Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oleid, ftguess: parsing issues with PPTM file #853

Open
decalage2 opened this issue Apr 4, 2024 · 0 comments
Open

oleid, ftguess: parsing issues with PPTM file #853

decalage2 opened this issue Apr 4, 2024 · 0 comments

Comments

@decalage2
Copy link
Owner

the sample with hash 061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578 (available on MalwareBazaar) is not parsed correctly by ftguess and oleid:

oleid prints a warning that some XML could not be parsed:
Actually this is because ppt/presentation.xml is an empty file. So this PPTM file is malformed.

oleid 0.60.1 - http://decalage.info/oletools

Filename: 061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578.pptm
WARNING    xml-parsing for ppt/presentation.xml failed (no element found: line 1, column 0). Run iter_non_xml to investigate.

ftguess does not identify the file format properly:
This is because the MIME type of the main part (ppt/presentation.xml) is "application/vnd.ms-powerpoint.addin.macroEnabled.main+xml", which is not yet supported by ftguess.
=> need to add PPAM, POTX and POTM.

ftguess 0.60.1 on Python 3.11.6 - http://decalage.info/python/oletools

File       : 061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578.pptm
File Type  : OpenXML file
Description: Generic OpenXML file
Application: MS Office
Container  : OpenXML
Content-type(s) : 
PUID       : None
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant