 In this video, I want to show you how you can deal with olivies that are corrupt. So I have a sample here, this one. If we analyze it with olidump, you can just see the five streams that you would find in a simple Word document without any VBA micros. But if you look here at the sides, there's all the streams, and you add them together, you arrive at about 20k. While if you look at the file size here, we are almost speaking of an 80k file. So there's a lot of bytes here in this file that are not stored into streams. Now if we do a strings on this sample and pipe this through less, you can see here the beginning of the strings. And now let's search for attribute. A normal macro, a normal VBA macro that is compressed, will start with the keyword attribute. So if we search for attribute here, we find attribute here, we can actually see a compressed macro. So here you can read VBA name, this document. And if we look for the next one, we see another one, VBA name equals module one. Then public, dati, cartelino, and so on. Next one, we don't have anyone. So although this document here doesn't actually contain streams with VBA macros, there are still VBA macros, compressed VBA macros hidden somewhere in this file. And we can use olidump to search for these compressed VBA macros. And we do this by using option row, the R for initial row. So a row file is not an only file, but a file that contains compressed VBA macros. And we want to decompress the file, so option V, and the file. So now olidump will search for that attribute keyword and then try to decompress the macro. And here it found one, but it was not able to decompress it, and that is because it is corrupt. But we can force olidump to try to decompress as much as it can. And you do that with option VBA decompress corrupt, like this. And as you can see now here, we have a macro, now the open macro. This is actually not the normal name, but anyway. And then here some extra data that looks like it is actually garbage. So by using row, we can still extract a macro. But this row option will only extract the first stream that it finds. And we saw here that we have two streams. So now we are going to select that second stream in that only file. So I mean not the second stream, but I mean that second compressed VBA macro. And then pass that on to olidump. And we can do that with cut bytes, where we search for attribute like this. We search for the second instance, so not the first time we find attribute, but the second time. Sorry, and I have to quote this, like this. So the second instance, and then we return four bytes, so minus four. And then the rest of the stream, like this. So let me pipe this through list so that you can see already the result of this cut operation. And here you can see that attribute VBA module one is selected. So that's what we want. So we can pass this on to olidump, row, decompress. We have an error. So here also the compressed VBA is corrupt. And let's pipe this through list. Okay, and here now we see the macro. This array of integers is actually an encoded URL. You can decode it, but I have a plugin to do this. But let me go to the end, like this. And here now you can see that we have a lot of lines that are being repeated. And this is again, and here control characters, and this is again an indication of corrupt macros. So let's use the plugin. Linear is the plugin to decode this array of integers. And now here you have the URL.