Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unexpected value in Macros/VBA/dir for variable REFERENCEREGISTERED_Reserved1 #112

Open
gregcopenhaver opened this issue Dec 7, 2016 · 0 comments
Assignees
Milestone

Comments

@gregcopenhaver
Copy link

$ olevba b22e8883178d7407c379d7062e26abef.doc
olevba 0.50 - http://decalage.info/python/oletools
Flags        Filename                                                         
-----------  -----------------------------------------------------------------
!ERROR       b22e8883178d7407c379d7062e26abef.doc - Unexpected value in Macros/VBA/dir for variable REFERENCEREGISTERED_Reserved1: expected 0000 but found 6E37!

https://www.virustotal.com/en/file/b047c4e4fcdcac2dc022c7abd1fdfe5948c79e41131ccaf0fcabb22d513f2194/analysis/1481119985/

https://malwr.com/analysis/ZmRjOThiMDU2NzNiNDk4OWIxZWE4ZGUxYTEwMGE4NDg/

$ oledump.py b22e8883178d7407c379d7062e26abef.doc
  1:       114 '\x01CompObj'
  2:      4096 '\x05DocumentSummaryInformation'
  3:      4096 '\x05SummaryInformation'
  4:      7142 '1Table'
  5:     38552 'Data'
  6:       367 'Macros/PROJECT'
  7:        41 'Macros/PROJECTwm'
  8: M  113596 'Macros/VBA/ThisDocument'
  9:     21166 'Macros/VBA/_VBA_PROJECT'
 10:      1297 'Macros/VBA/__SRP_0'
 11:       190 'Macros/VBA/__SRP_1'
 12:       592 'Macros/VBA/__SRP_2'
 13:       316 'Macros/VBA/__SRP_3'
 14:       521 'Macros/VBA/dir'
 15:      4096 'WordDocument'
@decalage2 decalage2 added this to the oletools 0.60 milestone Dec 7, 2016
@decalage2 decalage2 self-assigned this Dec 7, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants