Strip option removes useful statements

[joseph-hannon]

Using the -s option means the sample I'm looking at isn't parsed as well. Without stripping the Application.Run() command is found, with stripping it isn't.

To Reproduce
Dridex sample I'm testing is here: http://malwaretech.com/downloads/dridex.zip
I extracted the VBA macro into a seperate .vba file using oledump, hosted on Pastebin.
Compare the results of the two commands:
python vmonkey.py ./dridex.vba
python vmonkey.py -s ./dridex.vba

Expected behavior
To have the same analysis, with the stripped one obviously having less statements if they are genuinely useless.

Screenshots
Screenshot of stripped (worse) output

Screenshot of the non-stripped (better) output

Desktop (please complete the following information):

• Linux, remnux-6.0, latest updates

[joseph-hannon]

Looks like this might be fixed in @kirk-sayre-work 's branch, will test later:
kirk-sayre-work@50592b9