Great, thanks. Here is the output with ‘—debug’: LibClamAV debug: Initialized 0.99.2 engine LibClamAV debug: in cli_ole2_extract() LibClamAV debug: OLE2 magic failed! LibClamAV debug: Cleaning up phishcheck LibClamAV debug: Phishcheck cleaned up
To note, the document opens fine in Microsoft Word, and oletools has no issues dumping out the macros. Best, Jack > On Aug 15, 2016, at 9:19 AM, Steve Basford <steveb_cla...@sanesecurity.com> > wrote: > > > On Mon, August 15, 2016 3:50 pm, Jack wrote: >> Hello, >> >> > >> >> Can someone take a look and determine why there are passing issues? > Hi Jack, > > add --debug on the end... eg... might give you a bit more info... > > sigtool --vba "287DD777DB20BE14F2DD0B9952BECF41.xxx" --debug > LibClamAV debug: Initialized 0.99.2 engine > LibClamAV debug: in cli_ole2_extract() > LibClamAV debug: OLE2 magic failed! > LibClamAV debug: Cleaning up phishcheck > LibClamAV debug: Phishcheck cleaned up > > > Cheers, > > Steve > Web : sanesecurity.com > Twitter: @sanesecurity > > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
