search

decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.05k stars 186 forks source link

Cannot read document variables #44

Open thansau239 opened 6 years ago

thansau239 commented 6 years ago

Describe the bug ERROR Cannot read document variables. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read custom doc properties. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read document text from 1b2a9b3e9405c55a6b4d48bb77226c53. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read form strings. 'VBA_Parser' object has no attribute 'extract

Desktop (please complete the following information):

Additional context

Module None Sub CgCydi ([wUtzAWZ as Integer]): 13 statement(s) Sub YNTfFJ ([lmCgoO as String, OZLWlnM as Boolean, vVFKdxx as Boolean, DpvoKQas String, SncUfb as Boolean]): 13 statement(s) Function vwjVsi ([PRbGUQ as String, AHUOzN as Boolean]): 14 statement(s)

ERROR Cannot read document variables. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read custom doc properties. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read document text from 1b2a9b3e9405c55a6b4d48bb77226c53. [Errno 2] No such file or directory: '1b2a9b3e9405c55a6b4d48bb77226c53' ERROR Cannot read form strings. 'VBA_Parser' object has no attribute 'extract _form_strings_extended' Traceback (most recent call last): File "c:\Python27\lib\site-packages\vipermonkey-0.7-py2.7.egg\vipermonkey\vmonkey.py", line 773, in process_file for (subfilename, stream_path, form_variables) in vba.extract_form_strings_extended(): AttributeError: 'VBA_Parser' object has no attribute 'extract_form_strings_extended' Traceback (most recent call last): File "c:\Python27\lib\site-packages\vipermonkey-0.7-py2.7.egg\vipermonkey\vmonkey.py", line 828, in process_file raise e AttributeError: 'VBA_Parser' object has no attribute 'extract_form_strings_extended'

decalage2 commented 6 years ago

Hi, could you please share the sample file that triggered this error?

thansau239 commented 6 years ago

Hi @decalage2 Please check it https://www.virustotal.com/#/file/8c69eb54976e04898fc2f17867464e4468c77901a4fd70a8ba7b80ed486f50df/details

kirk-sayre-work commented 5 years ago

Try the dev fork of ViperMonkey @ https://github.com/kirk-sayre-work/ViperMonkey . The dev version of ViperMonkey process this file correctly on my machine. Can you please verify on your end?