-
Notifications
You must be signed in to change notification settings - Fork 586
Description
Affected tool:
olevba
Describe the bug
With a specific document the olevba.analyze_macros() raise a exception in line 3413 and/or 3735 because vba_code is bytes.
Line 3413 in 0286347
self.vba_code_all_modules += vba_code + '\n' |
Line 3735 in 0286347
vba_code_all_modules += vba_code + '\n' |
File/Malware sample to reproduce the bug
https://www.virustotal.com/gui/file/1e6d72e0cbe34cf8e016857317b9f98050f492c3098971644ccef8b6c7db77c8/details
It's malware. If you want the file you can contact me.
How To Reproduce the bug
Extract macros with olevba:
vbaparser = VBA_Parser(file_path) if vbaparser: if vbaparser.detect_vba_macros(): vbaparser.analyze_macros()
Version information:
- Ubuntu 16.04 64 bits
- Python 3.8 64 bits
- oletools version: 0.55.1
Additional context
I've solved the error decoding bytes to string if it's instance of bytes in line 3359.
Line 3359 in 0286347
# TODO vba_code = self.encode_string(vba_code) |
Solved with:
if isinstance(vba_code, bytes): vba_code = bytes2str(vba_code)