Malwrologist

I'm not getting the error 

Amazing instance, I added a few features to handle this instance. But still it needs more features to support this. I am not sure whether this instance is malicious. If...

Thanks for sharing the info. The deobfuscator still cannot fully interpret this sample. So it is better to leave this issue open. I will gradually cover other functionalities.

Can you give me the hash? if it is available on VirusTotal, can you upload it somewhere and send me the link via DM on Twitter (https://twitter.com/DissectMalware)?

I investigated the sample. The problem is that the xlm grammar can parse one statement at a time. In this sample, some of the cells contain more that one statement...

Fixed the grammar to handle multi formulas. It fixes the problem.  However, I should think about a way to properly show the changes to users Currently, users see ...

The issue is fixed but still needs more testing before merging with the master branch 

> > > Just wanted to chime in and say that your branch with the fix has been working wonderfully for me on documents with this issue I've been discovering...

> > > This xlsb sample, ebbf15cc0bedec40e58146d369150ee3 (on VirusTotal), fails with the following error: > > File "/usr/local/lib/python3.6/dist-packages/XLMMacroDeobfuscator/deobfuscator.py", line 1954, in process_file > excel_doc = XLSBWrapper(file_path) > File "/usr/local/lib/python3.6/dist-packages/XLMMacroDeobfuscator/xlsb_wrapper.py", line...

Other similar samples: 27814e7df19b2b3165fd93b8148b22eaafc78cff4f649d16bacf9ba5d2f943f1 77d7cb65a982b20a8176c1f72f897e50a81a8c1fff0837afecda20b9bb1ba843 2fbae9bcd3d74139090c83eae09e7322c7d16b73aee8e648af1984b37552132d