Crashes attempting to dump malicious spreadsheet about macrome HOT 8 CLOSED

Samples emailed.
John

from macrome.

deobfuscate DID work on this test spreadsheet

from macrome.

Yup, I'd call this a bug. Do you feel comfortable sharing this file, or a similar file that causes the crash? I can't fix this issue without being able to reproduce it locally unfortunately.

My guess is that whatever cell is at A14 is what's causing it to blow up, so if you can't share it, but you can somehow open the file in Excel and copy paste out that cell's contents, I can probably try to fix that as well.

If I had to guess, it's because of the ARGUMENT usage - I've never actually seen that used before, but my guess is that after defining the argument for a user defined function and then invoking it, there's some extra garbage added to that invocation's BIFF record and that's what's causing problems.

from macrome.

from macrome.

I attached the files to that email. I'm hoping you received them, and that github didn't just filter them out.
John

from macrome.

Unfortunately it looks like the attachments got eaten. Depending on what your personal opsec thresholds are there's a few options here:

1. Email it directly to me at mi[c]h[a]el[[.]]]we[][]ber[][@]][[malw][[are][.]piz[]]za (with no []s in it).
2. Host it somewhere you feel comfortable, provide a link, and then delete the files after I verify I've grabbed them. You can send me the link via email if you like.
3. Use the github site to reply to this, and then you can drag+drop the zip file as an attachment. I'll delete the issue post after I grab the files.
4. I'm open to other suggestions as well.

The bug is definitely in my formula parsing code, but I'm not entirely sure where it might be.

Cheers!
-Mike

from macrome.

@johnmccash

I was able to use the samples you sent me to improve Macrome's parsing of BiffRecords, specifically with regards to funky ranges which create extra PtgRange and PtgMemArea records. These were previously unhandled - they will now properly dump information.

If you're comfortable pulling down the latest code and compiling it, give it a try - otherwise I'll push a release in the coming days and you can work with that.

Thanks for helping improve this tool!

from macrome.

I've pushed a release containing the fix for this issue. Going to close for now, but if errors continue popping up please reopen it!

from macrome.