LinuxCommandLibrary

oletools

collection of Python tools for analyzing Microsoft Office documents

TLDR

Analyze document with oleid

$ oleid [document.doc]
copy
Extract VBA macros
$ olevba [document.xlsm]
copy
Detect malicious macros
$ mraptor [document.doc]
copy
Find RTF exploits
$ rtfobj [document.rtf]
copy
Analyze OLE structure
$ olemeta [document.doc]
copy
Check for Flash
$ oleobj [document.pptx]
copy

SYNOPSIS

oletools - Python tools for analyzing Office documents

DESCRIPTION

oletools is a collection of Python tools for analyzing Microsoft Office documents (OLE, VBA, Office Open XML). It's commonly used for malware analysis and detecting malicious documents.
The toolkit includes multiple specialized tools for different analysis tasks.

INCLUDED TOOLS

$ oleid    - Quick analysis, indicators
olevba   - Extract/analyze VBA macros
mraptor  - Detect malicious VBA
olemeta  - Show metadata
oleobj   - Extract embedded objects
rtfobj   - Analyze RTF files
oletimes - Show timestamps
oledir   - List OLE directory
copy

INSTALLATION

$ pip install oletools
copy

CAVEATS

Python package required. Heuristic detection may have false positives. Cannot decrypt password-protected files.

HISTORY

oletools was created by Philippe Lagadec for analyzing potentially malicious Office documents, widely used in malware analysis and incident response.

SEE ALSO

oleid(1), olevba(1), mraptor(1), yara(1)

> TERMINAL_GEAR

Curated for the Linux community

Copied to clipboard

> TERMINAL_GEAR

Curated for the Linux community