Peter M. Groen / oletools

Commit 6540ccbc7f72ccd67f24226b190e2fa26a3b6bb6

Authored by decalage2
1 parent a854e61e

readme, documentation and comment updates for v0.56 release

Inline Side-by-side
Showing 12 changed files with 103 additions and 128 deletions
LICENSE.md
  View file @6540ccb
1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files 1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
2 published with their own license. 2 published with their own license.
3 3
4 -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info) 4 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)
5 5
6 All rights reserved. 6 All rights reserved.
7 7
MANIFEST.in
  View file @6540ccb
@@ -7,6 +7,7 @@ include oletools/README.html @@ -7,6 +7,7 @@ include oletools/README.html
7 include oletools/LICENSE.txt 7 include oletools/LICENSE.txt
8 include oletools/DocVarDump.vba 8 include oletools/DocVarDump.vba
9 recursive-include oletools/thirdparty *.* 9 recursive-include oletools/thirdparty *.*
  10 +prune oletools/thirdparty/oledump/old
10 recursive-include cheatsheet *.* 11 recursive-include cheatsheet *.*
11 global-exclude *.pyc 12 global-exclude *.pyc
12 13
README.md
  View file @6540ccb
@@ -26,6 +26,28 @@ Note: python-oletools is not related to OLETools published by BeCubed Software. @@ -26,6 +26,28 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
26 News 26 News
27 ---- 27 ----
28 28
  29 +- **2020-09-28 v0.56**:
  30 + - olevba/mraptor:
  31 + - added detection of trigger _OnConnecting
  32 + - olevba:
  33 + - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing
  34 + - added simple analysis of Excel 4/XLM macros in XLSM files (PR #569)
  35 + - added detection of template injection (PR #569)
  36 + - added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/)
  37 + - improved MHT detection (PR #532)
  38 + - added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532)
  39 + - fixed bug when decompressing raw chunks in VBA (issue #575)
  40 + - fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604)
  41 + - fixed option --relaxed (issue #596, PR #595)
  42 + - enabled relaxed mode by default (issues #477, #593)
  43 + - fixed detect_vba_macros to always return VBA code as
  44 + unicode on Python 3 (issues #455, #477, #587, #593)
  45 + - replaced option --pcode by --show-pcode and --no-pcode,
  46 + replaced optparse by argparse (PR #479)
  47 + - oleform: improved form parsing (PR #532)
  48 + - oleobj: "Ole10Native" is now case insensitive (issue #541)
  49 + - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)
  50 + - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)
29 - **2019-12-03 v0.55**: 51 - **2019-12-03 v0.55**:
30 - olevba: 52 - olevba:
31 - added support for SLK files and XLM macro extraction from SLK 53 - added support for SLK files and XLM macro extraction from SLK
@@ -39,35 +61,6 @@ News @@ -39,35 +61,6 @@ News
39 - tests: 61 - tests:
40 - test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215) 62 - test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215)
41 - tests that trigger antivirus alerts have been temporarily disabled (issue #215) 63 - tests that trigger antivirus alerts have been temporarily disabled (issue #215)
42 -- **2019-05-22 v0.54.2**:  
43 - - bugfix release: fixed several issues related to encrypted documents  
44 - and XLM/XLF Excel 4 macros  
45 - - msoffcrypto-tool is now installed by default to handle encrypted documents  
46 - - olevba and msodde now handle documents encrypted with common passwords such  
47 - as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically.  
48 -- **2019-04-04 v0.54**:  
49 - - olevba, msodde: added support for encrypted MS Office files  
50 - - olevba: added detection and extraction of XLM/XLF Excel 4 macros (thanks to plugin_biff from Didier Stevens' oledump)  
51 - - olevba, mraptor: added detection of VBA running Excel 4 macros  
52 - - olevba: detect and display special characters such as backspace  
53 - - olevba: colorized output showing suspicious keywords in the VBA code  
54 - - olevba, mraptor: full Python 3 compatibility, no separate olevba3/mraptor3 anymore  
55 - - olevba: improved handling of code pages and unicode  
56 - - olevba: fixed a false-positive in VBA macro detection  
57 - - rtfobj: improved OLE Package handling, improved Equation object detection  
58 - - oleobj: added detection of external links to objects in OpenXML  
59 - - replaced third party packages by PyPI dependencies  
60 -- 2018-05-30 v0.53:  
61 - - olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML files (aka Flat OPC format)  
62 - - improved support for VBA forms in olevba (oleform)  
63 - - rtfobj now displays the CLSID of OLE objects, which is the best way to identify them. Known-bad CLSIDs such as MS Equation Editor are highlighted in red.  
64 - - Updated rtfobj to handle obfuscated RTF samples.  
65 - - rtfobj now handles the "\\'" obfuscation trick seen in recent samples such as https://twitter.com/buffaloverflow/status/989798880295444480, by emulating the MS Word bug described in https://securelist.com/disappearing-bytes/84017/  
66 - - msodde: improved detection of DDE formulas in CSV files  
67 - - oledir now displays the tree of storage/streams, along with CLSIDs and their meaning.  
68 - - common.clsid contains the list of known CLSIDs, and their links to CVE vulnerabilities when relevant.  
69 - - oleid now detects encrypted OpenXML files  
70 - - fixed bugs in oleobj, rtfobj, oleid, olevba  
71 64
72 See the [full changelog](https://github.com/decalage2/oletools/wiki/Changelog) for more information. 65 See the [full changelog](https://github.com/decalage2/oletools/wiki/Changelog) for more information.
73 66
@@ -193,7 +186,7 @@ License @@ -193,7 +186,7 @@ License
193 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files 186 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
194 published with their own license. 187 published with their own license.
195 188
196 -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info) 189 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)
197 190
198 All rights reserved. 191 All rights reserved.
199 192
oletools/README.html
  View file @6540ccb
@@ -23,6 +23,32 @@ @@ -23,6 +23,32 @@
23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p> 23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
24 <h2 id="news">News</h2> 24 <h2 id="news">News</h2>
25 <ul> 25 <ul>
  26 +<li><strong>2020-09-28 v0.56</strong>:
  27 +<ul>
  28 +<li>olevba/mraptor:
  29 +<ul>
  30 +<li>added detection of trigger _OnConnecting</li>
  31 +</ul></li>
  32 +<li>olevba:
  33 +<ul>
  34 +<li>updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing</li>
  35 +<li>added simple analysis of Excel 4/XLM macros in XLSM files (PR #569)</li>
  36 +<li>added detection of template injection (PR #569)</li>
  37 +<li>added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/)</li>
  38 +<li>improved MHT detection (PR #532)</li>
  39 +<li>added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532)</li>
  40 +<li>fixed bug when decompressing raw chunks in VBA (issue #575)</li>
  41 +<li>fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604)</li>
  42 +<li>fixed option --relaxed (issue #596, PR #595)</li>
  43 +<li>enabled relaxed mode by default (issues #477, #593)</li>
  44 +<li>fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)</li>
  45 +<li>replaced option --pcode by --show-pcode and --no-pcode, replaced optparse by argparse (PR #479)</li>
  46 +</ul></li>
  47 +<li>oleform: improved form parsing (PR #532)</li>
  48 +<li>oleobj: &quot;Ole10Native&quot; is now case insensitive (issue #541)</li>
  49 +<li>clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)</li>
  50 +<li>ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)</li>
  51 +</ul></li>
26 <li><strong>2019-12-03 v0.55</strong>: 52 <li><strong>2019-12-03 v0.55</strong>:
27 <ul> 53 <ul>
28 <li>olevba: 54 <li>olevba:
@@ -42,39 +68,6 @@ @@ -42,39 +68,6 @@
42 <li>tests that trigger antivirus alerts have been temporarily disabled (issue #215)</li> 68 <li>tests that trigger antivirus alerts have been temporarily disabled (issue #215)</li>
43 </ul></li> 69 </ul></li>
44 </ul></li> 70 </ul></li>
45 -<li><strong>2019-05-22 v0.54.2</strong>:  
46 -<ul>  
47 -<li>bugfix release: fixed several issues related to encrypted documents and XLM/XLF Excel 4 macros</li>  
48 -<li>msoffcrypto-tool is now installed by default to handle encrypted documents</li>  
49 -<li>olevba and msodde now handle documents encrypted with common passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically.</li>  
50 -</ul></li>  
51 -<li><strong>2019-04-04 v0.54</strong>:  
52 -<ul>  
53 -<li>olevba, msodde: added support for encrypted MS Office files</li>  
54 -<li>olevba: added detection and extraction of XLM/XLF Excel 4 macros (thanks to plugin_biff from Didier Stevens' oledump)</li>  
55 -<li>olevba, mraptor: added detection of VBA running Excel 4 macros</li>  
56 -<li>olevba: detect and display special characters such as backspace</li>  
57 -<li>olevba: colorized output showing suspicious keywords in the VBA code</li>  
58 -<li>olevba, mraptor: full Python 3 compatibility, no separate olevba3/mraptor3 anymore</li>  
59 -<li>olevba: improved handling of code pages and unicode</li>  
60 -<li>olevba: fixed a false-positive in VBA macro detection</li>  
61 -<li>rtfobj: improved OLE Package handling, improved Equation object detection</li>  
62 -<li>oleobj: added detection of external links to objects in OpenXML</li>  
63 -<li>replaced third party packages by PyPI dependencies</li>  
64 -</ul></li>  
65 -<li>2018-05-30 v0.53:  
66 -<ul>  
67 -<li>olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML files (aka Flat OPC format)</li>  
68 -<li>improved support for VBA forms in olevba (oleform)</li>  
69 -<li>rtfobj now displays the CLSID of OLE objects, which is the best way to identify them. Known-bad CLSIDs such as MS Equation Editor are highlighted in red.</li>  
70 -<li>Updated rtfobj to handle obfuscated RTF samples.</li>  
71 -<li>rtfobj now handles the &quot;\'&quot; obfuscation trick seen in recent samples such as https://twitter.com/buffaloverflow/status/989798880295444480, by emulating the MS Word bug described in https://securelist.com/disappearing-bytes/84017/</li>  
72 -<li>msodde: improved detection of DDE formulas in CSV files</li>  
73 -<li>oledir now displays the tree of storage/streams, along with CLSIDs and their meaning.</li>  
74 -<li>common.clsid contains the list of known CLSIDs, and their links to CVE vulnerabilities when relevant.</li>  
75 -<li>oleid now detects encrypted OpenXML files</li>  
76 -<li>fixed bugs in oleobj, rtfobj, oleid, olevba</li>  
77 -</ul></li>  
78 </ul> 71 </ul>
79 <p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p> 72 <p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p>
80 <h2 id="tools">Tools:</h2> 73 <h2 id="tools">Tools:</h2>
@@ -97,7 +90,7 @@ @@ -97,7 +90,7 @@
97 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li> 90 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
98 </ul> 91 </ul>
99 <h2 id="projects-using-oletools">Projects using oletools:</h2> 92 <h2 id="projects-using-oletools">Projects using oletools:</h2>
100 -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p> 93 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
101 <h2 id="download-and-install">Download and Install:</h2> 94 <h2 id="download-and-install">Download and Install:</h2>
102 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p> 95 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
103 <ul> 96 <ul>
@@ -120,7 +113,7 @@ @@ -120,7 +113,7 @@
120 <p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p> 113 <p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
121 <h2 id="license">License</h2> 114 <h2 id="license">License</h2>
122 <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p> 115 <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
123 -<p>The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (http://www.decalage.info)</p> 116 +<p>The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (http://www.decalage.info)</p>
124 <p>All rights reserved.</p> 117 <p>All rights reserved.</p>
125 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 118 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
126 <ul> 119 <ul>
oletools/README.rst
  View file @6540ccb
@@ -29,6 +29,39 @@ Software. @@ -29,6 +29,39 @@ Software.
29 News 29 News
30 ---- 30 ----
31 31
  32 +- **2020-09-28 v0.56**:
  33 +
  34 + - olevba/mraptor:
  35 +
  36 + - added detection of trigger \_OnConnecting
  37 +
  38 + - olevba:
  39 +
  40 + - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros
  41 + parsing
  42 + - added simple analysis of Excel 4/XLM macros in XLSM files (PR
  43 + #569)
  44 + - added detection of template injection (PR #569)
  45 + - added detection of many suspicious keywords (PR #591 and #569,
  46 + see https://www.certego.net/en/news/advanced-vba-macros/)
  47 + - improved MHT detection (PR #532)
  48 + - added --no-xlm option to disable Excel 4/XLM macros parsing (PR
  49 + #532)
  50 + - fixed bug when decompressing raw chunks in VBA (issue #575)
  51 + - fixed bug with email package due to monkeypatch for MHT parsing
  52 + (issue #602, PR #604)
  53 + - fixed option --relaxed (issue #596, PR #595)
  54 + - enabled relaxed mode by default (issues #477, #593)
  55 + - fixed detect_vba_macros to always return VBA code as unicode on
  56 + Python 3 (issues #455, #477, #587, #593)
  57 + - replaced option --pcode by --show-pcode and --no-pcode,
  58 + replaced optparse by argparse (PR #479)
  59 +
  60 + - oleform: improved form parsing (PR #532)
  61 + - oleobj: "Ole10Native" is now case insensitive (issue #541)
  62 + - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)
  63 + - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)
  64 +
32 - **2019-12-03 v0.55**: 65 - **2019-12-03 v0.55**:
33 66
34 - olevba: 67 - olevba:
@@ -50,56 +83,6 @@ News @@ -50,56 +83,6 @@ News
50 - tests that trigger antivirus alerts have been temporarily 83 - tests that trigger antivirus alerts have been temporarily
51 disabled (issue #215) 84 disabled (issue #215)
52 85
53 -- **2019-05-22 v0.54.2**:  
54 -  
55 - - bugfix release: fixed several issues related to encrypted  
56 - documents and XLM/XLF Excel 4 macros  
57 - - msoffcrypto-tool is now installed by default to handle encrypted  
58 - documents  
59 - - olevba and msodde now handle documents encrypted with common  
60 - passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop  
61 - automatically.  
62 -  
63 -- **2019-04-04 v0.54**:  
64 -  
65 - - olevba, msodde: added support for encrypted MS Office files  
66 - - olevba: added detection and extraction of XLM/XLF Excel 4 macros  
67 - (thanks to plugin_biff from Didier Stevens' oledump)  
68 - - olevba, mraptor: added detection of VBA running Excel 4 macros  
69 - - olevba: detect and display special characters such as backspace  
70 - - olevba: colorized output showing suspicious keywords in the VBA  
71 - code  
72 - - olevba, mraptor: full Python 3 compatibility, no separate  
73 - olevba3/mraptor3 anymore  
74 - - olevba: improved handling of code pages and unicode  
75 - - olevba: fixed a false-positive in VBA macro detection  
76 - - rtfobj: improved OLE Package handling, improved Equation object  
77 - detection  
78 - - oleobj: added detection of external links to objects in OpenXML  
79 - - replaced third party packages by PyPI dependencies  
80 -  
81 -- 2018-05-30 v0.53:  
82 -  
83 - - olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML  
84 - files (aka Flat OPC format)  
85 - - improved support for VBA forms in olevba (oleform)  
86 - - rtfobj now displays the CLSID of OLE objects, which is the best  
87 - way to identify them. Known-bad CLSIDs such as MS Equation Editor  
88 - are highlighted in red.  
89 - - Updated rtfobj to handle obfuscated RTF samples.  
90 - - rtfobj now handles the "\'" obfuscation trick seen in recent  
91 - samples such as  
92 - https://twitter.com/buffaloverflow/status/989798880295444480, by  
93 - emulating the MS Word bug described in  
94 - https://securelist.com/disappearing-bytes/84017/  
95 - - msodde: improved detection of DDE formulas in CSV files  
96 - - oledir now displays the tree of storage/streams, along with CLSIDs  
97 - and their meaning.  
98 - - common.clsid contains the list of known CLSIDs, and their links to  
99 - CVE vulnerabilities when relevant.  
100 - - oleid now detects encrypted OpenXML files  
101 - - fixed bugs in oleobj, rtfobj, oleid, olevba  
102 -  
103 See the `full 86 See the `full
104 changelog <https://github.com/decalage2/oletools/wiki/Changelog>`__ for 87 changelog <https://github.com/decalage2/oletools/wiki/Changelog>`__ for
105 more information. 88 more information.
@@ -154,14 +137,18 @@ oletools are used by a number of projects and online malware analysis @@ -154,14 +137,18 @@ oletools are used by a number of projects and online malware analysis
154 services, including `ACE <https://github.com/IntegralDefense/ACE>`__, 137 services, including `ACE <https://github.com/IntegralDefense/ACE>`__,
155 `Anlyz.io <https://sandbox.anlyz.io/>`__, 138 `Anlyz.io <https://sandbox.anlyz.io/>`__,
156 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__, 139 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__,
157 -`CAPE <https://github.com/ctxis/CAPE>`__, `Cuckoo 140 +`CAPE <https://github.com/ctxis/CAPE>`__,
  141 +`CinCan <https://cincan.io>`__, `Cuckoo
158 Sandbox <https://github.com/cuckoosandbox/cuckoo>`__, 142 Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
159 `DARKSURGEON <https://github.com/cryps1s/DARKSURGEON>`__, 143 `DARKSURGEON <https://github.com/cryps1s/DARKSURGEON>`__,
160 `Deepviz <https://sandbox.deepviz.com/>`__, 144 `Deepviz <https://sandbox.deepviz.com/>`__,
161 -`dridex.malwareconfig.com <https://dridex.malwareconfig.com>`__, 145 +`DIARIO <https://diario.elevenpaths.com/>`__,
  146 +`dridex.malwareconfig.com <https://dridex.malwareconfig.com>`__, `EML
  147 +Analyzer <https://github.com/ninoseki/eml_analyzer>`__,
162 `FAME <https://certsocietegenerale.github.io/fame/>`__, 148 `FAME <https://certsocietegenerale.github.io/fame/>`__,
163 `FLARE-VM <https://github.com/fireeye/flare-vm>`__, 149 `FLARE-VM <https://github.com/fireeye/flare-vm>`__,
164 -`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__, `Joe 150 +`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__,
  151 +`IntelOwl <https://github.com/certego/IntelOwl>`__, `Joe
165 Sandbox <https://www.document-analyzer.net/>`__, `Laika 152 Sandbox <https://www.document-analyzer.net/>`__, `Laika
166 BOSS <https://github.com/lmco/laikaboss>`__, 153 BOSS <https://github.com/lmco/laikaboss>`__,
167 `MacroMilter <https://github.com/sbidy/MacroMilter>`__, 154 `MacroMilter <https://github.com/sbidy/MacroMilter>`__,
@@ -176,6 +163,7 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__, @@ -176,6 +163,7 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
176 `REMnux <https://remnux.org/>`__, 163 `REMnux <https://remnux.org/>`__,
177 `Snake <https://github.com/countercept/snake>`__, 164 `Snake <https://github.com/countercept/snake>`__,
178 `SNDBOX <https://app.sndbox.com>`__, 165 `SNDBOX <https://app.sndbox.com>`__,
  166 +`SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__,
179 `Strelka <https://github.com/target/strelka>`__, 167 `Strelka <https://github.com/target/strelka>`__,
180 `stoQ <https://stoq.punchcyber.com/>`__, 168 `stoQ <https://stoq.punchcyber.com/>`__,
181 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__, 169 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__,
@@ -245,7 +233,7 @@ This license applies to the python-oletools package, apart from the @@ -245,7 +233,7 @@ This license applies to the python-oletools package, apart from the
245 thirdparty folder which contains third-party files published with their 233 thirdparty folder which contains third-party files published with their
246 own license. 234 own license.
247 235
248 -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec 236 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec
249 (http://www.decalage.info) 237 (http://www.decalage.info)
250 238
251 All rights reserved. 239 All rights reserved.
oletools/doc/Home.html
  View file @6540ccb
@@ -16,7 +16,7 @@ @@ -16,7 +16,7 @@
16 <![endif]--> 16 <![endif]-->
17 </head> 17 </head>
18 <body> 18 <body>
19 -<h1 id="python-oletools-v0.55-documentation">python-oletools v0.55 documentation</h1> 19 +<h1 id="python-oletools-v0.56-documentation">python-oletools v0.56 documentation</h1>
20 <p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p> 20 <p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
21 <p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p> 21 <p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
22 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> 22 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
oletools/doc/Home.md
  View file @6540ccb
1 -python-oletools v0.55 documentation 1 +python-oletools v0.56 documentation
2 =================================== 2 ===================================
3 3
4 This is the home page of the documentation for python-oletools. The latest version can be found 4 This is the home page of the documentation for python-oletools. The latest version can be found
oletools/doc/License.html
  View file @6540ccb
@@ -18,7 +18,7 @@ @@ -18,7 +18,7 @@
18 <body> 18 <body>
19 <h1 id="license-for-python-oletools">License for python-oletools</h1> 19 <h1 id="license-for-python-oletools">License for python-oletools</h1>
20 <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p> 20 <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
21 -<p>The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p> 21 +<p>The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
22 <p>All rights reserved.</p> 22 <p>All rights reserved.</p>
23 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 23 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
24 <ul> 24 <ul>
oletools/doc/License.md
  View file @6540ccb
@@ -4,7 +4,7 @@ License for python-oletools @@ -4,7 +4,7 @@ License for python-oletools
4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 thirdparty folder which contains third-party files published with their own license. 5 thirdparty folder which contains third-party files published with their own license.
6 6
7 -The python-oletools package is copyright (c) 2012-2019 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) 7 +The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8
9 All rights reserved. 9 All rights reserved.
10 10
oletools/mraptor.py
  View file @6540ccb
@@ -23,7 +23,7 @@ http://www.decalage.info/python/oletools @@ -23,7 +23,7 @@ http://www.decalage.info/python/oletools
23 23
24 # === LICENSE ================================================================== 24 # === LICENSE ==================================================================
25 25
26 -# MacroRaptor is copyright (c) 2016-2019 Philippe Lagadec (http://www.decalage.info) 26 +# MacroRaptor is copyright (c) 2016-2020 Philippe Lagadec (http://www.decalage.info)
27 # All rights reserved. 27 # All rights reserved.
28 # 28 #
29 # Redistribution and use in source and binary forms, with or without modification, 29 # Redistribution and use in source and binary forms, with or without modification,
@@ -62,7 +62,7 @@ http://www.decalage.info/python/oletools @@ -62,7 +62,7 @@ http://www.decalage.info/python/oletools
62 # 2019-11-06 v0.55 PL: - added SetTimer 62 # 2019-11-06 v0.55 PL: - added SetTimer
63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562) 63 # 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
64 64
65 -__version__ = '0.56dev12' 65 +__version__ = '0.56'
66 66
67 #------------------------------------------------------------------------------ 67 #------------------------------------------------------------------------------
68 # TODO: 68 # TODO:
oletools/oleobj.py
  View file @6540ccb
@@ -88,7 +88,7 @@ from oletools.common.io_encoding import ensure_stdout_handles_unicode @@ -88,7 +88,7 @@ from oletools.common.io_encoding import ensure_stdout_handles_unicode
88 # 2018-10-30 SA: - added detection of external links (PR #317) 88 # 2018-10-30 SA: - added detection of external links (PR #317)
89 # 2020-03-03 v0.56 PL: - fixed bug #541, "Ole10Native" is case-insensitive 89 # 2020-03-03 v0.56 PL: - fixed bug #541, "Ole10Native" is case-insensitive
90 90
91 -__version__ = '0.56dev2' 91 +__version__ = '0.56'
92 92
93 # ----------------------------------------------------------------------------- 93 # -----------------------------------------------------------------------------
94 # TODO: 94 # TODO:
oletools/olevba.py
  View file @6540ccb
@@ -234,7 +234,7 @@ from __future__ import print_function @@ -234,7 +234,7 @@ from __future__ import print_function
234 # 2020-09-28 PL: - added VBA_Parser.get_vba_code_all_modules (partial fix 234 # 2020-09-28 PL: - added VBA_Parser.get_vba_code_all_modules (partial fix
235 # for issue #619) 235 # for issue #619)
236 236
237 -__version__ = '0.56dev12' 237 +__version__ = '0.56'
238 238
239 #------------------------------------------------------------------------------ 239 #------------------------------------------------------------------------------
240 # TODO: 240 # TODO: