This python based milter (mail-filter) checks an incoming mail for suspicious VBA macro code in MS 20xx Office attachments (doc, xls, ppt ...).
37
stars
14
forks
source link
RTF Files are being scanned, resulting in error #45
Open
hildeb opened 6 years ago
2018-06-06 09:40:38,733 - DEBUG: [197] Content-Type: 'multipart/mixed' 2018-06-06 09:40:38,733 - DEBUG: [197] Content-Type: 'multipart/alternative' 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'text/plain' 2018-06-06 09:40:38,734 - DEBUG: [197] Analyzing attachment: None 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'text/html' 2018-06-06 09:40:38,734 - DEBUG: [197] Analyzing attachment: None 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'application/msword' 2018-06-06 09:40:38,736 - DEBUG: [197] Analyzing attachment: '=?iso-8859-2?Q?name=FCr_AWMF.doc?=' 2018-06-06 09:40:38,751 - DEBUG: [197] The attachment '=?iso-8859-2?Q?name=FCr_AWMF.doc?=' is clean. 2018-06-06 09:40:38,751 - DEBUG: [197] Content-Type: 'application/rtf' 2018-06-06 09:40:38,752 - DEBUG: [197] Analyzing attachment: '=?iso-8859-2?Q?LL-othername=FCr_AWMF.rtf?=' 2018-06-06 09:40:38,753 - ERROR: [197] Error while processing the message 2018-06-06 09:40:38,754 - DEBUG: [197] Exeption code: [!! Traceback (most recent call last): !! File "/usr/bin/macromilter.py", line 295, in checkforVBA vba_parser = olevba.VBA_Parser(filename='message', data=attachment) !! File "/usr/local/lib/python2.7/dist-packages/oletools/olevba.py", line 2385, in init raise FileOpenError(msg) !! FileOpenError: Failed to open file message is RTF, need to run rtfobj.py and find VBA Macros in its output. ]