olevba: error 'NoneType' object has no attribute 'splitlines' #629
Description
error triggered by olevba 0.56.1.dev1 on Win10 both with Python 3.8.3 or Python 2.7.14, with this sample:
https://labs.inquest.net/dfi/hash/2bfb95bc1e1ff7801796cfb8c1047feebfd8576b8496030cd559d5bac804c9bb
https://www.virustotal.com/gui/file/2bfb95bc1e1ff7801796cfb8c1047feebfd8576b8496030cd559d5bac804c9bb
From this tweet: https://mobile.twitter.com/JohnLaTwC/status/1312433855056416768
First we get this error:
ERROR VBA code returned by extract_all_macros is not a string
Then this:
Traceback (most recent call last):
File "\Users\u\dev\oletools\oletools\olevba.py", line 4032, in process_file
vba_code_filtered = filter_vba(vba_code)
File "\Users\u\dev\oletools\oletools\olevba.py", line 2136, in filter_vba
vba_lines = vba_code.splitlines()
AttributeError: 'NoneType' object has no attribute 'splitlines'
ERROR Error processing file 2bfb95bc1e1ff7801796cfb8c1047feebfd8576b8496030cd559d5bac804c9bb ('NoneType' object has no attribute 'splitlines')!
So somewhere a function returns None instead of a string for the VBA code.
Interestingly, if I scan it with olevba 0.55.2, I get a different error, and the analysis continues with an empty macro and just P-code:
ValueError: CompressedChunkSize != 4098 but CompressedChunkFlag == 0