it cannot find. A workaround is to simply extract the file before executing olevba, which results in successful extraction of PCODE.
Additionally, running olevba with loglevel debug yields the expected PCODE.
File/Malware sample to reproduce the bug
Sample: https://www.virustotal.com/gui/file/7631858874171fe3d76b954d5f8d7c458472a35907f6085cf6ab5e380ca418cd/detection
(Will attach as well, zip password is "threat")
How To Reproduce the bug
Run:
olevba [samplename]
Result:
Mac:
Windows:
Run:
7z [samplename]
olevba [samplename]
Result:
correct output here, including full pcodedmp
Expected behavior
olevba [samplenamehere] results in full PCODE dump for stomped sample instead of shell error regarding missing file.
Version information:
Also confirmed on Windows, same Python/oletools versions.
Additional context
I think this is due to the file being OOXML XML format. But OLETOOLS is a huge project and I have not been able to identify where in the code this issue exists.
The text was updated successfully, but these errors were encountered: