[olevba] can't concat str to bytes #455

0xcpu · 2019-06-21T15:29:31Z

Affected tool:
olevba

Describe the bug
Unable to process VBA code

File/Malware sample to reproduce the bug
fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8

How To Reproduce the bug
olevba3 -c fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8

Console output / Screenshots

olevba3 -l debug -c fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8 
olevba 0.55.dev2 on Python 3.6.8 - http://decalage.info/python/oletools
INFO     Opening OLE file fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8
INFO     Check whether OLE file is PPT
DEBUG    using open OleFileIO
DEBUG    File appears not to be a ppt file (In stream "root" for field "listdir" found value "[['\x01CompObj'], ['\x05DocumentSummaryInformation'], ['\x05SummaryInformation'], ['1Table'], ['Data'], ['ObjectPool', '_1608932915', '\x01CompObj'], ['ObjectPool', '_1608932915', '\x03OCXNAME'], ['ObjectPool', '_1608932915', '\x03ObjInfo'], ['ObjectPool', '_1608932915', '\x03PRINT'], ['ObjectPool', '_1608932915', 'contents'], ['WordDocument']]" but expected len = 1!)
===============================================================================
FILE: fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8
Type: OLE
DEBUG    VBA_Parser.find_vba_projects
DEBUG    Checking storage ['ObjectPool']
DEBUG    Checking storage ['ObjectPool', '_1608932915']
DEBUG    Checking storage ['Xacros']
DEBUG    Checking DirEntry #0
DEBUG    Checking DirEntry #1
DEBUG    Reading data from stream 'Data' - size: 29687 bytes
DEBUG    Read 29687 bytes
DEBUG    b'\xc3q\x00\x00D\x00d\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x92"_\n\xe8\x03\xe8\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x04\xf0j\x00\x00\x00\xb2\x04\n\xf0\x08\x00\x00\x00\x03\x04\x00\x00\x00\n\x00\x00c\x00\x0b\xf08\x00\x00\x00'...[much more data]...b'\xe2&tCCgQ\xd0,\xd5-\xf5\xb71{\xba/\xcff\xe5\xe1\xf3\xfc\xf2<\xe7K\x9b{\xcai\x19\xeb\xd1=:v\xabZG\x12\x82n\x10\xf8\x05\x1b\x1b6\x9f'
DEBUG    Checking DirEntry #2
DEBUG    Reading data from stream 'WordDocument' - size: 4096 bytes
DEBUG    Read 4096 bytes
DEBUG    b'\xec\xa5\xc1\x00_\x00\t\x04\x00\x00\xf8\x12\xbf\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x08\x00\x004\x08\x00\x00\x0e\x00bjbj\x88e\x88e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x04\x16\x00\x88\x0f\x00\x00\xea\x0f\x00f\xea\x0f\x00f\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #3
DEBUG    Checking DirEntry #4
DEBUG    Checking DirEntry #5
DEBUG    Reading data from stream '\x03PRINT' - size: 510 bytes
DEBUG    Read 510 bytes
DEBUG    b'\x08\x00\xec\t{\x02\x00\x00\x01\x00\t\x00\x00\x03\xfb\x00\x00\x00\x05\x00\x1d\x00\x00\x00\x00\x00\x04\x00\x00\x00\x03\x01\x08\x00\x05\x00\x00\x00\x0b\x02\x00\x00\x00\x00\x05\x00\x00\x00\x0c\x02\x18\x00`\x00\x03\x00\x00\x00\x1e\x00\x07\x00\x00\x00\xfc\x02\x00\x00\xff\xff\xff\x00\x00\x00\x04\x00\x00\x00-\x01\x00\x00\t\x00\x00\x00\x1d\x06!\x00\xf0\x00\x18\x00\x01\x00\x00\x00_\x00'...[much more data]...b"cmd /c %prOG\x06\x00\x0c\x00\x08\x00\x03\x00\x06\x00\x06\x00\x03\x00\x0b\x00\x08\x00\x05\x00\n\x00\t\x00\x04\x00\x00\x00'\x01\xff\xff\x03\x00\x00\x00\x00\x00"
DEBUG    Checking DirEntry #6
DEBUG    Reading data from stream '\x01CompObj' - size: 116 bytes
DEBUG    Read 116 bytes
DEBUG    b'\x01\x00\xfe\xff\x03\n\x00\x00\xff\xff\xff\xff\x10\x1d\xd2\x8bB\xec\xce\x11\x9e\r\x00\xaa\x00`\x02\xf3\x1c\x00\x00\x00Microsoft Forms 2.0 TextBox\x00\x10\x00\x00\x00Embedded Object\x00\x10\x00\x00\x00Forms.TextBox.1\x00\xf49\xb2q\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #7
DEBUG    Reading data from stream '\x03ObjInfo' - size: 6 bytes
DEBUG    Read 6 bytes
DEBUG    b'\x00\x12\x03\x00\x04\x00'
DEBUG    Checking DirEntry #8
DEBUG    Reading data from stream '\x03OCXNAME' - size: 20 bytes
DEBUG    Read 20 bytes
DEBUG    b'T\x00e\x00x\x00t\x00B\x00o\x00x\x001\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #9
DEBUG    Reading data from stream 'contents' - size: 2508 bytes
DEBUG    Read 2508 bytes
DEBUG    b'\x00\x02\xac\t\x01\x01@\x80\x00\x00\x00\x00\x1bH\x80,\x91\t\x00\x80\xec\t\x00\x00{\x02\x00\x00cmd /c %prOGRaMdAta:~0,1%%pROgrAmdAta:~9,2%  /v:  /C"  sET   jsH=)Ek1eSl'...[much more data]...b'  !Oo3:~ 5!  | CmD"\x00\x00\x00\x00\x02\x18\x005\x00\x00\x00\x07\x00\x00\x80\xe1\x00\x00\x00\x00\x02\x00\x00Calibri\x00'
DEBUG    Checking DirEntry #10
DEBUG    Reading data from stream '1Table' - size: 9722 bytes
DEBUG    Read 9722 bytes
DEBUG    b'\x1a\x06\x11\x00\x12\x00\x01\x00w\x01\x0f\x00\x07\x00\x03\x00\x03\x00\x03\x00\x00\x00\x04\x00\x08\x00\x00\x00\x98\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x00\x9e\x00\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x006\x06\x00\x00'...[much more data]...b'\xdc\x00\x00\x00\x00\x00\x00\x00\xff\xff\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #11
DEBUG    Reading data from stream '\x05SummaryInformation' - size: 404 bytes
DEBUG    Read 404 bytes
DEBUG    b"\xfe\xff\x00\x00\x06\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xe0\x85\x9f\xf2\xf9Oh\x10\xab\x91\x08\x00+'\xb3\xd90\x00\x00\x00d\x01\x00\x00\x11\x00\x00\x00\x01\x00\x00\x00\x90\x00\x00\x00\x02\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\xa4\x00\x00\x00\x04\x00\x00\x00\xb0\x00\x00\x00\x05\x00\x00\x00\xbc\x00\x00\x00\x06\x00\x00\x00"...[much more data]...b'\x9a\x9b\x8b\xab\xd4\x01@\x00\x00\x00\x00\xbc\x9a\x9b\x8b\xab\xd4\x01\x03\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x0e\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #12
DEBUG    Reading data from stream '\x05DocumentSummaryInformation' - size: 280 bytes
DEBUG    Read 280 bytes
DEBUG    b'\xfe\xff\x00\x00\x06\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x02\xd5\xcd\xd5\x9c.\x1b\x10\x93\x97\x08\x00+,\xf9\xae0\x00\x00\x00\xe8\x00\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x00h\x00\x00\x00\x0f\x00\x00\x00p\x00\x00\x00\x05\x00\x00\x00|\x00\x00\x00\x06\x00\x00\x00\x84\x00\x00\x00\x11\x00\x00\x00\x8c\x00\x00\x00\x17\x00\x00\x00'...[much more data]...b'\x00\x00\x00\x00\x00\x00\x1e\x10\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x0c\x10\x00\x00\x02\x00\x00\x00\x1e\x00\x00\x00\x06\x00\x00\x00Title\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00'
DEBUG    Checking DirEntry #13
DEBUG    Checking DirEntry #14
DEBUG    This DirEntry is an orphan or unused
DEBUG    Checking DirEntry #15
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Dci2l' - size: 1956 bytes
DEBUG    Read 1956 bytes
DEBUG    b'\x01\x16\x01\x00\x06$\x01\x00\x00\xda\x03\x00\x00\x08\x01\x00\x006\x02\x00\x00!\x04\x00\x00;\x04\x00\x00\xe3\x05\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\xa0\xd4\xf5\xe9\x00\x00\xff\xff\xe3\x01\x00\x00\x88\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xffD\x00\xff\xff\x00\x00`\x01f\x84\x04G\xe1L\xbc&\xc0,\xee\xbd\x03\xe0\x1e'...[much more data]...b'mm\x81\x0fS217\x02l@\x05Sc9s\r\n Rps33\x80\nIz\x04cf\x00\x05Kb3ah@\r\nEnd \xc0;\r\x00\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #16
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream '__SRP_2' - size: 428 bytes
DEBUG    Read 428 bytes
DEBUG    b'rU\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x03\x000\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00\x00\x00\x00\x00\x01\x00\x01\x00\x00\x00\x02\x00\t\x08\x00\x00\x00\x00\x00\x001\x08\x00\x00\x00\x00\x00\x00Y\x08\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x01\x00\x02\x00\xc1\x07'...[much more data]...b'\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x144\x00\r\x00\x00\x00\x07\x00\x00\x13\x00\x00\x00\x00A\x00\x00\x7f\x00\x00\x00\x00'
DEBUG    Checking DirEntry #17
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream '__SRP_3' - size: 142 bytes
DEBUG    Read 142 bytes
DEBUG    b'rU\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\t\x00\x00\x00\x00\x00\x02\x00\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00H\x00\x00\x00\x04\x00$\x00\xb9\x01\x00\x00\x00\x00\x02\x00\x00\x00\x04`\x00\x00\r\x07\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x01\x00 \x00\xa1\x00\x00\x00\x00\x00\x01\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x04@\x02\x00\x00\x07\x1d\xc1\x00\x00\x00\x00\x00\x01\x004\x00\x00\x00\x00\x00\x00\x00n\x00\x00\x7f\x00\x00\x00\x00'
DEBUG    Checking DirEntry #18
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Aijoz' - size: 3700 bytes
DEBUG    Read 3700 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\\\x02\x00\x00\xd4\x00\x00\x00\x88\x01\x00\x00\xff\xff\xff\xffc\x02\x00\x00\x03\n\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4\xc8E\x00\x00\xff\xff\x03\x00\x00\x00\x00\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\nCto\xa13A-V\x88mi4-\xbdS35GZ\x826\xee\rY8jp5\xe0\x08 D4vli\xcf\x16\r\n\x03\xf1-\xe5\x80\r\n\r\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #19
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Pvm3' - size: 672 bytes
DEBUG    Read 672 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\x1c\x02\x00\x00\xd4\x00\x00\x00\x88\x01\x00\x00\xff\xff\xff\xff#\x02\x00\x00w\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4\xf9\x19\x00\x00\xff\xff\x03\x00\x00\x00\x00\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\x00\xff\xff\xff\xffx\x00\x00\x00\xff\xff\xff\xff\x00\x00\x01\x1f\xb0\x00Attribut\x00e VB_Nam\x00e = "Pvm\x003"\r\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #20
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Mwswz' - size: 673 bytes
DEBUG    Read 673 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\x1c\x02\x00\x00\xd4\x00\x00\x00\x88\x01\x00\x00\xff\xff\xff\xff#\x02\x00\x00w\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4*\xea\x00\x00\xff\xff\x03\x00\x00\x00\x00\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\xff\xff\xff\xffx\x00\x00\x00\xff\xff\xff\xff\x00\x00\x01 \xb0\x00Attribut\x00e VB_Nam\x00e = "Mws\x00wz"\r\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #21
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'F5p12' - size: 673 bytes
DEBUG    Read 673 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\x1c\x02\x00\x00\xd4\x00\x00\x00\x88\x01\x00\x00\xff\xff\xff\xff#\x02\x00\x00w\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4"\x84\x00\x00\xff\xff\x03\x00\x00\x00\x00\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\xff\xff\xff\xffx\x00\x00\x00\xff\xff\xff\xff\x00\x00\x01 \xb0\x00Attribut\x00e VB_Nam\x00e = "F5p\x0012"\r\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #22
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Nqih' - size: 672 bytes
DEBUG    Read 672 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\x1c\x02\x00\x00\xd4\x00\x00\x00\x88\x01\x00\x00\xff\xff\xff\xff#\x02\x00\x00w\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4\xb1\x9c\x00\x00\xff\xff\x03\x00\x00\x00\x00\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\x00\xff\xff\xff\xffx\x00\x00\x00\xff\xff\xff\xff\x00\x00\x01\x1f\xb0\x00Attribut\x00e VB_Nam\x00e = "Nqi\x00h"\r\n'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #23
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'S4oi7' - size: 984 bytes
DEBUG    Read 984 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\xc4\x02\x00\x00\xd4\x00\x00\x00\x00\x02\x00\x00\xff\xff\xff\xff\xcb\x02\x00\x00\x1f\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4\xb5\x14\x00\x00\xff\xff\x01\x00\x00\x00\x80\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'ecla\x00\x06Id\x03\x00\xaa\x11CExpose\x01\x15\x1dTemplat@eDeriv\x16%C\x80ustomiz\x0bE\x00'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #24
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'L87z' - size: 982 bytes
DEBUG    Read 982 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\xc4\x02\x00\x00\xd4\x00\x00\x00\x00\x02\x00\x00\xff\xff\xff\xff\xcb\x02\x00\x00\x1f\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4)4\x00\x00\xff\xff\x01\x00\x00\x00\x80\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'\x90ecla\x00\x06Id\x00\xa9\x81\x11CExpose\x15\x1d\x00Template Deriv\x16%Cu@stomiz\x0bE'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #25
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'Suw46' - size: 984 bytes
DEBUG    Read 984 bytes
DEBUG    b'\x01\x16\x01\x00\x00\xf0\x00\x00\x00\xc4\x02\x00\x00\xd4\x00\x00\x00\x00\x02\x00\x00\xff\xff\xff\xff\xcb\x02\x00\x00\x1f\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa0\xd4g|\x00\x00\xff\xff\x01\x00\x00\x00\x80\x00\x00\x00\xb6\x00\xff\xff\x01\x01\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...[much more data]...b'ecla\x00\x06Id\x03\x00\xaa\x11CExpose\x01\x15\x1dTemplat@eDeriv\x16%C\x80ustomiz\x0bE\x00'
DEBUG    Found VBA compressed code
DEBUG    Checking DirEntry #26
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'XVBA_PROJECT' - size: 6224 bytes
DEBUG    Read 6224 bytes
DEBUG    b'\xcca\xaf\x00\x00\x01\x00\xff\t\x04\x00\x00\t\x04\x00\x00\xe4\x04\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x06\x00\x02\x00 \x01*\x00\\\x00G\x00{\x000\x000\x000\x002\x000\x004\x00E\x00F\x00-\x000\x000\x000\x000\x00-\x000\x000\x000\x000\x00-\x00C\x000\x000\x000\x00-\x000\x000\x000\x000\x00'...[much more data]...b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #27
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'dir' - size: 1043 bytes
DEBUG    Read 1043 bytes
DEBUG    b'\x01\x0f\xb4\x80\x01\x00\x04\x00\x00\x00\x01\x000*\x02\x02\x90\t\x00p\x14\x06H\x03\x00\x82\x02\x00d\xe4\x04\x04\x00\x07\x00\x1c\x00Project\x05Q\x00(\x00\x00@\x02\x14\x06\x02\x14=\xad\x02\n\x07\x02l\x01\x14\x08\x06\x12\t\x02\x12\x800p\x1a^\x1c\x00\x0c\x02J\x12<\x02\n\x16\x00\x01rstd\x10ole>\x02\x19s'...[much more data]...b'\x02c\x1a\xe5\x023?\ra\x1a)41\r\xc2\x17uw\x1446%\x1bu\xe0A4\x006?%\x1bA\x03%\x1bE\x03\xff\r\xe1\rg|\x05\xef\r\x10\xa2\x1c'
DEBUG    Checking DirEntry #28
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream '__SRP_0' - size: 1914 bytes
DEBUG    Read 1914 bytes
DEBUG    b'\x93K*\xaf\x01\x00\x10\x00\x00\x00\xff\xff\x00\x00\x00\x00\x01\x00\x02\x00\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x05\x00\x01\x00\t\x00\x00\x00*\\CNormalrU\x80\x01\x00\x00\x80\x00\x00\x00\x80\x00\x00'...[much more data]...b'\x03\x00\x00\x02\x08\x00\x00\x00autoopen\x05\x00\x00\r\x14\x00\x14\x00H\x00\x00\x00\x02\x00\x00\x00\x00\x004\x00\x03\x004\x00\x03\x00J\x00\x00\x7f\x00\x00\x00\x00'
DEBUG    Checking DirEntry #29
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream '__SRP_1' - size: 214 bytes
DEBUG    Read 214 bytes
DEBUG    b'rU\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x01\x00\x00~\x01\x00\x00~\x01\x00\x00~y\x00\x00\x7f\x00\x00\x00\x00\n\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x03\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'...[much more data]...b'\x00\x08\x08\x00\x00\x00TextBox1\x03\x00\x00\ti\x07\x00\x00\x00\x00\x00\x009\t\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x01\x00d\x00\x00\x7f\x00\x00\x00\x00'
DEBUG    Checking DirEntry #30
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'PROJECTwm' - size: 155 bytes
DEBUG    Read 155 bytes
DEBUG    b'Dci2l\x00D\x00c\x00i\x002\x00l\x00\x00\x00Aijoz\x00A\x00i\x00j\x00o\x00z\x00\x00\x00Pvm3\x00P\x00v\x00m\x003\x00\x00\x00Mwswz\x00M\x00w\x00s\x00w\x00z\x00\x00\x00F5p12\x00F\x005\x00p\x001\x002\x00\x00\x00Nqih\x00N\x00q\x00i\x00h\x00\x00\x00S4oi7\x00S\x004\x00o\x00i\x007\x00\x00\x00L87z\x00L\x008\x007\x00z\x00\x00\x00Suw46\x00S\x00u\x00w\x004\x006\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #31
DEBUG    This DirEntry is an orphan or unused
DEBUG    Reading data from stream 'PROJECT' - size: 773 bytes
DEBUG    Read 773 bytes
DEBUG    b'ID="{D1DA3262-8BE5-4443-8048-AEC3DB6C9B39}"\r\nDocument=Dci2l/&H00000000\r\nModule=Aijoz\r\nModule=Pvm3\r\nM'...[much more data]...b'5, 175, 1535, 843, \r\nSuw46=200, 200, 1560, 868, \r\n'
DEBUG    Checking DirEntry #32
DEBUG    Reading data from stream '\x01CompObj' - size: 114 bytes
DEBUG    Read 114 bytes
DEBUG    b'\x01\x00\xfe\xff\x03\n\x00\x00\xff\xff\xff\xff\x06\t\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F \x00\x00\x00Microsoft Word 97-2003 Document\x00\n\x00\x00\x00MSWordDoc\x00\x10\x00\x00\x00Word.Document.8\x00\xf49\xb2q\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
DEBUG    Checking DirEntry #33
DEBUG    This DirEntry is an orphan or unused
DEBUG    Checking DirEntry #34
DEBUG    This DirEntry is an orphan or unused
DEBUG    Checking DirEntry #35
DEBUG    This DirEntry is an orphan or unused
DEBUG    extract_macros:
DEBUG    VBA_Parser.find_vba_projects
DEBUG    Checking DirEntry #0
DEBUG    Checking DirEntry #1
DEBUG    Reading data from stream 'Data'
DEBUG    Checking DirEntry #2
DEBUG    Reading data from stream 'WordDocument'
DEBUG    Checking DirEntry #3
DEBUG    Checking DirEntry #4
DEBUG    Checking DirEntry #5
DEBUG    Reading data from stream '\x03PRINT'
DEBUG    Checking DirEntry #6
DEBUG    Reading data from stream '\x01CompObj'
DEBUG    Checking DirEntry #7
DEBUG    Reading data from stream '\x03ObjInfo'
DEBUG    Checking DirEntry #8
DEBUG    Reading data from stream '\x03OCXNAME'
DEBUG    Checking DirEntry #9
DEBUG    Reading data from stream 'contents'
DEBUG    Checking DirEntry #10
DEBUG    Reading data from stream '1Table'
DEBUG    Checking DirEntry #11
DEBUG    Reading data from stream '\x05SummaryInformation'
DEBUG    Checking DirEntry #12
DEBUG    Reading data from stream '\x05DocumentSummaryInformation'
DEBUG    Checking DirEntry #13
DEBUG    Checking DirEntry #14
DEBUG    Checking DirEntry #15
DEBUG    Reading data from stream 'Dci2l'
DEBUG    Found VBA compressed code at index 5E9
DEBUG    chunk size = 442, compressed flag = 1
DEBUG    Checking DirEntry #16
DEBUG    Reading data from stream '__SRP_2'
DEBUG    Checking DirEntry #17
DEBUG    Reading data from stream '__SRP_3'
DEBUG    Checking DirEntry #18
DEBUG    Reading data from stream 'Aijoz'
DEBUG    Found VBA compressed code at index A09
DEBUG    chunk size = 1130, compressed flag = 1
DEBUG    Checking DirEntry #19
DEBUG    Reading data from stream 'Pvm3'
DEBUG    Found VBA compressed code at index 27D
DEBUG    chunk size = 34, compressed flag = 1
DEBUG    Checking DirEntry #20
DEBUG    Reading data from stream 'Mwswz'
DEBUG    Found VBA compressed code at index 27D
DEBUG    chunk size = 35, compressed flag = 1
DEBUG    Checking DirEntry #21
DEBUG    Reading data from stream 'F5p12'
DEBUG    Found VBA compressed code at index 27D
DEBUG    chunk size = 35, compressed flag = 1
DEBUG    Checking DirEntry #22
DEBUG    Reading data from stream 'Nqih'
DEBUG    Found VBA compressed code at index 27D
DEBUG    chunk size = 34, compressed flag = 1
DEBUG    Checking DirEntry #23
DEBUG    Reading data from stream 'S4oi7'
DEBUG    Found VBA compressed code at index 325
DEBUG    chunk size = 178, compressed flag = 1
DEBUG    Checking DirEntry #24
DEBUG    Reading data from stream 'L87z'
DEBUG    Found VBA compressed code at index 325
DEBUG    chunk size = 176, compressed flag = 1
DEBUG    Checking DirEntry #25
DEBUG    Reading data from stream 'Suw46'
DEBUG    Found VBA compressed code at index 325
DEBUG    chunk size = 178, compressed flag = 1
DEBUG    Checking DirEntry #26
DEBUG    Reading data from stream 'XVBA_PROJECT'
DEBUG    Checking DirEntry #27
DEBUG    Reading data from stream 'dir'
DEBUG    Checking DirEntry #28
DEBUG    Reading data from stream '__SRP_0'
DEBUG    Checking DirEntry #29
DEBUG    Reading data from stream '__SRP_1'
DEBUG    Checking DirEntry #30
DEBUG    Reading data from stream 'PROJECTwm'
DEBUG    Checking DirEntry #31
DEBUG    Reading data from stream 'PROJECT'
DEBUG    Checking DirEntry #32
DEBUG    Reading data from stream '\x01CompObj'
DEBUG    Checking DirEntry #33
DEBUG    Checking DirEntry #34
DEBUG    Checking DirEntry #35
DEBUG    Analysing the P-code to detect VBA stomping
DEBUG    Calling pcodedmp to extract and disassemble the VBA P-code
DEBUG    before pcodedmp
INFO     Opening OLE file fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8
INFO     Check whether OLE file is PPT
DEBUG    using open OleFileIO
DEBUG    File appears not to be a ppt file (In stream "root" for field "listdir" found value "[['\x01CompObj'], ['\x05DocumentSummaryInformation'], ['\x05SummaryInformation'], ['1Table'], ['Data'], ['ObjectPool', '_1608932915', '\x01CompObj'], ['ObjectPool', '_1608932915', '\x03OCXNAME'], ['ObjectPool', '_1608932915', '\x03ObjInfo'], ['ObjectPool', '_1608932915', '\x03PRINT'], ['ObjectPool', '_1608932915', 'contents'], ['WordDocument']]" but expected len = 1!)
DEBUG    VBA_Parser.find_vba_projects
DEBUG    Checking storage ['ObjectPool']
DEBUG    Checking storage ['ObjectPool', '_1608932915']
DEBUG    Checking storage ['Xacros']
DEBUG    after pcodedmp
DEBUG    pcodedmp OK
DEBUG    Keywords extracted from P-code: []
INFO     Error processing file fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8 (can't concat str to bytes)
DEBUG    Traceback:
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3703, in process_file
    self.run_analysis(show_decoded_strings=show_decoded_strings, deobfuscate=deobfuscate)
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3601, in run_analysis
    self.analyze_macros(show_decoded_strings, deobfuscate)
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3250, in analyze_macros
    for (_, _, _, vba_code) in self.extract_all_macros():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3229, in extract_all_macros
    for (subfilename, stream_path, vba_filename, vba_code) in self.extract_macros():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3213, in extract_macros
    if self.detect_vba_stomping():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3549, in detect_vba_stomping
    vba_code_all_modules += vba_code + '\n'
TypeError: can't concat str to bytes
DEBUG    Checking for encryption (after exception)
DEBUG    is_encrypted
DEBUG    Checking for encryption using msoffcrypto
ERROR    Error processing file fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8 (can't concat str to bytes)!
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3703, in process_file
    self.run_analysis(show_decoded_strings=show_decoded_strings, deobfuscate=deobfuscate)
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3601, in run_analysis
    self.analyze_macros(show_decoded_strings, deobfuscate)
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3250, in analyze_macros
    for (_, _, _, vba_code) in self.extract_all_macros():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3229, in extract_all_macros
    for (subfilename, stream_path, vba_filename, vba_code) in self.extract_macros():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3213, in extract_macros
    if self.detect_vba_stomping():
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3549, in detect_vba_stomping
    vba_code_all_modules += vba_code + '\n'
TypeError: can't concat str to bytes

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3987, in process_file
    deobfuscate=options.deobfuscate, pcode=options.pcode)
  File "/usr/local/lib/python3.6/dist-packages/oletools/olevba.py", line 3776, in process_file
    raise ProcessingError(self.filename, exc)
oletools.olevba.ProcessingError: Error processing file fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8 (can't concat str to bytes)
DEBUG    will exit now with code 6

Version information:

OS: Linux
OS version: 18.04- 64 bits
Python version: 3.6 - 64 bits
oletools version: olevba 0.55.dev2

The text was updated successfully, but these errors were encountered:

martinvonwittich · 2020-08-11T10:54:30Z

Any progress on this? We rely on mraptor to detect incoming macro viruses in our mail server, but unfortunately, Emotet seems to get through because of this bug (full mraptor -l debug output attached):

server ~/x # mraptor Anhange_0_848416.doc                       
MacroRaptor 0.54 - http://decalage.info/python/oletools
This is work in progress, please report issues at https://github.com/decalage2/oletools/issues
----------+-----+----+--------------------------------------------------------
Result    |Flags|Type|File                                                    
----------+-----+----+--------------------------------------------------------
ERROR     |     |OLE:|Anhange_0_848416.doc                                    
          |     |    |can't concat str to bytes                               

Flags: A=AutoExec, W=Write, X=Execute
Traceback (most recent call last):
  File "/usr/bin/mraptor", line 11, in <module>
    load_entry_point('oletools==0.55.dev3', 'console_scripts', 'mraptor')()
  File "/usr/lib/python3.7/dist-packages/oletools/mraptor.py", line 349, in main
    print('Exit code: %d - %s' % (exitcode, global_result.name))
AttributeError: 'NoneType' object has no attribute 'name'

sample.zip (password oletools)
debug.log

martinvonwittich · 2020-08-11T11:14:41Z

The following issues seem to be duplicates or at least related to this issue:

#593
#587
#477

gernotschilling · 2020-08-12T11:48:55Z

two problems here:

mraptor.py: the continues in the exception handling skip the global_error setting part at the end of the loop
olevba.py: decompress returns bytes, but extract_macros expects strings.

i think the last problem means, that any compressed vba code will trigger the concat error in python3.

a patch is here:
https://gist.github.com/gernotschilling/9f29e26e3e54b469b8904dcf7c28de79

a similar solution is given in
#587 (comment)

i will add a pull request later today.

gernotschilling · 2020-08-12T12:12:12Z

Pull request:
#597

decalage2 · 2020-09-16T19:31:13Z

@0xcpu you reported this bug a long time ago, but would it be possible to share the sample that triggered it? You can upload it here in a zip with password infected, for example. Or upload it to an online sandbox that allows downloads, such as app.any.run or hybrid-analysis.com.
I think I fixed the bug, so I'd like to test it with your sample.

0xcpu · 2020-09-16T19:52:23Z

@0xcpu you reported this bug a long time ago, but would it be possible to share the sample that triggered it? You can upload it here in a zip with password infected, for example. Or upload it to an online sandbox that allows downloads, such as app.any.run or hybrid-analysis.com.
I think I fixed the bug, so I'd like to test it with your sample.

Hey @decalage2, sure. Here's the sample, password: decalage2.
fe572d860bd5523170e27cb24b5ee09c97c826046acaa08175d41035fbb019e8.zip

decalage2 · 2020-09-16T20:44:27Z

OK, it took me a while to find the root cause of this issue, which is common to issues #455, #477, #587, #593. Here's a quick summary.
What happens when everything goes well:

VBA_Parser uses find_vba_projects to find the root storage of each VBA project in the file
For each project, a VBA_Project object is created
VBA_Project parses the dir stream, to extract many attributes of the VBA project, including the code page (encoding of the VBA source code)
For each module in the VBA project, the VBA source code is decompressed. We get a raw bytes string, encoded with the project code page. In Western countries, the code page is usually 1252 but it may be different if the VBA code was typed in a Russian or Chinese system.
The raw bytes string is decoded to Unicode, using the project code page.
On Python 3, the VBA source code is returned as Unicode (native str). On Python 2, the VBA source code is re-encoded from Unicode to UTF-8, and returned as bytes (native str for py2). So whatever the Python version, the VBA source code is always returned as a native str.
Then the statement vba_code_all_modules += vba_code + '\n' works fine.

The bug happens when the parsing of the VBA project streams fails (for different reasons):

Either the VBA_Project object is not created because the dir stream contains invalid values (issues olevba exception when PROJECTLCIDINVOKE is not en-us #477, UnexpectedDataError: Unexpected value in Macros/VBA/dir for variable PROJECTDOCSTRING_Id #593) and we're not in relaxed mode.
Or find_vba_projects does not find the root storage of a VB Project (issue [olevba] can't concat str to bytes #455 - because the storage "Macros" was renamed "Xacros")
In those cases, olevba will switch to an alternate way to find VBA modules (located in VBA_Parser.detect_vba_macros): it will look at every stream in the file, and look for the beginning of compressed VBA code, which is always "Attribut\x00".
When a VBA module stream is found, the content is decompressed, and we obtain encoded VBA source code as bytes.
In that case the VBA source code was returned as-is, without decoding to Unicode for Python 3 as it should be. This is the actual bug.
Then the statement vba_code_all_modules += vba_code + '\n' triggers the exception "can't concat str to bytes" on Python 3, and the analysis stops prematurely.

So I fixed olevba so that VBA source code is always returned as Unicode on Python 3, and the exception "can't concat str to bytes" does not appear anymore. This is not perfect, because we have no way to know the code page used to encode the VBA source code, when the VBA project cannot be parsed. So for now I'm just using code page 1252, which should work in most cases but not always.

…tect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)

…ge2#593), fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues decalage2#455, decalage2#477, decalage2#587, decalage2#593)

decalage2 · 2020-10-04T21:01:07Z

This issue is now fixed in oletools 0.56.

decalage2 self-assigned this Jun 23, 2019

decalage2 added 🐛 bug olevba Python 3.x labels Jun 23, 2019

decalage2 added this to the oletools 0.55 milestone Jun 23, 2019

kscieslinski mentioned this issue Aug 20, 2020

Find office file entry points via callgraph CERT-Polska/drakvuf-sandbox#215

Merged

decalage2 linked a pull request Aug 26, 2020 that will close this issue

mraptor: fix the behaviour in case of error #597

Open

decalage2 mentioned this issue Sep 14, 2020

UnexpectedDataError: Unexpected value in Macros/VBA/dir for variable PROJECTDOCSTRING_Id #593

Closed

This was referenced Sep 16, 2020

olevba exception when PROJECTLCIDINVOKE is not en-us #477

Closed

Exception can't concatenate str to bytes python 3 #587

Closed

decalage2 added a commit that referenced this issue Sep 16, 2020

olevba: enabled relaxed mode by default (issues #477, #593), fixed de…

e7e7f97

…tect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)

decalage2 removed a link to a pull request Sep 16, 2020

mraptor: fix the behaviour in case of error #597

Open

decalage2 modified the milestones: oletools 0.55, oletools 0.56 Sep 23, 2020

This was referenced Sep 24, 2020

Several str to bytes errors with python 3.7.x #622

Closed

Multiple issues extracting macro. #623

Closed

decalage2 mentioned this issue Oct 4, 2020

Fix TypeError in VBA_Parser.analyze_macros() (can't concat bytes to s… #429

Closed

decalage2 closed this as completed Oct 4, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[olevba] can't concat str to bytes #455

[olevba] can't concat str to bytes #455

0xcpu commented Jun 21, 2019

martinvonwittich commented Aug 11, 2020

martinvonwittich commented Aug 11, 2020

gernotschilling commented Aug 12, 2020

gernotschilling commented Aug 12, 2020 •

edited

Loading

decalage2 commented Sep 16, 2020

0xcpu commented Sep 16, 2020 •

edited

Loading

decalage2 commented Sep 16, 2020 •

edited

Loading

decalage2 commented Oct 4, 2020 •

edited

Loading

[olevba] can't concat str to bytes #455

[olevba] can't concat str to bytes #455

Comments

0xcpu commented Jun 21, 2019

martinvonwittich commented Aug 11, 2020

martinvonwittich commented Aug 11, 2020

gernotschilling commented Aug 12, 2020

gernotschilling commented Aug 12, 2020 • edited Loading

decalage2 commented Sep 16, 2020

0xcpu commented Sep 16, 2020 • edited Loading

decalage2 commented Sep 16, 2020 • edited Loading

decalage2 commented Oct 4, 2020 • edited Loading

gernotschilling commented Aug 12, 2020 •

edited

Loading

0xcpu commented Sep 16, 2020 •

edited

Loading

decalage2 commented Sep 16, 2020 •

edited

Loading

decalage2 commented Oct 4, 2020 •

edited

Loading