olevba/plugin_biff: error variable referenced before assignment

[decalage2]

See https://twitter.com/James_inthe_box/status/1333792970399617025
sample: https://app.any.run/tasks/339739c0-d03f-48a5-a19d-76dd570504e3/
error:

[scandox]

Have observed recent malware on which macro detection fails due to this bug. Can provide sample if it is helpful.

[decalage2]

Yes please, a sample would be helpful. I need to try it with the latest oledump, in case it was already fixed by Didier.

@DidierStevens, were you aware of that bug in plugin_biff (see above), and if so maybe you already fixed it?

[DidierStevens]

I found a file with exactly the same name on anyrun: https://app.any.run/tasks/339739c0-d03f-48a5-a19d-76dd570504e3

It does not crash plugin_biff.

And neither does it crash olevba.

So if the sample is different, please share it.

[decalage2]

I just tried it: the bug is still there with olevba (which includes an old version of plugin_biff), but the latest oledump runs without error. So I just need to update the plugin_biff embedded with olevba and it should fix the bug.
(see also issue #649)

[scandox]

Sample is: https://app.any.run/tasks/acdc4eeb-dd98-432b-b8f7-b2746f3bbd93

As @decalage2 says it appears oledump no longer has this issue. The two lines below resolved this and we already patched our systems with them and detection is now working:

https:/DidierStevens/DidierStevensSuite/blob/15f24a64047dd879dd33198ef7da930adecde851/plugin_biff.py#L1190
https:/DidierStevens/DidierStevensSuite/blob/15f24a64047dd879dd33198ef7da930adecde851/plugin_biff.py#L1191