Peter M. Groen / oletools

Commit 6540ccbc7f72ccd67f24226b190e2fa26a3b6bb6

Authored by decalage2
1 parent a854e61e

readme, documentation and comment updates for v0.56 release

Inline Side-by-side
Showing 12 changed files with 103 additions and 128 deletions
LICENSE.md
  View file @6540ccb
1 1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
2 2 published with their own license.
3 3  
4   -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info)
  4 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)
5 5  
6 6 All rights reserved.
7 7  
... ...
MANIFEST.in
  View file @6540ccb
... ... @@ -7,6 +7,7 @@ include oletools/README.html
7 7 include oletools/LICENSE.txt
8 8 include oletools/DocVarDump.vba
9 9 recursive-include oletools/thirdparty *.*
  10 +prune oletools/thirdparty/oledump/old
10 11 recursive-include cheatsheet *.*
11 12 global-exclude *.pyc
12 13  
... ...
README.md
  View file @6540ccb
... ... @@ -26,6 +26,28 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
26 26 News
27 27 ----
28 28  
  29 +- **2020-09-28 v0.56**:
  30 + - olevba/mraptor:
  31 + - added detection of trigger _OnConnecting
  32 + - olevba:
  33 + - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing
  34 + - added simple analysis of Excel 4/XLM macros in XLSM files (PR #569)
  35 + - added detection of template injection (PR #569)
  36 + - added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/)
  37 + - improved MHT detection (PR #532)
  38 + - added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532)
  39 + - fixed bug when decompressing raw chunks in VBA (issue #575)
  40 + - fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604)
  41 + - fixed option --relaxed (issue #596, PR #595)
  42 + - enabled relaxed mode by default (issues #477, #593)
  43 + - fixed detect_vba_macros to always return VBA code as
  44 + unicode on Python 3 (issues #455, #477, #587, #593)
  45 + - replaced option --pcode by --show-pcode and --no-pcode,
  46 + replaced optparse by argparse (PR #479)
  47 + - oleform: improved form parsing (PR #532)
  48 + - oleobj: "Ole10Native" is now case insensitive (issue #541)
  49 + - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)
  50 + - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)
29 51 - **2019-12-03 v0.55**:
30 52 - olevba:
31 53 - added support for SLK files and XLM macro extraction from SLK
... ... @@ -39,35 +61,6 @@ News
39 61 - tests:
40 62 - test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215)
41 63 - tests that trigger antivirus alerts have been temporarily disabled (issue #215)
42   -- **2019-05-22 v0.54.2**:
43   - - bugfix release: fixed several issues related to encrypted documents
44   - and XLM/XLF Excel 4 macros
45   - - msoffcrypto-tool is now installed by default to handle encrypted documents
46   - - olevba and msodde now handle documents encrypted with common passwords such
47   - as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically.
48   -- **2019-04-04 v0.54**:
49   - - olevba, msodde: added support for encrypted MS Office files
50   - - olevba: added detection and extraction of XLM/XLF Excel 4 macros (thanks to plugin_biff from Didier Stevens' oledump)
51   - - olevba, mraptor: added detection of VBA running Excel 4 macros
52   - - olevba: detect and display special characters such as backspace
53   - - olevba: colorized output showing suspicious keywords in the VBA code
54   - - olevba, mraptor: full Python 3 compatibility, no separate olevba3/mraptor3 anymore
55   - - olevba: improved handling of code pages and unicode
56   - - olevba: fixed a false-positive in VBA macro detection
57   - - rtfobj: improved OLE Package handling, improved Equation object detection
58   - - oleobj: added detection of external links to objects in OpenXML
59   - - replaced third party packages by PyPI dependencies
60   -- 2018-05-30 v0.53:
61   - - olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML files (aka Flat OPC format)
62   - - improved support for VBA forms in olevba (oleform)
63   - - rtfobj now displays the CLSID of OLE objects, which is the best way to identify them. Known-bad CLSIDs such as MS Equation Editor are highlighted in red.
64   - - Updated rtfobj to handle obfuscated RTF samples.
65   - - rtfobj now handles the "\\'" obfuscation trick seen in recent samples such as https://twitter.com/buffaloverflow/status/989798880295444480, by emulating the MS Word bug described in https://securelist.com/disappearing-bytes/84017/
66   - - msodde: improved detection of DDE formulas in CSV files
67   - - oledir now displays the tree of storage/streams, along with CLSIDs and their meaning.
68   - - common.clsid contains the list of known CLSIDs, and their links to CVE vulnerabilities when relevant.
69   - - oleid now detects encrypted OpenXML files
70   - - fixed bugs in oleobj, rtfobj, oleid, olevba
71 64  
72 65 See the [full changelog](https://github.com/decalage2/oletools/wiki/Changelog) for more information.
73 66  
... ... @@ -193,7 +186,7 @@ License
193 186 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
194 187 published with their own license.
195 188  
196   -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info)
  189 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)
197 190  
198 191 All rights reserved.
199 192  
... ...
oletools/README.html
  View file @6540ccb
... ... @@ -23,6 +23,32 @@
23 23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
24 24 <h2 id="news">News</h2>
25 25 <ul>
  26 +<li><strong>2020-09-28 v0.56</strong>:
  27 +<ul>
  28 +<li>olevba/mraptor:
  29 +<ul>
  30 +<li>added detection of trigger _OnConnecting</li>
  31 +</ul></li>
  32 +<li>olevba:
  33 +<ul>
  34 +<li>updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing</li>
  35 +<li>added simple analysis of Excel 4/XLM macros in XLSM files (PR #569)</li>
  36 +<li>added detection of template injection (PR #569)</li>
  37 +<li>added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/)</li>
  38 +<li>improved MHT detection (PR #532)</li>
  39 +<li>added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532)</li>
  40 +<li>fixed bug when decompressing raw chunks in VBA (issue #575)</li>
  41 +<li>fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604)</li>
  42 +<li>fixed option --relaxed (issue #596, PR #595)</li>
  43 +<li>enabled relaxed mode by default (issues #477, #593)</li>
  44 +<li>fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)</li>
  45 +<li>replaced option --pcode by --show-pcode and --no-pcode, replaced optparse by argparse (PR #479)</li>
  46 +</ul></li>
  47 +<li>oleform: improved form parsing (PR #532)</li>
  48 +<li>oleobj: &quot;Ole10Native&quot; is now case insensitive (issue #541)</li>
  49 +<li>clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)</li>
  50 +<li>ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)</li>
  51 +</ul></li>
26 52 <li><strong>2019-12-03 v0.55</strong>:
27 53 <ul>
28 54 <li>olevba:
... ... @@ -42,39 +68,6 @@
42 68 <li>tests that trigger antivirus alerts have been temporarily disabled (issue #215)</li>
43 69 </ul></li>
44 70 </ul></li>
45   -<li><strong>2019-05-22 v0.54.2</strong>:
46   -<ul>
47   -<li>bugfix release: fixed several issues related to encrypted documents and XLM/XLF Excel 4 macros</li>
48   -<li>msoffcrypto-tool is now installed by default to handle encrypted documents</li>
49   -<li>olevba and msodde now handle documents encrypted with common passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically.</li>
50   -</ul></li>
51   -<li><strong>2019-04-04 v0.54</strong>:
52   -<ul>
53   -<li>olevba, msodde: added support for encrypted MS Office files</li>
54   -<li>olevba: added detection and extraction of XLM/XLF Excel 4 macros (thanks to plugin_biff from Didier Stevens' oledump)</li>
55   -<li>olevba, mraptor: added detection of VBA running Excel 4 macros</li>
56   -<li>olevba: detect and display special characters such as backspace</li>
57   -<li>olevba: colorized output showing suspicious keywords in the VBA code</li>
58   -<li>olevba, mraptor: full Python 3 compatibility, no separate olevba3/mraptor3 anymore</li>
59   -<li>olevba: improved handling of code pages and unicode</li>
60   -<li>olevba: fixed a false-positive in VBA macro detection</li>
61   -<li>rtfobj: improved OLE Package handling, improved Equation object detection</li>
62   -<li>oleobj: added detection of external links to objects in OpenXML</li>
63   -<li>replaced third party packages by PyPI dependencies</li>
64   -</ul></li>
65   -<li>2018-05-30 v0.53:
66   -<ul>
67   -<li>olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML files (aka Flat OPC format)</li>
68   -<li>improved support for VBA forms in olevba (oleform)</li>
69   -<li>rtfobj now displays the CLSID of OLE objects, which is the best way to identify them. Known-bad CLSIDs such as MS Equation Editor are highlighted in red.</li>
70   -<li>Updated rtfobj to handle obfuscated RTF samples.</li>
71   -<li>rtfobj now handles the &quot;\'&quot; obfuscation trick seen in recent samples such as https://twitter.com/buffaloverflow/status/989798880295444480, by emulating the MS Word bug described in https://securelist.com/disappearing-bytes/84017/</li>
72   -<li>msodde: improved detection of DDE formulas in CSV files</li>
73   -<li>oledir now displays the tree of storage/streams, along with CLSIDs and their meaning.</li>
74   -<li>common.clsid contains the list of known CLSIDs, and their links to CVE vulnerabilities when relevant.</li>
75   -<li>oleid now detects encrypted OpenXML files</li>
76   -<li>fixed bugs in oleobj, rtfobj, oleid, olevba</li>
77   -</ul></li>
78 71 </ul>
79 72 <p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p>
80 73 <h2 id="tools">Tools:</h2>
... ... @@ -97,7 +90,7 @@
97 90 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
98 91 </ul>
99 92 <h2 id="projects-using-oletools">Projects using oletools:</h2>
100   -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
  93 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
101 94 <h2 id="download-and-install">Download and Install:</h2>
102 95 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
103 96 <ul>
... ... @@ -120,7 +113,7 @@
120 113 <p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
121 114 <h2 id="license">License</h2>
122 115 <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
123   -<p>The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info)</p>
  116 +<p>The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)</p>
124 117 <p>All rights reserved.</p>
125 118 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
126 119 <ul>
... ...
oletools/README.rst
  View file @6540ccb
... ... @@ -29,6 +29,39 @@ Software.
29 29 News
30 30 ----
31 31  
  32 +- **2020-09-28 v0.56**:
  33 +
  34 + - olevba/mraptor:
  35 +
  36 + - added detection of trigger \_OnConnecting
  37 +
  38 + - olevba:
  39 +
  40 + - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros
  41 + parsing
  42 + - added simple analysis of Excel 4/XLM macros in XLSM files (PR
  43 + #569)
  44 + - added detection of template injection (PR #569)
  45 + - added detection of many suspicious keywords (PR #591 and #569,
  46 + see https://www.certego.net/en/news/advanced-vba-macros/)
  47 + - improved MHT detection (PR #532)
  48 + - added --no-xlm option to disable Excel 4/XLM macros parsing (PR
  49 + #532)
  50 + - fixed bug when decompressing raw chunks in VBA (issue #575)
  51 + - fixed bug with email package due to monkeypatch for MHT parsing
  52 + (issue #602, PR #604)
  53 + - fixed option --relaxed (issue #596, PR #595)
  54 + - enabled relaxed mode by default (issues #477, #593)
  55 + - fixed detect_vba_macros to always return VBA code as unicode on
  56 + Python 3 (issues #455, #477, #587, #593)
  57 + - replaced option --pcode by --show-pcode and --no-pcode,
  58 + replaced optparse by argparse (PR #479)
  59 +
  60 + - oleform: improved form parsing (PR #532)
  61 + - oleobj: "Ole10Native" is now case insensitive (issue #541)
  62 + - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)
  63 + - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)
  64 +
32 65 - **2019-12-03 v0.55**:
33 66  
34 67 - olevba:
... ... @@ -50,56 +83,6 @@ News
50 83 - tests that trigger antivirus alerts have been temporarily
51 84 disabled (issue #215)
52 85  
53   -- **2019-05-22 v0.54.2**:
54   -
55   - - bugfix release: fixed several issues related to encrypted
56   - documents and XLM/XLF Excel 4 macros
57   - - msoffcrypto-tool is now installed by default to handle encrypted
58   - documents
59   - - olevba and msodde now handle documents encrypted with common
60   - passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop
61   - automatically.
62   -
63   -- **2019-04-04 v0.54**:
64   -
65   - - olevba, msodde: added support for encrypted MS Office files
66   - - olevba: added detection and extraction of XLM/XLF Excel 4 macros
67   - (thanks to plugin_biff from Didier Stevens' oledump)
68   - - olevba, mraptor: added detection of VBA running Excel 4 macros
69   - - olevba: detect and display special characters such as backspace
70   - - olevba: colorized output showing suspicious keywords in the VBA
71   - code
72   - - olevba, mraptor: full Python 3 compatibility, no separate
73   - olevba3/mraptor3 anymore
74   - - olevba: improved handling of code pages and unicode
75   - - olevba: fixed a false-positive in VBA macro detection
76   - - rtfobj: improved OLE Package handling, improved Equation object
77   - detection
78   - - oleobj: added detection of external links to objects in OpenXML
79   - - replaced third party packages by PyPI dependencies
80   -
81   -- 2018-05-30 v0.53:
82   -
83   - - olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML
84   - files (aka Flat OPC format)
85   - - improved support for VBA forms in olevba (oleform)
86   - - rtfobj now displays the CLSID of OLE objects, which is the best
87   - way to identify them. Known-bad CLSIDs such as MS Equation Editor
88   - are highlighted in red.
89   - - Updated rtfobj to handle obfuscated RTF samples.
90   - - rtfobj now handles the "\'" obfuscation trick seen in recent
91   - samples such as
92   - https://twitter.com/buffaloverflow/status/989798880295444480, by
93   - emulating the MS Word bug described in
94   - https://securelist.com/disappearing-bytes/84017/
95   - - msodde: improved detection of DDE formulas in CSV files
96   - - oledir now displays the tree of storage/streams, along with CLSIDs
97   - and their meaning.
98   - - common.clsid contains the list of known CLSIDs, and their links to
99   - CVE vulnerabilities when relevant.
100   - - oleid now detects encrypted OpenXML files
101   - - fixed bugs in oleobj, rtfobj, oleid, olevba
102   -
103 86 See the `full
104 87 changelog <https://github.com/decalage2/oletools/wiki/Changelog>`__ for
105 88 more information.
... ... @@ -154,14 +137,18 @@ oletools are used by a number of projects and online malware analysis
154 137 services, including `ACE <https://github.com/IntegralDefense/ACE>`__,
155 138 `Anlyz.io <https://sandbox.anlyz.io/>`__,
156 139 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__,
157   -`CAPE <https://github.com/ctxis/CAPE>`__, `Cuckoo
  140 +`CAPE <https://github.com/ctxis/CAPE>`__,
  141 +`CinCan <https://cincan.io>`__, `Cuckoo
158 142 Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
159 143 `DARKSURGEON <https://github.com/cryps1s/DARKSURGEON>`__,
160 144 `Deepviz <https://sandbox.deepviz.com/>`__,
161   -`dridex.malwareconfig.com <https://dridex.malwareconfig.com>`__,
  145 +`DIARIO <https://diario.elevenpaths.com/>`__,
  146 +`dridex.malwareconfig.com <https://dridex.malwareconfig.com>`__, `EML
  147 +Analyzer <https://github.com/ninoseki/eml_analyzer>`__,
162 148 `FAME <https://certsocietegenerale.github.io/fame/>`__,
163 149 `FLARE-VM <https://github.com/fireeye/flare-vm>`__,
164   -`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__, `Joe
  150 +`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__,
  151 +`IntelOwl <https://github.com/certego/IntelOwl>`__, `Joe
165 152 Sandbox <https://www.document-analyzer.net/>`__, `Laika
166 153 BOSS <https://github.com/lmco/laikaboss>`__,
167 154 `MacroMilter <https://github.com/sbidy/MacroMilter>`__,
... ... @@ -176,6 +163,7 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
176 163 `REMnux <https://remnux.org/>`__,
177 164 `Snake <https://github.com/countercept/snake>`__,
178 165 `SNDBOX <https://app.sndbox.com>`__,
  166 +`SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__,
179 167 `Strelka <https://github.com/target/strelka>`__,
180 168 `stoQ <https://stoq.punchcyber.com/>`__,
181 169 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__,
... ... @@ -245,7 +233,7 @@ This license applies to the python-oletools package, apart from the
245 233 thirdparty folder which contains third-party files published with their
246 234 own license.
247 235  
248   -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec
  236 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec
249 237 (http://www.decalage.info)
250 238  
251 239 All rights reserved.
... ...
oletools/doc/Home.html
  View file @6540ccb
... ... @@ -16,7 +16,7 @@
16 16 <![endif]-->
17 17 </head>
18 18 <body>
19   -<h1 id="python-oletools-v0.55-documentation">python-oletools v0.55 documentation</h1>
  19 +<h1 id="python-oletools-v0.56-documentation">python-oletools v0.56 documentation</h1>
20 20 <p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
21 21 <p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
22 22 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
... ...
oletools/doc/Home.md
  View file @6540ccb
1   -python-oletools v0.55 documentation
  1 +python-oletools v0.56 documentation
2 2 ===================================
3 3  
4 4 This is the home page of the documentation for python-oletools. The latest version can be found
... ...
oletools/doc/License.html
  View file @6540ccb
... ... @@ -18,7 +18,7 @@
18 18 <body>
19 19 <h1 id="license-for-python-oletools">License for python-oletools</h1>
20 20 <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
21   -<p>The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
  21 +<p>The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
22 22 <p>All rights reserved.</p>
23 23 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
24 24 <ul>
... ...
oletools/doc/License.md
  View file @6540ccb
... ... @@ -4,7 +4,7 @@ License for python-oletools
4 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 5 thirdparty folder which contains third-party files published with their own license.
6 6  
7   -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
  7 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8  
9 9 All rights reserved.
10 10  
... ...
oletools/mraptor.py
  View file @6540ccb
... ... @@ -23,7 +23,7 @@ http://www.decalage.info/python/oletools
23 23  
24 24 # === LICENSE ==================================================================
25 25  
26   -# MacroRaptor is copyright (c) 2016-2019 Philippe Lagadec (http://www.decalage.info)
  26 +# MacroRaptor is copyright (c) 2016-2020 Philippe Lagadec (http://www.decalage.info)
27 27 # All rights reserved.
28 28 #
29 29 # Redistribution and use in source and binary forms, with or without modification,
... ... @@ -62,7 +62,7 @@ http://www.decalage.info/python/oletools
62 62 # 2019-11-06 v0.55 PL: - added SetTimer
63 63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
64 64  
65   -__version__ = '0.56dev12'
  65 +__version__ = '0.56'
66 66  
67 67 #------------------------------------------------------------------------------
68 68 # TODO:
... ...
oletools/oleobj.py
  View file @6540ccb
... ... @@ -88,7 +88,7 @@ from oletools.common.io_encoding import ensure_stdout_handles_unicode
88 88 # 2018-10-30 SA: - added detection of external links (PR #317)
89 89 # 2020-03-03 v0.56 PL: - fixed bug #541, "Ole10Native" is case-insensitive
90 90  
91   -__version__ = '0.56dev2'
  91 +__version__ = '0.56'
92 92  
93 93 # -----------------------------------------------------------------------------
94 94 # TODO:
... ...
oletools/olevba.py
  View file @6540ccb
... ... @@ -234,7 +234,7 @@ from __future__ import print_function
234 234 # 2020-09-28 PL: - added VBA_Parser.get_vba_code_all_modules (partial fix
235 235 # for issue #619)
236 236  
237   -__version__ = '0.56dev12'
  237 +__version__ = '0.56'
238 238  
239 239 #------------------------------------------------------------------------------
240 240 # TODO:
... ...