search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 116 forks source link

unsupported operand type(s) for +: 'Boundsheet' and 'str' #75

Open Beercow opened 3 years ago

Beercow commented 3 years ago

[Loading Cells] auto_open: auto_open->'handling'!$C$84 [Starting Deobfuscation] CELL:C84 , FullEvaluation , SET.NAME(activated,0) CELL:C86 , FullEvaluation , -1496 CELL:C88 , FullEvaluation , WHILE(activated<32.0) -> [True] CELL:C91 , FullEvaluation , SET.NAME(cottages,-1) CELL:C92 , FullEvaluation , SET.NAME(activated,1) CELL:C94 , FullEvaluation , SET.NAME(qualities,) CELL:C95 , FullEvaluation , WHILE(cottages<225.0) -> [True] CELL:C98 , FullEvaluation , SET.NAME(cottages,0) Error [deobfuscator.py:2407 evaluation_result = self.evaluate_parse_tree(current_cell, parse_tree, interactive)]: unsupported operand type(s) for +: 'Boundsheet' and 'str'

Hash of File: 16216501ce582e0a109f0b5546c4d498dbebfcdaa0723c99b5a3267f3b928c1f

DissectMalware commented 3 years ago

Thank you for the sample,

I added INDIRECT and ABSREF functions. Also, I fixed a few bugs.

So far, we have:

image

It still needs more work.