search

sbidy / MacroMilter

This python based milter (mail-filter) checks an incoming mail for suspicious VBA macro code in MS 20xx Office attachments (doc, xls, ppt ...).
MIT License
37 stars 14 forks source link

RTF Files are being scanned, resulting in error #45

Open hildeb opened 6 years ago

hildeb commented 6 years ago

2018-06-06 09:40:38,733 - DEBUG: [197] Content-Type: 'multipart/mixed' 2018-06-06 09:40:38,733 - DEBUG: [197] Content-Type: 'multipart/alternative' 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'text/plain' 2018-06-06 09:40:38,734 - DEBUG: [197] Analyzing attachment: None 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'text/html' 2018-06-06 09:40:38,734 - DEBUG: [197] Analyzing attachment: None 2018-06-06 09:40:38,734 - DEBUG: [197] Content-Type: 'application/msword' 2018-06-06 09:40:38,736 - DEBUG: [197] Analyzing attachment: '=?iso-8859-2?Q?name=FCr_AWMF.doc?=' 2018-06-06 09:40:38,751 - DEBUG: [197] The attachment '=?iso-8859-2?Q?name=FCr_AWMF.doc?=' is clean. 2018-06-06 09:40:38,751 - DEBUG: [197] Content-Type: 'application/rtf' 2018-06-06 09:40:38,752 - DEBUG: [197] Analyzing attachment: '=?iso-8859-2?Q?LL-othername=FCr_AWMF.rtf?=' 2018-06-06 09:40:38,753 - ERROR: [197] Error while processing the message 2018-06-06 09:40:38,754 - DEBUG: [197] Exeption code: [!! Traceback (most recent call last): !! File "/usr/bin/macromilter.py", line 295, in checkforVBA vba_parser = olevba.VBA_Parser(filename='message', data=attachment) !! File "/usr/local/lib/python2.7/dist-packages/oletools/olevba.py", line 2385, in init raise FileOpenError(msg) !! FileOpenError: Failed to open file message is RTF, need to run rtfobj.py and find VBA Macros in its output. ]

sbidy commented 6 years ago

Hey, I look into that. maybe there was a change at the olevba ...