oletools

python-oletools oletools is a package of python tools to analyze Microsoft OLE2 files also called Structured Storage, Compound File Binary Format or Compound Document File Format, such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and...

EUVD-2000-0276

Malware in sbrugna...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

PT-2022-36938

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a heap-double-free crash. The crash occurs in the following functions: cli extract xlm macros and images, cli ole2 scan tempdir, a...

clamav:clamav_scanfile_OLE2_fuzzer: Heap-double-free in cli_extract_xlm_macros_and_images

Detailed Report: https://oss-fuzz.com/testcase?key=5377513273032704 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavscanfileOLE2fuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x60300017fc00 Crash State: cliextractxlmmacrosandimages...

PT-2022-37282

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a heap-double-free crash. The crash occurs in the following functions: cli extract xlm macros and images, cli ole2 scan tempdir, a...

clamav:clamav_scanfile_OLE2_fuzzer: Heap-double-free in cli_extract_xlm_macros_and_images

Detailed Report: https://oss-fuzz.com/testcase?key=4967049879748608 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavscanfileOLE2fuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x602000007370 Crash State: cliextractxlmmacrosandimages...

At long last, Microsoft is disabling Excel 4.0 macros by default

Sometimes good news in the security world comes unexpectedly. This is one of those times. After three decades of macro viruses, and three decades of trying to convince every single Excel user individually to disable macros, Microsoft is going disable Excel 4.0 macros for everyone. Better late tha...

XLMMacroDeobfuscator - Extract And Deobfuscate XLM Macros (A.K.A Excel 4.0 Macros)

XLMMacroDeobfuscator can be used to decode obfuscated XLM macros also known as Excel 4.0 macros. It utilizes an internal XLM emulator to interpret the macros, without fully performing the code. It supports both xls, xlsm, and xlsb formats. It uses xlrd2, pyxlsb2 and its own parser to extract cell...

XLM + AMSI: New runtime defense against Excel 4.0 macro malware

We have recently expanded the integration of Antimalware Scan Interface AMSI with Office 365 to include the runtime scanning of Excel 4.0 XLM macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros. This integration, an example of the many security feature...

XLM + AMSI: New runtime defense against Excel 4.0 macro malware

We have recently expanded the integration of Antimalware Scan Interface AMSI with Office 365 to include the runtime scanning of Excel 4.0 XLM macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros. This integration, an example of the many security feature...

Microsoft Office for Mac cannot properly disable XLM macros

Overview The Microsoft Office for Mac option "Disable all macros without notification" enables XLM macros without prompting, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description XLM macros Up to and including Microsoft Excel 4.0, a macro...

CVE-2000-0277

Microsoft Excel 97/2000 are affected by the XLM Text Macro vulnerability, where Excel fails to warn when macros in external text files are executed, potentially allowing arbitrary commands via a macro virus. The issue occurs when references to external XLM macro files are present; Excel may not d...