search

decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.92k stars 563 forks source link

ValueError: bytes length not a multiple of item size #492

Open chchchchchchchch opened 5 years ago

chchchchchchchch commented 5 years ago

File "E:/project/MaliciousMacroBot-master/obfuscatedbot/vbasamplemongo/vbatomongo.py", line 70, in extracted_vba if vbaparser.detect_vba_macros(): File "C:\Users\chenlu\AppData\Local\Programs\Python\Python37\lib\site-packages\oletools\olevba.py", line 3077, in detect_vba_macros data = ole._open(d.isectStart, d.size).read() File "C:\Users\chenlu\AppData\Local\Programs\Python\Python37\lib\site-packages\olefile\olefile.py", line 1793, in _open self.loadminifat() File "C:\Users\chenlu\AppData\Local\Programs\Python\Python37\lib\site-packages\olefile\olefile.py", line 1608, in loadminifat self.minifat = self.sect2array(s) File "C:\Users\chenlu\AppData\Local\Programs\Python\Python37\lib\site-packages\olefile\olefile.py", line 1455, in sect2array a = array.array(UINT32, sect) ValueError: bytes length not a multiple of item size

decalage2 commented 5 years ago

Hi, could you please submit the sample file that triggers this error, so that I can reproduce the bug? It looks like the OLE file is malformed. Also, I will need to know which versions of olefile and oletools you are using. Thanks.

chchchchchchchch commented 5 years ago

Hi, could you please submit the sample file that triggers this error, so that I can reproduce the bug? It looks like the OLE file is malformed. Also, I will need to know which versions of olefile and oletools you are using. Thanks.

File/Malware sample to reproduce the bug:https://github.com/chchchchchchchch/project/blob/master/3206C441BC1F9403D751BAB812F29EF7 Version information: windows10 python version :3.7/ 64bits oletools version: 0.54.2

chchchchchchchch commented 5 years ago

File/Malware sample to reproduce the bug:https://github.com/chchchchchchchch/project/blob/master/3206C441BC1F9403D751BAB812F29EF7 Version information: windows10 python version :3.7/ 64bits oletools version: 0.54.2