search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 116 forks source link

[Loading Cells] Error [deobfuscator.py:3195 process_file(**vars(args))]: #117

Open Hellfire0x01 opened 1 year ago

Hellfire0x01 commented 1 year ago

Hi,

When I am running the tool to analyze the research-1646684671.xls file, I am getting this error. I have attached the link of the image below.

image

SHA256 of research-1646684671.xls - 1df68d55968bb9d2db4d0d18155188a03a442850ff543c8595166ac6987df820

The sample is also present on VirusTotal.

Any idea why is this happening? Or any way to work around? Thanks for your time.

Kind Regards, Hellfire0x01

Anonymous4717 commented 1 year ago

Hi,

When I am running the tool to analyze the research-1646684671.xls file, I am getting this error. I have attached the link of the image below.

image

SHA256 of research-1646684671.xls - 1df68d55968bb9d2db4d0d18155188a03a442850ff543c8595166ac6987df820

The sample is also present on VirusTotal.

Any idea why is this happening? Or any way to work around? Thanks for your time.

Kind Regards, Hellfire0x01

first, edit the formual.py with sudo nano or whatever find assert bv >= 80 #### this function needs updating #### and chnage it to assert bv >= 70 and then run the tool with sudo

Hellfire0x01 commented 1 year ago

Hi, When I am running the tool to analyze the research-1646684671.xls file, I am getting this error. I have attached the link of the image below. image SHA256 of research-1646684671.xls - 1df68d55968bb9d2db4d0d18155188a03a442850ff543c8595166ac6987df820 The sample is also present on VirusTotal. Any idea why is this happening? Or any way to work around? Thanks for your time. Kind Regards, Hellfire0x01

first, edit the formual.py with sudo nano or whatever find assert bv >= 80 #### this function needs updating #### and chnage it to assert bv >= 70 and then run the tool with sudo

Hello there, hope you are well. Thanks for responding back, but I can't find the formual.py file. Can you provide the full path for this file? I cannot find it in the package, even after installing it.

Kind Regards, Hellfire0x01

eugeneewe commented 11 months ago

Facing the same issue like yours, you may get the formula.py from Filepath: '/usr/local/lib/python3.9/dist-package/xlrd2/formula.py' Please use your own python version that available.

Find assert bv >= 80 #### this function needs updating #### and change it to assert bv >= 70 and then run the tool with sudo.

image

Hellfire0x01 commented 11 months ago

Facing the same issue like yours, you may get the formula.py from Filepath: '/usr/local/lib/python3.9/dist-package/xlrd2/formula.py' Please use your own python version that available.

Find assert bv >= 80 #### this function needs updating #### and change it to assert bv >= 70 and then run the tool with sudo.

image

It worked like a charm! But literally, I want to know how does this changing value of assert bv impacts the working of the tool? Thank you very much.

Kind Regards, H.