|
In diary entry "VBA Office Document: Which Version?", I explain how to identify the Office version that was used to create a document with VBA macros. I have now an oledump.py plugin (plugin_version_vba) that automates this task:
In this example, the version number is 00AF, and that corresponds to Office 2016 or 2019 32-bit. If the version number is not known, like with this AutoCAD .dwg file, you'll get a question mark:
The version number is 009A, but that does not correspond to an Office version I know.
Didier Stevens |
DidierStevens 649 Posts ISC Handler Dec 23rd 2019 |
| Thread locked Subscribe |
Dec 23rd 2019 2 years ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
