A quick bugfix and a new feature.
oledump will now correctly handle OLE files with an empty storage. Here is an example with a malicious sample that blog readers reported to me:
And when the OLE file contains a stream with VBA code, but this code is just a set of Attribute statements and nothing else, then the indicator will be a lowercase letter m instead of an uppercase letter M.
This way, you can quickly identify interesting VBA streams to analyze.
oledump_V0_0_5.zip (https)
MD5: A712DCF508C2A0184F751B74FE7F513D
SHA256: E9106A87386CF8512467FDD8BB8B280210F6A52FCBACEEECB405425EFE5532D9
Didier Stevens 
Leave a Reply (comments are moderated)