Welcome to olefile Discussions!

[decalage2]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[rickhenderson]

Well, too bad this doesn't get more use!
I'm working with a lot of maldocs these days, currently looking at Emotet samples that use Excel4 macros. I have to be very careful not to detonate them on our work network, but luckily I can use LibreOffice and they won't execute (secret technique! works on Windows too).

Anyway, I'm getting samples from Japan that none of the oletools are able to recognize properly. I was able to get this far into finding out that the magic numbers do not match what oletools is looking for:

olefile version 0.46 2018-09-09 - https://www.decalage.info/en/olefile

DEBUG    File size: 42412 bytes (A5ACh)
DEBUG    Magic = b'PK\x03\x04\x14\x00\x00\x08' instead of b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1'
ERROR    not an OLE2 structured storage file
ERROR    Error while parsing file 'simple2022-03-15_1058.ods'
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/olefile/olefile.py", line 2314, in main
    ole = OleFileIO(filename)#, raise_defects=DEFECT_INCORRECT)
  File "/usr/local/lib/python3.8/dist-packages/olefile/olefile.py", line 1075, in __init__
    self.open(filename, write_mode=write_mode)
  File "/usr/local/lib/python3.8/dist-packages/olefile/olefile.py", line 1192, in open
    self._raise_defect(DEFECT_FATAL, "not an OLE2 structured storage file")
  File "/usr/local/lib/python3.8/dist-packages/olefile/olefile.py", line 1105, in _raise_defect
    raise exception_type(message)
OSError: not an OLE2 structured storage file

Yes, it's some kind of compression appearing, but when the document is saved as .xlsm, .xlsx, or even .ods it does not change.

Any suggestions or do you think there is some fix might be required in olefile?

[decalage2]

Hello, from the filename with an ".ods" extension, it looks like the file is an OpenDocument spreadsheet (https://www.libreoffice.org/discover/what-is-opendocument/), not a Microsoft Office file. So It's normal that oletools cannot analyse it. I would need the original file in Excel format (.xlsm) to check if there is an issue. Could you please open an issue on the oletools repository and share the file if possible, so that I can check?

Moreover, olefile is only a parser for OLE files only, e.g. MS Office 97-2003 formats (doc, xls, ppt). It is not meant to parse newer MS Office 2007+ formats (docx, docm, xlsx, xlsm, pptx, pptm), which are zip files containing xml. olefile is just a parser, it does not analyse file contents.
By contrast, oletools is a set of analysis tools, designed to analyse malicious files. Some of the tools like olevba support many more formats than OLE, including the MS Office 2007+ formats and others.