Didier Stevens

Monday 13 June 2016

Update:oledump.py Version 0.0.24

Filed under: My Software,Update — Didier Stevens @ 0:00

oledump.py has the –calc option to calculate the MD5 hashes of each stream (if you need another hash algorithm, use option –extra).

This time I needed the hashes of the decompressed macro streams, and not of the raw streams. So I updated oledump.py to support using options –calc and -v together (and also option –extra and -v). When you use option –calc (or –extra) with option -v, raw macro streams (indicator m or M) will be decompressed and the hash of the decompressed macro will be calculated.

I needed this option to compare two samples that were different, but probably very similar.

Here I can see that the hashes of the macro streams are identical, hence that although I have 2 different samples, the VBA code is identical.


oledump_V0_0_24.zip (https)
MD5: F1BFD24FBC72966D54C365B57E662700
SHA256: 4C175874EFDF7DB3264038BFACFD44F1B9060E834189FF3CBAA6C8EBD9D7F680

Blog at WordPress.com.