search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
570 stars 115 forks source link

Issue - 'XLSMWrapper' object has no attribute 'get_workbook_name' #96

Closed nikitah4x closed 2 years ago

nikitah4x commented 2 years ago

Hey, I'm running the XLM Deobfuscator on a xlsm file, and I've this issue [Loading Cells] auto_open: auto_open->Macro1!$A$1 auto_close: auto_close1->Macro1!$W$474 [Starting Deobfuscation] CELL:A39 , FullEvaluation , GOTO(B3) Error [deobfuscator.py:2562 evaluation_result = self.evaluate_parse_tree(current_cell, parse_tree, interactive)]: 'XLSMWrapper' object has no attribute 'get_workbook_name' CELL:W484 , FullEvaluation , FORMULA("=EXEC(""rundll32.exe C:/Users/Public/Microsoft.dll,Exec"")",W573) CELL:W573 , PartialEvaluation , =EXEC("rundll32.exe C:/Users/Public/Microsoft.dll,Exec") CELL:W574 , FullEvaluation , FORMULA("Done",W573)

Files:

[END of Deobfuscation] time elapsed: 0.1580219268798828

Can someone elaborate on this issue?

DissectMalware commented 2 years ago

I need to examine the file. Can you share the SHA256 of the file if it is on VirusTotal? If it is not there, can you upload it somewhere and share? You can send me a direct message on Twitter (https://twitter.com/DissectMalware)

nikitah4x commented 2 years ago

@DissectMalware I sent you a message on Twitter.

DissectMalware commented 2 years ago

The problem was that get_workbook_name function was not implemented in XLSMWrapper and XLSBWrapper.

Fixed in https://github.com/DissectMalware/XLMMacroDeobfuscator/commit/45d1cf4d5e028743b699adc234b2f9e6d3978753