decalage2/oletools issues and pull requests

#753 - XLS with Macro not detected

Issue - State: open - Opened by randubin over 2 years ago - 2 comments
Labels: :bug: bug, olevba

#751 - olevba: improve parsing of XLM macros

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :bug: bug, olevba, XLM

#750 - Avoid repeated string join()s in analyze_macros()

Pull Request - State: open - Opened by Blacksyke over 2 years ago
Labels: :bug: bug, olevba

#749 - String parsing slow with ~100,000+ strings

Issue - State: open - Opened by Blacksyke over 2 years ago - 1 comment
Labels: :bug: bug, olevba

#748 - Olevba: Add switch parameter to choose either XLMMacroDeobfuscator or plugin_biff for XLM-macros analysis

Issue - State: open - Opened by antmaxi over 2 years ago - 1 comment
Labels: :+1: enhancement, olevba, proposal, XLM

#747 - Olevba can't parse vsdm (Visio) files anymore

Issue - State: open - Opened by eyaltemps over 2 years ago - 1 comment
Labels: :bug: bug, olevba

#746 - Olevba sometimes extract macros of embedded files

Issue - State: open - Opened by eyaltemps over 2 years ago

#745 - mraptor does not detect Excel4 Macro

Issue - State: open - Opened by gnugnug over 2 years ago - 2 comments
Labels: :+1: enhancement, mraptor

#744 - olevba: add option or sample script to scan an entire PC for macros

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement

#742 - can't detect the macro in the virus xlsb

Issue - State: open - Opened by leezp over 2 years ago - 1 comment
Labels: :bug: bug, olevba, XLM

#741 - XLM4 is not detected

Issue - State: open - Opened by randubin over 2 years ago - 2 comments
Labels: :bug: bug, olevba

#740 - OLEVBA do not show xls macro while OLEID indicate it exist

Issue - State: open - Opened by randubin over 2 years ago - 5 comments
Labels: :bug: bug, olevba, setup.py, oleid, XLM

#739 - rtfobj: Not a well-formed OLE object

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :bug: bug, rtfobj

#738 - update oletools description

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, :memo: documentation

#737 - olevba: fix sys.argv[1] using xlmdeobfuscator

Pull Request - State: closed - Opened by minanokawari1124 over 2 years ago - 1 comment
Labels: :bug: bug, olevba

#736 - rtfobj: detect remote templates

Issue - State: open - Opened by decalage2 over 2 years ago - 1 comment
Labels: :+1: enhancement, rtfobj

#735 - ftguess: add more OLE formats based on file Magdir

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, ftguess

#734 - oleid/ftguess: detect CSV files, use msodde to detect DDE

Issue - State: open - Opened by decalage2 over 2 years ago

#733 - mraptor, olevba: add VBA trigger using customUI

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, olevba, mraptor

#732 - oleobj, oleid: mention MITRE ATT&CK technique for template injection if detected

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, oleobj, oleid

#731 - olevba: add VBA trigger using a checkbox

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, olevba

#730 - oleobj: add detection for customUI external links

Issue - State: open - Opened by decalage2 over 2 years ago - 1 comment
Labels: :+1: enhancement, oleobj

#729 - olevba/ftguess: large MHT file incorrectly identified as OpenXML

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :bug: bug, olevba, oleid, ftguess

#728 - extract_macros (of VBA_PARSER) doesn't extract macrosheet code anymore

Issue - State: open - Opened by eyaltemps almost 3 years ago - 8 comments
Labels: :bug: bug, olevba

#726 - Retrieve Original Filenames of OleObject.bin files

Issue - State: closed - Opened by SmithCJ47 almost 3 years ago - 5 comments
Labels: question, oleobj

#725 - malware does "ERROR PROJECTNAME_SizeOfProjectName value not in range [1-128]: 131075"

Issue - State: closed - Opened by lclevy almost 3 years ago - 1 comment
Labels: :bug: bug, olevba

#723 - olevba: add projectcompatversion record

Pull Request - State: closed - Opened by kijeong almost 3 years ago - 5 comments
Labels: :bug: bug, olevba

#719 - olevba: detect VBA referencing

Issue - State: open - Opened by decalage2 almost 3 years ago - 1 comment
Labels: :+1: enhancement, olevba

#718 - Test xlm samples

Pull Request - State: closed - Opened by christian-intra2net almost 3 years ago - 2 comments
Labels: :+1: enhancement, olevba, tests, XLM

#716 - Ftguess: more types and tests

Pull Request - State: closed - Opened by christian-intra2net almost 3 years ago - 3 comments
Labels: oleid, tests, ftguess

#709 - colorclass dependency causes incompatibility with CPython 3.10

Issue - State: open - Opened by michaelweiser about 3 years ago - 3 comments
Labels: :bug: bug, olevba, setup.py

#707 - olevba: add info on Conditional Compiler Arguments and References

Issue - State: open - Opened by xlsupport about 3 years ago - 2 comments
Labels: olevba, proposal

#701 - olevba: error in _extract_vba

Issue - State: closed - Opened by decalage2 about 3 years ago - 2 comments
Labels: :bug: bug, olevba

#700 - Strange Project Information Record

Issue - State: closed - Opened by Ikari33 about 3 years ago - 5 comments
Labels: :bug: bug, olevba

#673 - rtfobj: parse and display the oleclsid control word when present

Issue - State: open - Opened by decalage2 over 3 years ago - 2 comments
Labels: :+1: enhancement, rtfobj

#667 - olevba: UnicodeEncodeError when redirecting output to a file on Windows with Python 3

Issue - State: open - Opened by decalage2 over 3 years ago - 1 comment
Labels: :bug: bug, olevba, Python 3.x

#666 - Possible fix for extended ASCII issue (#490)

Pull Request - State: open - Opened by kirk-sayre-work over 3 years ago - 3 comments
Labels: :bug: bug, olevba

#658 - olevba: map suspicious keywords to MITRE ATT&CK and/or MBC

Issue - State: open - Opened by decalage2 over 3 years ago - 1 comment
Labels: :+1: enhancement, olevba, oleobj, msodde

#642 - crypto: CryptographyDeprecationWarning on PyPy 2 triggers a WrongEncryptionPassword exception

Issue - State: open - Opened by decalage2 almost 4 years ago - 1 comment
Labels: :bug: bug, Python 2.7, crypto, PyPy

#598 - Add class ID for Autodesk 3ds Max Scene file

Pull Request - State: closed - Opened by utkonos about 4 years ago - 3 comments
Labels: :+1: enhancement, clsid

#581 - olevba+mraptor: add keywords for COM objects

Issue - State: open - Opened by decalage2 over 4 years ago - 2 comments
Labels: :+1: enhancement, olevba, mraptor

#555 - VBA compressed source injection?

Issue - State: open - Opened by sancarn over 4 years ago - 12 comments
Labels: question, olevba

#545 - Avoid stream copies

Pull Request - State: closed - Opened by jothan over 4 years ago - 3 comments
Labels: :bug: bug, plugin_biff

#543 - how to set the oldobj encoding for Chinese characters?

Issue - State: open - Opened by langsz over 4 years ago - 4 comments
Labels: :bug: bug, oleobj

#515 - olevba: add keywords for AMSI bypass

Issue - State: open - Opened by decalage2 almost 5 years ago - 2 comments
Labels: :+1: enhancement, olevba

#512 - olevba/mraptor: keywords for shellcode injection

Issue - State: open - Opened by decalage2 almost 5 years ago - 9 comments
Labels: :+1: enhancement, olevba, mraptor

#502 - olevba: Excel Macros (.xls & .xlsm) falsely flag as containing Hex Strings & Suspicious Keywords

Issue - State: open - Opened by CanIPhish almost 5 years ago - 4 comments
Labels: :bug: bug, olevba

#464 - Decrypt in oleobj

Pull Request - State: closed - Opened by christian-intra2net about 5 years ago - 2 comments
Labels: :+1: enhancement, oleobj, crypto

#451 - Oleobj preserve file extension

Pull Request - State: closed - Opened by christian-intra2net over 5 years ago - 4 comments
Labels: :+1: enhancement, oleobj

#449 - Use log helper

Pull Request - State: closed - Opened by christian-intra2net over 5 years ago - 6 comments
Labels: :+1: enhancement, olevba, crypto, log_helper

#429 - Fix TypeError in VBA_Parser.analyze_macros() (can't concat bytes to s…

Pull Request - State: closed - Opened by enkelli over 5 years ago - 5 comments
Labels: :bug: bug, olevba

#419 - olevba+mraptor: add suspicious keywords

Issue - State: open - Opened by decalage2 over 5 years ago - 5 comments
Labels: :+1: enhancement, olevba, mraptor

#386 - olevba: extract and display references from VBA project

Issue - State: open - Opened by decalage2 over 5 years ago - 1 comment
Labels: :+1: enhancement, olevba

#286 - olevba - detect external references in VBA project

Issue - State: open - Opened by decalage2 over 6 years ago - 1 comment
Labels: :+1: enhancement, olevba

#278 - accdb extract ole object (picturedata)

Issue - State: closed - Opened by paulopires16 over 6 years ago - 5 comments

#215 - How to deal with test data that might trigger antivirus engines

Issue - State: open - Opened by samiraguiar almost 7 years ago - 12 comments
Labels: :+1: enhancement, tests

#195 - Olevba MemoryError

Issue - State: open - Opened by LucasEsposito about 7 years ago - 5 comments
Labels: :bug: bug, olevba, olefile

#90 - mraptor false positives

Issue - State: open - Opened by decalage2 about 8 years ago - 8 comments
Labels: :bug: bug, major, mraptor

#56 - Uncompressed analysis

Pull Request - State: closed - Opened by christian-intra2net about 8 years ago
Labels: :+1: enhancement, olevba

#50 - olevba - add VM detection keywords

Issue - State: open - Opened by decalage2 over 8 years ago - 1 comment
Labels: :+1: enhancement, olevba

GitHub / decalage2/oletools issues and pull requests