oletools icon indicating copy to clipboard operation
oletools copied to clipboard

ftguess: file type not detected due to lack of root storage CLSID

Open decalage2 opened this issue 8 months ago • 0 comments

An OLE file without root storage CLSID is not properly identified by ftguess, for example this sample: 167949ba90da85c8b56878d95be19c1a - https://app.any.run/tasks/b42b3dff-1ff9-49ac-96f6-df8e4d9927bd/#

ftguess.py khaosat_trieuchung.doc
ftguess 0.60.2dev3 on Python 3.9.0 - http://decalage.info/python/oletools
THIS IS WORK IN PROGRESS - Check updates regularly!
Please report any issue at https://github.com/decalage2/oletools/issues

File       : khaosat_trieuchung.doc
File Type  : Generic OLE/CFB file
Description: Generic OLE file / Compound File (unknown format)
Application: Unknown Application
Container  : OLE
Root CLSID :  - None
Content-type(s) :
PUID       : None

It would be possible to enhance format detection by checking the presence of well-known stream names such as WordDocument for Word, and also the application name in document properties:

oledir khaosat_trieuchung.doc
oledir 0.54 - http://decalage.info/python/oletools
OLE directory entries in file khaosat_trieuchung.doc:
----+------+-------+----------------------+-----+-----+-----+--------+------
id  |Status|Type   |Name                  |Left |Right|Child|1st Sect|Size
----+------+-------+----------------------+-----+-----+-----+--------+------
0   |<Used>|Root   |Root Entry            |-    |-    |3    |34      |4928
1   |<Used>|Stream |1Table                |-    |5    |-    |D       |9645
2   |<Used>|Stream |WordDocument          |1    |-    |-    |0       |6190
3   |<Used>|Stream |\x05SummaryInformation|2    |4    |-    |20      |4096
4   |<Used>|Stream |\x05DocumentSummaryInf|-    |-    |-    |28      |4096
    |      |       |ormation              |     |     |     |        |
5   |<Used>|Storage|Macros                |-    |-    |12   |0       |0
6   |<Used>|Storage|VBA                   |-    |-    |7    |0       |0
7   |<Used>|Stream |ThisDocument          |8    |9    |-    |0       |954
8   |<Used>|Stream |NewMacros             |10   |-    |-    |3D      |10589
9   |<Used>|Stream |_VBA_PROJECT          |-    |-    |-    |F       |2710
10  |<Used>|Stream |dir                   |-    |-    |-    |3A      |569
11  |<Used>|Stream |PROJECTwm             |-    |-    |-    |43      |71
12  |<Used>|Stream |PROJECT               |6    |11   |-    |45      |487
13  |ORPHAN|Stream |\x01CompObj           |-    |-    |-    |4D      |114
14  |unused|Empty  |                      |-    |-    |-    |0       |0
15  |unused|Empty  |                      |-    |-    |-    |0       |0
----+----------------------------+------+--------------------------------------
id  |Name                        |Size  |CLSID
----+----------------------------+------+--------------------------------------
0   |Root Entry                  |-     |
4   |\x05DocumentSummaryInformati|4096  |
    |on                          |      |
3   |\x05SummaryInformation      |4096  |
1   |1Table                      |9645  |
5   |Macros                      |-     |
12  |  PROJECT                   |487   |
11  |  PROJECTwm                 |71    |
6   |  VBA                       |-     |
8   |    NewMacros               |10589 |
7   |    ThisDocument            |954   |
9   |    _VBA_PROJECT            |2710  |
10  |    dir                     |569   |
2   |WordDocument                |6190  |
olemeta khaosat_trieuchung.doc
olemeta 0.54 - http://decalage.info/python/oletools
THIS IS WORK IN PROGRESS - Check updates regularly!
Please report any issue at https://github.com/decalage2/oletools/issues
===============================================================================
FILE: khaosat_trieuchung.doc

Properties from the SummaryInformation stream:
+---------------------+------------------------------+
|Property             |Value                         |
+---------------------+------------------------------+
|codepage             |1252                          |
|title                |                              |
|subject              |                              |
|author               |HANH-PC                       |
|keywords             |                              |
|comments             |                              |
|template             |Normal                        |
|last_saved_by        |hanhnm                        |
|revision_number      |5                             |
|total_edit_time      |180                           |
|create_time          |2021-09-18 12:02:00           |
|last_saved_time      |2021-09-28 17:09:00           |
|num_pages            |2                             |
|num_words            |155                           |
|num_chars            |888                           |
|creating_application |Microsoft Office Word         |
|security             |0                             |
+---------------------+------------------------------+

Properties from the DocumentSummaryInformation stream:
+---------------------+------------------------------+
|Property             |Value                         |
+---------------------+------------------------------+
|codepage_doc         |1252                          |
|lines                |7                             |
|paragraphs           |2                             |
|scale_crop           |False                         |
|company              |                              |
|links_dirty          |False                         |
|chars_with_spaces    |1041                          |
|shared_doc           |False                         |
|hlinks_changed       |False                         |
|version              |983040                        |
+---------------------+------------------------------+

decalage2 avatar Oct 17 '23 21:10 decalage2