Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Files in test-data triigerclamsca virus detections #867

Open
brett060102 opened this issue Oct 15, 2024 · 0 comments
Open

Files in test-data triigerclamsca virus detections #867

brett060102 opened this issue Oct 15, 2024 · 0 comments
Assignees
Milestone

Comments

@brett060102
Copy link

Affected tool:
olevba, mraptor, rtfobj, oleid, etc

Describe the bug
The following files test data files trigger clamscan virus check errors:
tests/test-data/msodde/dde-test.xlsm: Doc.Dropper.Agent-6423249-0 FOUND
tests/test-data/msodde/dde-test.docx: Doc.Exploit.DDEautoexec-6346603-1 FOUND
tests/test-data/msodde/dde-test.docm: Doc.Exploit.DDEautoexec-6346603-1 FOUND
ttests/est-data/msodde/dde-test-from-office2016.doc: Doc.Exploit.DDEautoexec-6352494-0 FOUND
tests/test-data/rtfobj/issue_251.rtf: Rtf.Exploit.CVE_2018_0802-6624871-1 FOUND

File/Malware sample to reproduce the bug
scanning files with clamscan will display the error

How To Reproduce the bug
scan test data files with clamscan

Expected behavior
no viruses found

Console output / Screenshots
If applicable, add screenshots to help explain your problem.
Use the option "-l debug" to add debugging information, if possible.

Version information:

  • oletools version: all, files in preset in master branch and unchanged in last 7 years.

Additional context
We have automated virus scans using clamscan on incoming code. The clamscan failures cause us to reject the zip file
created from github.

@decalage2 decalage2 self-assigned this Oct 16, 2024
@decalage2 decalage2 added this to the oletools 0.60 milestone Oct 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants
@decalage2 @brett060102 and others