search

CYB3RMX / Qu1cksc0pe

All-in-One malware analysis tool.
GNU General Public License v3.0
1.33k stars 186 forks source link

qu1ckSc0pe's nonExecAnalyzer module fails VBA Macro retrieval #15

Closed patriciamespert closed 2 years ago

patriciamespert commented 2 years ago

When executing qu1cksc0pe in order to analyze document files (--doc argument) qu1cksc0pe's nonExecAnalyzer module is used to initiate VBA Macro retrieval.

Problem gets here https://github.com/CYB3RMX/Qu1cksc0pe/blob/6ca111c5df3e1f4873e5fd26bb1b5ec911e8365e/Modules/nonExecAnalyzer.py#L50

Once olevba tool gets instantiated as vbaparser a non existing property (contains_macros) gets called causing an Exception therefore get this error "An error occured while parsing that file for macro scan" Solution seems to replace contains_macro by contains_vba_macros.

This is the final output (once the problem is solved) issue

CYB3RMX commented 2 years ago

Hello. Thank you for suggestions! It will be fixed A.S.A.P.