DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 115 forks source link

Update xlsm_wrapper.py #5

Closed JohnLaTwC closed 4 years ago

JohnLaTwC commented 4 years ago

Fix copy paste error in bracket definition.

This happens because deobfuscator calls get_xl_international_char with XlApplicationInternational.xlRightBracket which is not defined and hence None is returned. It is a copy paste error at root cause.

file 1ee9a96b6222caebab404023dabf34309362fa2ef54b1209f75086fd12911a23

Traceback (most recent call last): File "deobfuscator.py", line 542, in interpreter = XLMInterpreter(excel_doc) File "deobfuscator.py", line 30, in init self.xlm_parser = self.get_parser() File "deobfuscator.py", line 63, in get_parser XlApplicationInternational.xlRightBracket)) TypeError: replace() argument 2 must be str, not None