Peter M. Groen / oletools

Commit 1b33934614caa93b98281dbb099a472d989aed5d

Authored by decalage2
1 parent a1f5b281

bumped version to 0.56.2

Inline Side-by-side
Showing 9 changed files with 70 additions and 8 deletions
README.md
  View file @1b33934
@@ -26,6 +26,18 @@ Note: python-oletools is not related to OLETools published by BeCubed Software. @@ -26,6 +26,18 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
26 News 26 News
27 ---- 27 ----
28 28
  29 +- **2021-05-07 v0.56.2**:
  30 + - olevba:
  31 + - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
  32 + - olevba, mraptor:
  33 + - added detection of Workbook_BeforeClose (issue #518)
  34 + - rtfobj:
  35 + - fixed bug when OLE package class name ends with null characters (issue #507, PR #648)
  36 + - oleid:
  37 + - fixed bug in check_excel (issue #584, PR #585)
  38 + - clsid:
  39 + - added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058
  40 + - added checks to ensure that all CLSIDs are uppercase (PR #678)
29 - **2021-04-02 v0.56.1**: 41 - **2021-04-02 v0.56.1**:
30 - olevba: 42 - olevba:
31 - fixed bug when parsing some malformed files (issue #629) 43 - fixed bug when parsing some malformed files (issue #629)
oletools/README.html
  View file @1b33934
@@ -23,6 +23,30 @@ @@ -23,6 +23,30 @@
23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p> 23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
24 <h2 id="news">News</h2> 24 <h2 id="news">News</h2>
25 <ul> 25 <ul>
  26 +<li><strong>2021-05-07 v0.56.2</strong>:
  27 +<ul>
  28 +<li>olevba:
  29 +<ul>
  30 +<li>updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)</li>
  31 +</ul></li>
  32 +<li>olevba, mraptor:
  33 +<ul>
  34 +<li>added detection of Workbook_BeforeClose (issue #518)</li>
  35 +</ul></li>
  36 +<li>rtfobj:
  37 +<ul>
  38 +<li>fixed bug when OLE package class name ends with null characters (issue #507, PR #648)</li>
  39 +</ul></li>
  40 +<li>oleid:
  41 +<ul>
  42 +<li>fixed bug in check_excel (issue #584, PR #585)</li>
  43 +</ul></li>
  44 +<li>clsid:
  45 +<ul>
  46 +<li>added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058</li>
  47 +<li>added checks to ensure that all CLSIDs are uppercase (PR #678)</li>
  48 +</ul></li>
  49 +</ul></li>
26 <li><strong>2021-04-02 v0.56.1</strong>: 50 <li><strong>2021-04-02 v0.56.1</strong>:
27 <ul> 51 <ul>
28 <li>olevba: 52 <li>olevba:
@@ -106,7 +130,7 @@ @@ -106,7 +130,7 @@
106 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li> 130 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
107 </ul> 131 </ul>
108 <h2 id="projects-using-oletools">Projects using oletools:</h2> 132 <h2 id="projects-using-oletools">Projects using oletools:</h2>
109 -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p> 133 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
110 <h2 id="download-and-install">Download and Install:</h2> 134 <h2 id="download-and-install">Download and Install:</h2>
111 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p> 135 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
112 <ul> 136 <ul>
oletools/README.rst
  View file @1b33934
@@ -29,6 +29,31 @@ Software. @@ -29,6 +29,31 @@ Software.
29 News 29 News
30 ---- 30 ----
31 31
  32 +- **2021-05-07 v0.56.2**:
  33 +
  34 + - olevba:
  35 +
  36 + - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
  37 +
  38 + - olevba, mraptor:
  39 +
  40 + - added detection of Workbook_BeforeClose (issue #518)
  41 +
  42 + - rtfobj:
  43 +
  44 + - fixed bug when OLE package class name ends with null characters
  45 + (issue #507, PR #648)
  46 +
  47 + - oleid:
  48 +
  49 + - fixed bug in check_excel (issue #584, PR #585)
  50 +
  51 + - clsid:
  52 +
  53 + - added several CLSIDs related to MS Office click-to-run issue
  54 + CVE-2021-27058
  55 + - added checks to ensure that all CLSIDs are uppercase (PR #678)
  56 +
32 - **2021-04-02 v0.56.1**: 57 - **2021-04-02 v0.56.1**:
33 58
34 - olevba: 59 - olevba:
@@ -182,7 +207,8 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__, @@ -182,7 +207,8 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
182 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__, 207 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__,
183 `REMnux <https://remnux.org/>`__, 208 `REMnux <https://remnux.org/>`__,
184 `Snake <https://github.com/countercept/snake>`__, 209 `Snake <https://github.com/countercept/snake>`__,
185 -`SNDBOX <https://app.sndbox.com>`__, 210 +`SNDBOX <https://app.sndbox.com>`__, `Splunk add-on for MS O365
  211 +Email <https://splunkbase.splunk.com/app/5365/>`__,
186 `SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__, 212 `SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__,
187 `Strelka <https://github.com/target/strelka>`__, 213 `Strelka <https://github.com/target/strelka>`__,
188 `stoQ <https://stoq.punchcyber.com/>`__, 214 `stoQ <https://stoq.punchcyber.com/>`__,
oletools/common/clsid.py
  View file @1b33934
@@ -43,7 +43,7 @@ http://www.decalage.info/python/oletools @@ -43,7 +43,7 @@ http://www.decalage.info/python/oletools
43 # 2018-04-18 PL: - added known-bad CLSIDs from Cuckoo sandbox (issue #290) 43 # 2018-04-18 PL: - added known-bad CLSIDs from Cuckoo sandbox (issue #290)
44 # 2018-05-08 PL: - added more CLSIDs (issues #299, #304), merged and sorted 44 # 2018-05-08 PL: - added more CLSIDs (issues #299, #304), merged and sorted
45 45
46 -__version__ = '0.56' 46 +__version__ = '0.56.2'
47 47
48 48
49 # REFERENCES: 49 # REFERENCES:
oletools/mraptor.py
  View file @1b33934
@@ -63,7 +63,7 @@ http://www.decalage.info/python/oletools @@ -63,7 +63,7 @@ http://www.decalage.info/python/oletools
63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562) 63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
64 # 2021-04-14 PL: - added Workbook_BeforeClose (issue #518) 64 # 2021-04-14 PL: - added Workbook_BeforeClose (issue #518)
65 65
66 -__version__ = '0.56.2.dev1' 66 +__version__ = '0.56.2'
67 67
68 #------------------------------------------------------------------------------ 68 #------------------------------------------------------------------------------
69 # TODO: 69 # TODO:
oletools/oleid.py
  View file @1b33934
@@ -60,7 +60,7 @@ from __future__ import print_function @@ -60,7 +60,7 @@ from __future__ import print_function
60 # improve encryption detection for ppt 60 # improve encryption detection for ppt
61 # 2021-05-07 v0.56.2 MN: - fixed bug in check_excel (issue #584, PR #585) 61 # 2021-05-07 v0.56.2 MN: - fixed bug in check_excel (issue #584, PR #585)
62 62
63 -__version__ = '0.56.2.dev3' 63 +__version__ = '0.56.2'
64 64
65 65
66 #------------------------------------------------------------------------------ 66 #------------------------------------------------------------------------------
oletools/olevba.py
  View file @1b33934
@@ -235,7 +235,7 @@ from __future__ import print_function @@ -235,7 +235,7 @@ from __future__ import print_function
235 # for issue #619) 235 # for issue #619)
236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518) 236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
237 237
238 -__version__ = '0.56.2.dev2' 238 +__version__ = '0.56.2'
239 239
240 #------------------------------------------------------------------------------ 240 #------------------------------------------------------------------------------
241 # TODO: 241 # TODO:
oletools/rtfobj.py
  View file @1b33934
@@ -95,7 +95,7 @@ http://www.decalage.info/python/oletools @@ -95,7 +95,7 @@ http://www.decalage.info/python/oletools
95 # 2021-05-06 v0.56.2 DD: - fixed bug when OLE package class name ends with null 95 # 2021-05-06 v0.56.2 DD: - fixed bug when OLE package class name ends with null
96 # characters (issue #507, PR #648) 96 # characters (issue #507, PR #648)
97 97
98 -__version__ = '0.56.2.dev3' 98 +__version__ = '0.56.2'
99 99
100 # ------------------------------------------------------------------------------ 100 # ------------------------------------------------------------------------------
101 # TODO: 101 # TODO:
setup.py
  View file @1b33934
@@ -52,7 +52,7 @@ import os, fnmatch @@ -52,7 +52,7 @@ import os, fnmatch
52 #--- METADATA ----------------------------------------------------------------- 52 #--- METADATA -----------------------------------------------------------------
53 53
54 name = "oletools" 54 name = "oletools"
55 -version = '0.56.2.dev3' 55 +version = '0.56.2'
56 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR" 56 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
57 long_desc = open('oletools/README.rst').read() 57 long_desc = open('oletools/README.rst').read()
58 author = "Philippe Lagadec" 58 author = "Philippe Lagadec"