Ok, I found my way!
The first 8 bytes after [0x10] are a OLE date in little endian hex.
I converted them to a regular datetime in python with:
import datetime
import math
from struct import unpack
def ole_date_bin_to_datetime(ole_date_bin):
"""
Converts a OLE date from a binary 8 bytes little endian hex form to a datetime
"""
#Conversion to OLE date float, where:
# - integer part: days from epoch (1899/12/30 00:00)
# - decimal part: percentage of the day, where 0,5 is midday
date_float = unpack('<d', ole_date_bin)[0]
date_decimal, date_integer = math.modf(date_float)
date_decimal = abs(date_decimal)
date_integer = int(date_integer)
#Calculate the result
res = datetime.datetime(1899, 12, 30) + datetime.timedelta(days=date_integer) #adding days to epoch
res = res + datetime.timedelta(seconds = 86400*date_decimal) #adding percentage of the day
return res
if __name__ == "__main__":
print ole_date_bin_to_datetime('\xd0\x74\xc4\xfe\x3f\x42\xe3\x40')