Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

malware does "ERROR PROJECTNAME_SizeOfProjectName value not in range [1-128]: 131075" #725

Closed
lclevy opened this issue Dec 1, 2021 · 1 comment
Assignees
Milestone

Comments

@lclevy
Copy link

lclevy commented Dec 1, 2021

Affected tool:
olevba

Describe the bug
malware with sha256 b02be8a230c8c3c92b1535ad44fe2c4a05866195cb2b9243dd9b2d48d7cb35ea (xls with VBA)
make olevba crash
with errors:
WARNING invalid value for PROJECTLCID_Id expected 0002 got 004A
WARNING invalid value for PROJECTLCID_Lcid expected 0409 got 0002
WARNING invalid value for PROJECTLCIDINVOKE_Id expected 0014 got 0002
WARNING invalid value for PROJECTCODEPAGE_Id expected 0003 got 0014
WARNING invalid value for PROJECTCODEPAGE_Size expected 0002 got 0004
WARNING invalid value for PROJECTNAME_Id expected 0004 got 0000
ERROR PROJECTNAME_SizeOfProjectName value not in range [1-128]: 131075
ERROR Error in _extract_vba
Traceback (most recent call last):
File "C:\Users\Laurent\AppData\Local\Programs\Python\Python38\lib\site-packages\oletools\olevba.py", line 3544, in extract_macros
for stream_path, vba_filename, vba_code in
File "C:\Users\Laurent\AppData\Local\Programs\Python\Python38\lib\site-packages\oletools\olevba.py", line 2112, in _extract_vba
project = VBA_Project(ole, vba_root, project_path, dir_path, relaxed)
File "C:\Users\Laurent\AppData\Local\Programs\Python\Python38\lib\site-packages\oletools\olevba.py", line 1770, in init
projectdocstring_id = struct.unpack("<H", dir_stream.read(2))[0]

File/Malware sample to reproduce the bug
https://bazaar.abuse.ch/sample/b02be8a230c8c3c92b1535ad44fe2c4a05866195cb2b9243dd9b2d48d7cb35ea/

How To Reproduce the bug
olevba virusfile

Expected behavior
analyse whole VBA code
only partial analysis

Console output / Screenshots
see above

Version information:

  • OS: Windows 10

  • OS version: 64 bits

  • Python version: Python 3.8.7 (tags/v3.8.7:6503f05, Dec 21 2020, 17:59:51) [MSC v.1928 64 bit (AMD64)] on win32

  • oletools version: git clone on 1dec2021

@decalage2 decalage2 self-assigned this Dec 1, 2021
@decalage2 decalage2 added this to the oletools 0.60 milestone Dec 1, 2021
@decalage2
Copy link
Owner

Fixed by PR #723

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants