decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.92k stars 563 forks source link

OLEVBA: VBA Stomping false positive #533

Open SystemsModelling opened 4 years ago

SystemsModelling commented 4 years ago

olevba, Windows 10. Files from https://ww3.arb.ca.gov/fuels/lcfs/ca-greet/ca-greet.htm show VBA Stomping. Could that be right? The VBA is password protected; I forget which oletool shows the password to open it.

It also starts by saying no vbaProject.bin then finds it.

F:\DOCS\Documents\Downloads>olevba ca-greet30-corrected.xlsm | more
olevba 0.55.1 on Python 3.7.4 - http://decalage.info/python/oletools
===============================================================================
FILE: ca-greet30-corrected.xlsm
Type: OpenXML
Error: [Errno 2] No such file or directory: 'xl/vbaProject.bin'.
-------------------------------------------------------------------------------
VBA MACRO Sheet2.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Sheet31.cls
in file: xl/vbaProject.bin - OLE stream: 'VBA/Sheet31'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

By the way .. I had been looking at a 2.0 version and got compile errors which gave weird errors, such as when trying to expand a sheet in the Debug Window, I get a dialog "Choose Profile" with default "Outlook". Let me know if you'd like me to email that to you.

SystemsModelling commented 4 years ago

Sorry, no idea why the big font appears.

mschoettle commented 4 years ago

I used a script that calls VBA_Parser.extract_all_macros() (see here) and get the same error (Error: [Errno 2] No such file or directory: 'xl/vbaProject.bin'.) when it parses a .xlsm file on OSX (although I haven't tried it with other files).

It still parses the file fine though.

ADSWNJ commented 4 years ago

Checking in on this issue. Looks like a spurious message to me, but nevertheless is forcing me to an older version to clean it up.

Any sign of a fix?