Invalid CompressedChunkSignature in VBA compressed stream

[decalage2]

Originally reported by: Anonymous

---

#!code

cuckoo@cuckoo-process:/tmp/decalage-oletools-d3c1e4fd0bb0/oletools$ python olevba.py bad.xls
olevba 0.42 - http:https://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
!ERROR       bad.xls - Invalid CompressedChunkSignature in VBA compressed stream

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, TXT=Text, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: bad.xls
Type: OLE
No suspicious keyword or IOC found.

cuckoo@cuckoo-process:/tmp/decalage-oletools-d3c1e4fd0bb0/oletools$ md5sum bad.xls
d838f59f1c8769fbf4cff10f73255c0a  bad.xls

---

• Bitbucket: https://bitbucket.org/decalage/oletools/issue/30

[jslirola]

Is there any update? Still is present on v0.53.1

Edit: I did some tests and finally is working. I had an old version of oletools that was overwriting the most recent version.