Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

parsing error/exception seen inside open_ppt() of oletools 0.60.2 #866

Open
ghanashyams opened this issue Sep 11, 2024 · 0 comments
Open

Comments

@ghanashyams
Copy link

**Affected tool:**olevba 0.60.2

Describe the bug
The sample with hash 548b5f7ed622db4098595877c701695d77672233116cb86835e28372c47d100a(available on VirusTotal) is not parsed and not handled correctly by olevba, exception raised . Detailed stack trace of parsing issue is as below:

(py38ole60) C:\Windows\System32>olevba "C:\samples\Release\ole_test\548b5f7ed622db4098595877c701695d77672233116cb86835e28372c47d100a"
olevba 0.60.2 on Python 3.8.19 - http://decalage.info/python/oletools
ERROR Unhandled exception in main: 'NoneType' object has no attribute 'name'
Traceback (most recent call last):
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\olevba.py", line 4670, in main
curr_return_code = process_file(filename, data, container, options)
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\olevba.py", line 4473, in process_file
vba_parser = VBA_Parser_CLI(filename, data=data, container=container,
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\olevba.py", line 4032, in init
super(VBA_Parser_CLI, self).init(*args, **kwargs)
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\olevba.py", line 2773, in init
self.open_ppt()
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\olevba.py", line 3110, in open_ppt
ppt = ppt_parser.PptParser(self.ole_file, fast_fail=True)
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\oletools\ppt_parser.py", line 1198, in init
root_streams = self.ole.listdir()
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\olefile\olefile.py", line 1917, in listdir
self._list(files, [], self.root, streams, storages)
File "C:\ProgramData\anaconda3\envs\py38ole60\lib\site-packages\olefile\olefile.py", line 1890, in _list
prefix = prefix + [node.name]
AttributeError: 'NoneType' object has no attribute 'name'

(py38ole60) C:\Windows\System32>
548b5f7ed622db4098595877c701695d77672233116cb86835e28372c47d100a.zip

File/Malware sample to reproduce the bug
Sample file is attached with this ticket. pascode- infected

How To Reproduce the bug
Steps to reproduce the behavior, including the full command line or the options you used.

Version information: python3.8 windows10/linux

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants