oledump.plugin_biff error #428
Description
Affected tool:
olevba
Running olevba on an xls with Excel 4 macro results in the following error:
malware hash - 4c6ec69af9dfb446273a38be73be83a613018b1b6a64ab1386cc798637a63832
olevba 0.54.1 on Python 2.7.16 - http://decalage.info/python/oletools
===============================================================================
FILE: 4c6ec69af9dfb446273a38be73be83a613018b1b6a64ab1386cc798637a63832.xls
Type: OLE
ERROR Error when running oledump.plugin_biff, please report to https://github.com/decalage2/oletools/issues
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/oletools/olevba.py", line 3106, in detect_xlm_macros
self.xlm_macros = biff_plugin.Analyze()
File "/usr/local/lib/python2.7/dist-packages/oletools/thirdparty/oledump/plugin_biff.py", line 1008, in Analyze
strings += ' '.join(values[0])
TypeError: sequence item 0: expected string, bytearray found
No VBA macros found.
Version information:
- OS: Linux
- OS version: Kali 64 bit
- Python version: 2.7.16
- oletools version: 0.54