2021-04-02 v0.56.1:
- olevba:
@@ -106,7 +130,7 @@
- olemap: to display a map of all the sectors in an OLE file.
-oletools are used by a number of projects and online malware analysis services, including ACE, Anlyz.io, AssemblyLine, CAPE, CinCan, Cuckoo Sandbox, DARKSURGEON, Deepviz, DIARIO, dridex.malwareconfig.com, EML Analyzer, FAME, FLARE-VM, Hybrid-analysis.com, IntelOwl, Joe Sandbox, Laika BOSS, MacroMilter, mailcow, malshare.io, malware-repo, Malware Repository Framework (MRF), MalwareBazaar, olefy, PeekabooAV, pcodedmp, PyCIRCLean, REMnux, Snake, SNDBOX, SpuriousEmu, Strelka, stoQ, TheHive/Cortex, TSUGURI Linux, Vba2Graph, Viper, ViperMonkey, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
+oletools are used by a number of projects and online malware analysis services, including ACE, Anlyz.io, AssemblyLine, CAPE, CinCan, Cuckoo Sandbox, DARKSURGEON, Deepviz, DIARIO, dridex.malwareconfig.com, EML Analyzer, FAME, FLARE-VM, Hybrid-analysis.com, IntelOwl, Joe Sandbox, Laika BOSS, MacroMilter, mailcow, malshare.io, malware-repo, Malware Repository Framework (MRF), MalwareBazaar, olefy, PeekabooAV, pcodedmp, PyCIRCLean, REMnux, Snake, SNDBOX, Splunk add-on for MS O365 Email, SpuriousEmu, Strelka, stoQ, TheHive/Cortex, TSUGURI Linux, Vba2Graph, Viper, ViperMonkey, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
Download and Install:
The recommended way to download and install/update the latest stable release of oletools is to use pip:
diff --git a/oletools/README.rst b/oletools/README.rst
index c9c83a7..0407ad0 100644
--- a/oletools/README.rst
+++ b/oletools/README.rst
@@ -29,6 +29,31 @@ Software.
News
----
+- **2021-05-07 v0.56.2**:
+
+ - olevba:
+
+ - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
+
+ - olevba, mraptor:
+
+ - added detection of Workbook_BeforeClose (issue #518)
+
+ - rtfobj:
+
+ - fixed bug when OLE package class name ends with null characters
+ (issue #507, PR #648)
+
+ - oleid:
+
+ - fixed bug in check_excel (issue #584, PR #585)
+
+ - clsid:
+
+ - added several CLSIDs related to MS Office click-to-run issue
+ CVE-2021-27058
+ - added checks to ensure that all CLSIDs are uppercase (PR #678)
+
- **2021-04-02 v0.56.1**:
- olevba:
@@ -182,7 +207,8 @@ Repository Framework (MRF) `__,
`PyCIRCLean `__,
`REMnux `__,
`Snake `__,
-`SNDBOX `__,
+`SNDBOX `__, `Splunk add-on for MS O365
+Email `__,
`SpuriousEmu `__,
`Strelka `__,
`stoQ `__,
diff --git a/oletools/common/clsid.py b/oletools/common/clsid.py
index 9202515..1712b47 100644
--- a/oletools/common/clsid.py
+++ b/oletools/common/clsid.py
@@ -43,7 +43,7 @@ http://www.decalage.info/python/oletools
# 2018-04-18 PL: - added known-bad CLSIDs from Cuckoo sandbox (issue #290)
# 2018-05-08 PL: - added more CLSIDs (issues #299, #304), merged and sorted
-__version__ = '0.56'
+__version__ = '0.56.2'
# REFERENCES:
diff --git a/oletools/mraptor.py b/oletools/mraptor.py
index f950a4b..80cfe35 100644
--- a/oletools/mraptor.py
+++ b/oletools/mraptor.py
@@ -63,7 +63,7 @@ http://www.decalage.info/python/oletools
# 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
# 2021-04-14 PL: - added Workbook_BeforeClose (issue #518)
-__version__ = '0.56.2.dev1'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
# TODO:
diff --git a/oletools/oleid.py b/oletools/oleid.py
index 64e0ee4..b4426e4 100644
--- a/oletools/oleid.py
+++ b/oletools/oleid.py
@@ -60,7 +60,7 @@ from __future__ import print_function
# improve encryption detection for ppt
# 2021-05-07 v0.56.2 MN: - fixed bug in check_excel (issue #584, PR #585)
-__version__ = '0.56.2.dev3'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
diff --git a/oletools/olevba.py b/oletools/olevba.py
index a32aa5f..45850d9 100644
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -235,7 +235,7 @@ from __future__ import print_function
# for issue #619)
# 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
-__version__ = '0.56.2.dev2'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
# TODO:
diff --git a/oletools/rtfobj.py b/oletools/rtfobj.py
index 4957a5f..54be596 100644
--- a/oletools/rtfobj.py
+++ b/oletools/rtfobj.py
@@ -95,7 +95,7 @@ http://www.decalage.info/python/oletools
# 2021-05-06 v0.56.2 DD: - fixed bug when OLE package class name ends with null
# characters (issue #507, PR #648)
-__version__ = '0.56.2.dev3'
+__version__ = '0.56.2'
# ------------------------------------------------------------------------------
# TODO:
diff --git a/setup.py b/setup.py
index 20c6588..bc8846c 100644
--- a/setup.py
+++ b/setup.py
@@ -52,7 +52,7 @@ import os, fnmatch
#--- METADATA -----------------------------------------------------------------
name = "oletools"
-version = '0.56.2.dev3'
+version = '0.56.2'
desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
long_desc = open('oletools/README.rst').read()
author = "Philippe Lagadec"