Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Incomplete OLE stream + Incorrect OLE FAT, sector index out of range #27
I've encountered a parsing error on malware sample. (I could open this file with SSView)
First, incomplete OLE stream error while opening unicode named vba script.
and out of range error while opening other vba files ...
Attached is xls file(malware sample), for reproducing the bug.
I am using python 2.7.10, olefile 0.42
Thanks for wonderful project.
After a lot of troubleshooting, I found the issue: the sample file is slightly malformed. Its header sets the "mini sector cutoff size" to 0, whereas the only allowed value is 4096. If I fix this value in olefile, then all streams can be read without error.
I will publish a new version with that fix soon.