Peter M. Groen / oletools

Commit 1b33934614caa93b98281dbb099a472d989aed5d

Authored by decalage2
1 parent a1f5b281

bumped version to 0.56.2

Inline Side-by-side
Showing 9 changed files with 70 additions and 8 deletions
README.md
  View file @1b33934
... ... @@ -26,6 +26,18 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
26 26 News
27 27 ----
28 28  
  29 +- **2021-05-07 v0.56.2**:
  30 + - olevba:
  31 + - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
  32 + - olevba, mraptor:
  33 + - added detection of Workbook_BeforeClose (issue #518)
  34 + - rtfobj:
  35 + - fixed bug when OLE package class name ends with null characters (issue #507, PR #648)
  36 + - oleid:
  37 + - fixed bug in check_excel (issue #584, PR #585)
  38 + - clsid:
  39 + - added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058
  40 + - added checks to ensure that all CLSIDs are uppercase (PR #678)
29 41 - **2021-04-02 v0.56.1**:
30 42 - olevba:
31 43 - fixed bug when parsing some malformed files (issue #629)
... ...
oletools/README.html
  View file @1b33934
... ... @@ -23,6 +23,30 @@
23 23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
24 24 <h2 id="news">News</h2>
25 25 <ul>
  26 +<li><strong>2021-05-07 v0.56.2</strong>:
  27 +<ul>
  28 +<li>olevba:
  29 +<ul>
  30 +<li>updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)</li>
  31 +</ul></li>
  32 +<li>olevba, mraptor:
  33 +<ul>
  34 +<li>added detection of Workbook_BeforeClose (issue #518)</li>
  35 +</ul></li>
  36 +<li>rtfobj:
  37 +<ul>
  38 +<li>fixed bug when OLE package class name ends with null characters (issue #507, PR #648)</li>
  39 +</ul></li>
  40 +<li>oleid:
  41 +<ul>
  42 +<li>fixed bug in check_excel (issue #584, PR #585)</li>
  43 +</ul></li>
  44 +<li>clsid:
  45 +<ul>
  46 +<li>added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058</li>
  47 +<li>added checks to ensure that all CLSIDs are uppercase (PR #678)</li>
  48 +</ul></li>
  49 +</ul></li>
26 50 <li><strong>2021-04-02 v0.56.1</strong>:
27 51 <ul>
28 52 <li>olevba:
... ... @@ -106,7 +130,7 @@
106 130 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
107 131 </ul>
108 132 <h2 id="projects-using-oletools">Projects using oletools:</h2>
109   -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
  133 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
110 134 <h2 id="download-and-install">Download and Install:</h2>
111 135 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
112 136 <ul>
... ...
oletools/README.rst
  View file @1b33934
... ... @@ -29,6 +29,31 @@ Software.
29 29 News
30 30 ----
31 31  
  32 +- **2021-05-07 v0.56.2**:
  33 +
  34 + - olevba:
  35 +
  36 + - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
  37 +
  38 + - olevba, mraptor:
  39 +
  40 + - added detection of Workbook_BeforeClose (issue #518)
  41 +
  42 + - rtfobj:
  43 +
  44 + - fixed bug when OLE package class name ends with null characters
  45 + (issue #507, PR #648)
  46 +
  47 + - oleid:
  48 +
  49 + - fixed bug in check_excel (issue #584, PR #585)
  50 +
  51 + - clsid:
  52 +
  53 + - added several CLSIDs related to MS Office click-to-run issue
  54 + CVE-2021-27058
  55 + - added checks to ensure that all CLSIDs are uppercase (PR #678)
  56 +
32 57 - **2021-04-02 v0.56.1**:
33 58  
34 59 - olevba:
... ... @@ -182,7 +207,8 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
182 207 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__,
183 208 `REMnux <https://remnux.org/>`__,
184 209 `Snake <https://github.com/countercept/snake>`__,
185   -`SNDBOX <https://app.sndbox.com>`__,
  210 +`SNDBOX <https://app.sndbox.com>`__, `Splunk add-on for MS O365
  211 +Email <https://splunkbase.splunk.com/app/5365/>`__,
186 212 `SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__,
187 213 `Strelka <https://github.com/target/strelka>`__,
188 214 `stoQ <https://stoq.punchcyber.com/>`__,
... ...
oletools/common/clsid.py
  View file @1b33934
... ... @@ -43,7 +43,7 @@ http://www.decalage.info/python/oletools
43 43 # 2018-04-18 PL: - added known-bad CLSIDs from Cuckoo sandbox (issue #290)
44 44 # 2018-05-08 PL: - added more CLSIDs (issues #299, #304), merged and sorted
45 45  
46   -__version__ = '0.56'
  46 +__version__ = '0.56.2'
47 47  
48 48  
49 49 # REFERENCES:
... ...
oletools/mraptor.py
  View file @1b33934
... ... @@ -63,7 +63,7 @@ http://www.decalage.info/python/oletools
63 63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
64 64 # 2021-04-14 PL: - added Workbook_BeforeClose (issue #518)
65 65  
66   -__version__ = '0.56.2.dev1'
  66 +__version__ = '0.56.2'
67 67  
68 68 #------------------------------------------------------------------------------
69 69 # TODO:
... ...
oletools/oleid.py
  View file @1b33934
... ... @@ -60,7 +60,7 @@ from __future__ import print_function
60 60 # improve encryption detection for ppt
61 61 # 2021-05-07 v0.56.2 MN: - fixed bug in check_excel (issue #584, PR #585)
62 62  
63   -__version__ = '0.56.2.dev3'
  63 +__version__ = '0.56.2'
64 64  
65 65  
66 66 #------------------------------------------------------------------------------
... ...
oletools/olevba.py
  View file @1b33934
... ... @@ -235,7 +235,7 @@ from __future__ import print_function
235 235 # for issue #619)
236 236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
237 237  
238   -__version__ = '0.56.2.dev2'
  238 +__version__ = '0.56.2'
239 239  
240 240 #------------------------------------------------------------------------------
241 241 # TODO:
... ...
oletools/rtfobj.py
  View file @1b33934
... ... @@ -95,7 +95,7 @@ http://www.decalage.info/python/oletools
95 95 # 2021-05-06 v0.56.2 DD: - fixed bug when OLE package class name ends with null
96 96 # characters (issue #507, PR #648)
97 97  
98   -__version__ = '0.56.2.dev3'
  98 +__version__ = '0.56.2'
99 99  
100 100 # ------------------------------------------------------------------------------
101 101 # TODO:
... ...
setup.py
  View file @1b33934
... ... @@ -52,7 +52,7 @@ import os, fnmatch
52 52 #--- METADATA -----------------------------------------------------------------
53 53  
54 54 name = "oletools"
55   -version = '0.56.2.dev3'
  55 +version = '0.56.2'
56 56 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
57 57 long_desc = open('oletools/README.rst').read()
58 58 author = "Philippe Lagadec"
... ...