Peter M. Groen / oletools

Commit ae46dbd0f0775ab3cfaea40835203b641496b81e

Authored by Sébastien Larinier
1 parent c64d6972

correct bug in olevba with strrevese string

Inline Side-by-side
Showing 1 changed file with 6 additions and 4 deletions
oletools/olevba.py
  View file @ae46dbd
@@ -1933,8 +1933,8 @@ class VBA_Scanner(object): @@ -1933,8 +1933,8 @@ class VBA_Scanner(object):
1933 # join long lines ending with " _": 1933 # join long lines ending with " _":
1934 self.code = vba_collapse_long_lines(vba_code) 1934 self.code = vba_collapse_long_lines(vba_code)
1935 self.code_hex = b'' 1935 self.code_hex = b''
1936 - self.code_hex_rev = ''  
1937 - self.code_rev_hex = '' 1936 + self.code_hex_rev = b''
  1937 + self.code_rev_hex = b''
1938 self.code_base64 = b'' 1938 self.code_base64 = b''
1939 self.code_dridex = '' 1939 self.code_dridex = ''
1940 self.code_vba = '' 1940 self.code_vba = ''
@@ -1972,9 +1972,9 @@ class VBA_Scanner(object): @@ -1972,9 +1972,9 @@ class VBA_Scanner(object):
1972 # if the code contains "StrReverse", also append the hex strings in reverse order: 1972 # if the code contains "StrReverse", also append the hex strings in reverse order:
1973 if self.strReverse: 1973 if self.strReverse:
1974 # StrReverse after hex decoding: 1974 # StrReverse after hex decoding:
1975 - self.code_hex_rev += '\n' + decoded[::-1] 1975 + self.code_hex_rev += b'\n' + decoded[::-1]
1976 # StrReverse before hex decoding: 1976 # StrReverse before hex decoding:
1977 - self.code_rev_hex += '\n' + binascii.unhexlify(encoded[::-1]) 1977 + self.code_rev_hex += b'\n' + binascii.unhexlify(encoded[::-1])
1978 #example: https://malwr.com/analysis/NmFlMGI4YTY1YzYyNDkwNTg1ZTBiZmY5OGI3YjlhYzU/ 1978 #example: https://malwr.com/analysis/NmFlMGI4YTY1YzYyNDkwNTg1ZTBiZmY5OGI3YjlhYzU/
1979 #TODO: also append the full code reversed if StrReverse? (risk of false positives?) 1979 #TODO: also append the full code reversed if StrReverse? (risk of false positives?)
1980 # Detect Base64-encoded strings 1980 # Detect Base64-encoded strings
@@ -2006,6 +2006,8 @@ class VBA_Scanner(object): @@ -2006,6 +2006,8 @@ class VBA_Scanner(object):
2006 (self.code_dridex, 'Dridex'), 2006 (self.code_dridex, 'Dridex'),
2007 (self.code_vba, 'VBA expression'), 2007 (self.code_vba, 'VBA expression'),
2008 ): 2008 ):
  2009 + if isinstance(code,bytes):
  2010 + code=code.decode('utf-8','replace')
2009 self.autoexec_keywords += detect_autoexec(code, obfuscation) 2011 self.autoexec_keywords += detect_autoexec(code, obfuscation)
2010 self.suspicious_keywords += detect_suspicious(code, obfuscation) 2012 self.suspicious_keywords += detect_suspicious(code, obfuscation)
2011 self.iocs += detect_patterns(code, obfuscation) 2013 self.iocs += detect_patterns(code, obfuscation)