oletools

python-oletools oletools is a package of python tools to analyze Microsoft OLE2 files also called Structured Storage, Compound File Binary Format or Compound Document File Format, such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and...

EXCELntDonut

| \ / / | | | | || \ | | | | \ / | | | | | | ' | | | | |/ | ' | | | | | | | / \ || || || | | | || || | | | | | || | | |//\|||| |||/ /|| ||,|| by @JoeLeonJr @FortyNorthSec EXCELntDonut is a XLM Excel 4.0 macro generator. Start with C source code EXE and end with a XLM Excel 4.0 macro that...

boobsnail

Follow us on Twitter! BoobSnail BoobSnail allows generating XLM Excel 4.0 macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation. Features: various infection techniques; various obfuscation techniques; translation of formulas into languages other than English; can be us...

Adversarial Robustness in Smishing Detection: A Comparative Analysis of Adversarial Fragility in Classical Vs. Transformer-Based Detection Systems

Smishing detection systems are commonly trained and evaluated on clean, monolingual text. In low-resource settings, however, attackers frequently circumvent these systems through character obfuscation, cross-lingual code-switching, and structural perturbation. This study evaluates adversarial...

EUVD-2000-0276

Malware in sbrugna...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

OSV-2022-337 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46586 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir climagicscan...

PT-2022-36938

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a heap-double-free crash. The crash occurs in the following functions: cli extract xlm macros and images, cli ole2 scan tempdir, a...

clamav:clamav_scanfile_OLE2_fuzzer: Heap-double-free in cli_extract_xlm_macros_and_images

Detailed Report: https://oss-fuzz.com/testcase?key=5377513273032704 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavscanfileOLE2fuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x60300017fc00 Crash State: cliextractxlmmacrosandimages...

OSV-2022-90 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44040 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir cliscanole2...

PT-2022-37282

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a heap-double-free crash. The crash occurs in the following functions: cli extract xlm macros and images, cli ole2 scan tempdir, a...

Microsoft is now disabling Excel 4.0 macros by default

Back in October 2021, Microsoft announced in an email to customers that it planned to disable Excel 4.0 macros by default to protect customers from malicious documents. Last week—after three decades of macro viruses, and three decades of trying to convince every single Excel user individually to...

clamav:clamav_scanfile_OLE2_fuzzer: Heap-double-free in cli_extract_xlm_macros_and_images

Detailed Report: https://oss-fuzz.com/testcase?key=4967049879748608 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavscanfileOLE2fuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x602000007370 Crash State: cliextractxlmmacrosandimages...

Microsoft is now disabling Excel 4.0 macros by default

Back in October 2021, Microsoft announced in an email sent to customers that it planned to disable Excel 4.0 macros by default to protect customers from malicious documents. Now, Microsoft says that change has happened. Good news Sometimes good news in the security world comes later than expected...

At long last, Microsoft is disabling Excel 4.0 macros by default

Sometimes good news in the security world comes unexpectedly. This is one of those times. After three decades of macro viruses, and three decades of trying to convince every single Excel user individually to disable macros, Microsoft is going disable Excel 4.0 macros for everyone. Better late tha...

ROS-2-1184

2.1184 Multiple vulnerabilities in ClamAV antivirus package CVE-2021-1252, CVE-2021-1404, CVE-2021-1405 1. Vulnerability Description: CVE-2021-1252 - looping when processing specially formatted Excel XLM files. CVE-2021-1404 - process crash when processing specially formatted PDF documents...

XLMMacroDeobfuscator - Extract And Deobfuscate XLM Macros (A.K.A Excel 4.0 Macros)

XLMMacroDeobfuscator can be used to decode obfuscated XLM macros also known as Excel 4.0 macros. It utilizes an internal XLM emulator to interpret the macros, without fully performing the code. It supports both xls, xlsm, and xlsb formats. It uses xlrd2, pyxlsb2 and its own parser to extract cell...

ClamAV Macro Analysis DoS

The vulnerability of the Excel XLM module in the ClamAV antivirus software package exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : ClamAV vulnerabilities (USN-4918-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4918-1 advisory. It was discovered that ClamAV incorrectly handled parsing Excel documents. A remote attacker could possibly use this issue to cau...

SUSE: Security Advisory (SUSE-SU-2021:1174-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...