DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 115 forks source link

Error: 'XLMInterpreter' object has no attribute 'parse_cell_address' #62

Closed rsaccani closed 3 years ago

rsaccani commented 3 years ago

By testing the attached sample, I get the following output:

Unencrypted xls file

[Loading Cells]
auto_open: auto_open->JsccwgbH!$B$138
[Starting Deobfuscation]
CELL:B162      , FullEvaluation      , http://SET.NAME("icWgeRooj",0)
CELL:B164      , FullEvaluation      , http://SET.NAME("dMblbtttKW",Sheet1$D$71:$D$109)
CELL:B168      , FullEvaluation      , http://SET.NAME("bdsUCc",$K$82:$K$91)
CELL:B171      , FullEvaluation      , http://SET.NAME("WBxfacTAO",179)
CELL:B173      , FullEvaluation      , http://SET.NAME("NmoxdYQdrueS",2)
Error: 'XLMInterpreter' object has no attribute 'parse_cell_address'
[END of Deobfuscation]
time elapsed: 0.08484935760498047

Sample: excel4weird.zip

DissectMalware commented 3 years ago

Please update from the master branch. The problem is now resolved in the latest commit.

pip install -U https://github.com/DissectMalware/xlrd2/archive/master.zip pip install -U https://github.com/DissectMalware/pyxlsb2/archive/master.zip pip install -U https://github.com/DissectMalware/XLMMacroDeobfuscator/archive/master.zip

image