.xls malicious sample not processed with doc_info analyzer

[ManaswibRane]

What happened

Tried analyzing this sample .xls
https://bazaar.abuse.ch/sample/49b9c15adfd52643c9e980a92af5ea642e3d21efaa0022632cbafca87daeb0b0/ with doc_info and file_info
It is caused due to the categorization of files used (libmagic)

We might want to add more tools for analysis like oledump. Thats how I extracted and found a word doc embeaded in the xls.
Also maybe improve the doc_info analyzer

Environment

1. OS: Linux
2. IntelOwl version: v 6.6.1

What did you expect to happen

How to reproduce your issue

use the sample in the analyzer

Error messages and logs

XLMMacroDeobfuscator

Exiftool

the embeaded doc

[mlodic]

I don't think it is a bug, it's just a weird behavior of this specific sample and you need to know that the specific "32" section ID must be extracted to get the doc file, which is something that can't be done completely automatically so it still requires human intervention.

If you like, we can still add a new analyzer that supports oledump where the user would provide the input of section ID as a mandatory requirement. What do you think?

[ManaswibRane]

Agree.Cool, I was thinking of a similar playbook too and test available samples.