oleid - macro not detected in docm file

[decalage2]

Issue submitted on Bitbucket: https://bitbucket.org/decalage/oletools/issues/43/oleid-macro-not-detected-in-docm-file

Hello, this sample contains macros, but oleid does not see them: https://www.hybrid-analysis.com/sample/5966ff898559a193d6335ab7b95af868b2710813e95ebfcb48dca2c93d6886d4?environmentId=100

+------------+-------+ | Indicator | Value | +------------+-------+ | OLE format | False | +------------+-------+

Thanks for your help

Sample (malware): https://bitbucket.org/decalage/oletools/issues/attachments/43/decalage/oletools/1469543517.13/43/COPY0000684.docm

[decalage2]

Indeed, oleid has not been improved for a while. For now, it can only process OLE files (MS Office 97-2003), not the newer MS Office 2007+ formats (docm, xlsm, etc).

oleid should rely on olevba+mraptor to detect macros in all MS Office formats.