Peter M. Groen / oletools

Commit 82b53b32737080925c74ac31ec98b37a48b3138d

Authored by Philippe Lagadec
1 parent e70b9d8f

updated doc folder

Inline Side-by-side
Showing 21 changed files with 3663 additions and 906 deletions
oletools/README.html
  View file @82b53b3
... ... @@ -4,40 +4,231 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="python-oletools">python-oletools</h1>
20   -<p><a href="https://pypi.org/project/oletools/"><img src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a href="https://travis-ci.org/decalage2/oletools"><img src="https://travis-ci.org/decalage2/oletools.svg?branch=master" alt="Build Status" /></a> <a href="https://saythanks.io/to/decalage2"><img src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg" alt="Say Thanks!" /></a></p>
21   -<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
22   -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a> <a href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>
23   -<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
  160 +<p><a href="https://pypi.org/project/oletools/"><img
  161 +src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a
  162 +href="https://travis-ci.org/decalage2/oletools"><img
  163 +src="https://travis-ci.org/decalage2/oletools.svg?branch=master"
  164 +alt="Build Status" /></a> <a
  165 +href="https://saythanks.io/to/decalage2"><img
  166 +src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg"
  167 +alt="Say Thanks!" /></a></p>
  168 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a
  169 +package of python tools to analyze <a
  170 +href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft
  171 +OLE2 files</a> (also called Structured Storage, Compound File Binary
  172 +Format or Compound Document File Format), such as Microsoft Office
  173 +97-2003 documents, MSI files or Outlook messages, mainly for malware
  174 +analysis, forensics and debugging. It is based on the <a
  175 +href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  176 +<p>It also provides tools to analyze RTF files and files based on the <a
  177 +href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>
  178 +(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  179 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE
  180 +objects, Excel 4 macros (XLM) and DDE links.</p>
  181 +<p>See <a
  182 +href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>
  183 +for more info.</p>
  184 +<p><strong>Quick links:</strong> <a
  185 +href="http://www.decalage.info/python/oletools">Home page</a> - <a
  186 +href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>
  187 +- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>
  188 +- <a href="https://github.com/decalage2/oletools/issues">Report
  189 +Issues/Suggestions/Questions</a> - <a
  190 +href="http://decalage.info/contact">Contact the Author</a> - <a
  191 +href="https://github.com/decalage2/oletools">Repository</a> - <a
  192 +href="https://twitter.com/decalage2">Updates on Twitter</a> <a
  193 +href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>
  194 +<p>Note: python-oletools is not related to OLETools published by BeCubed
  195 +Software.</p>
24 196 <h2 id="news">News</h2>
25 197 <ul>
  198 +<li><strong>2024-06-27 v0.60.2</strong>:
  199 +<ul>
  200 +<li>olevba:
  201 +<ul>
  202 +<li>fixed a bug in open_slk (issue #797, PR #769)</li>
  203 +<li>fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR
  204 +#723, issues #700, #701, #725, #791, #808, #811, #833)</li>
  205 +</ul></li>
  206 +<li>oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning
  207 +(PR #774)</li>
  208 +<li>rtfobj: fixed SyntaxError with Python 3.12 (PR #854)</li>
  209 +<li>clsid: added CLSIDs for MSI, Zed</li>
  210 +<li>ftguess: added MSI, PNG and OneNote formats</li>
  211 +<li>pyxswf: fixed python 3.12 compatibility (PR #841, issue #813)</li>
  212 +<li>setup/requirements: allow pyparsing 3 to solve install issues (PR
  213 +#812, issue #762)</li>
  214 +</ul></li>
26 215 <li><strong>2022-05-09 v0.60.1</strong>:
27 216 <ul>
28 217 <li>olevba:
29 218 <ul>
30 219 <li>fixed a bug when calling XLMMacroDeobfuscator (PR #737)</li>
31   -<li>removed keyword &quot;sample&quot; causing false positives</li>
  220 +<li>removed keyword "sample" causing false positives</li>
32 221 </ul></li>
33 222 <li>oleid: fixed OleID init issue (issue #695, PR #696)</li>
34 223 <li>oleobj:
35 224 <ul>
36 225 <li>added simple detection of CVE-2021-40444 initial stage</li>
37 226 <li>added detection for customUI onLoad</li>
38   -<li>improved handling of incorrect filenames in OLE package (PR #451)</li>
  227 +<li>improved handling of incorrect filenames in OLE package (PR
  228 +#451)</li>
39 229 </ul></li>
40   -<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue #692)</li>
  230 +<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue
  231 +#692)</li>
41 232 <li>ftguess:
42 233 <ul>
43 234 <li>added PowerPoint and XPS formats (PR #716)</li>
... ... @@ -48,7 +239,8 @@
48 239 </ul></li>
49 240 <li><strong>2021-06-02 v0.60</strong>:
50 241 <ul>
51   -<li>ftguess: new tool to identify file formats and containers (issue #680)</li>
  242 +<li>ftguess: new tool to identify file formats and containers (issue
  243 +#680)</li>
52 244 <li>oleid: (issue #679)
53 245 <ul>
54 246 <li>each indicator now has a risk level</li>
... ... @@ -58,160 +250,232 @@
58 250 </ul></li>
59 251 <li>olevba:
60 252 <ul>
61   -<li>when XLMMacroDeobfuscator is available, use it to extract and deobfuscate XLM macros</li>
  253 +<li>when XLMMacroDeobfuscator is available, use it to extract and
  254 +deobfuscate XLM macros</li>
62 255 </ul></li>
63 256 <li>rtfobj:
64 257 <ul>
65 258 <li>use ftguess to identify file type of OLE Package (issue #682)</li>
66 259 <li>fixed bug in re_executable_extensions</li>
67 260 </ul></li>
68   -<li>crypto: added PowerPoint transparent password '/01Hannes Ruescher/01' (issue #627)</li>
69   -<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional dependencies</li>
70   -</ul></li>
71   -<li><strong>2021-05-07 v0.56.2</strong>:
72   -<ul>
73   -<li>olevba:
74   -<ul>
75   -<li>updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)</li>
76   -</ul></li>
77   -<li>olevba, mraptor:
78   -<ul>
79   -<li>added detection of Workbook_BeforeClose (issue #518)</li>
80   -</ul></li>
81   -<li>rtfobj:
82   -<ul>
83   -<li>fixed bug when OLE package class name ends with null characters (issue #507, PR #648)</li>
84   -</ul></li>
85   -<li>oleid:
86   -<ul>
87   -<li>fixed bug in check_excel (issue #584, PR #585)</li>
88   -</ul></li>
89   -<li>clsid:
90   -<ul>
91   -<li>added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058</li>
92   -<li>added checks to ensure that all CLSIDs are uppercase (PR #678)</li>
93   -</ul></li>
94   -</ul></li>
95   -<li><strong>2021-04-02 v0.56.1</strong>:
96   -<ul>
97   -<li>olevba:
98   -<ul>
99   -<li>fixed bug when parsing some malformed files (issue #629)</li>
100   -</ul></li>
101   -<li>oleobj:
102   -<ul>
103   -<li>fixed bug preventing detection of links 'externalReference', 'frame', 'hyperlink' (issue #641, PR #670)</li>
104   -</ul></li>
105   -<li>setup:
106   -<ul>
107   -<li>avoid installing msoffcrypto-tool when platform is PyPy+Windows (issue #473)</li>
108   -<li>PyPI version is now a wheel package to improve installation and avoid antivirus false positives due to test files (issues #215, #398)</li>
109   -</ul></li>
110   -</ul></li>
111   -<li><strong>2020-09-28 v0.56</strong>:
112   -<ul>
113   -<li>olevba/mraptor:
114   -<ul>
115   -<li>added detection of trigger _OnConnecting</li>
116   -</ul></li>
117   -<li>olevba:
118   -<ul>
119   -<li>updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing</li>
120   -<li>added simple analysis of Excel 4/XLM macros in XLSM files (PR #569)</li>
121   -<li>added detection of template injection (PR #569)</li>
122   -<li>added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/)</li>
123   -<li>improved MHT detection (PR #532)</li>
124   -<li>added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532)</li>
125   -<li>fixed bug when decompressing raw chunks in VBA (issue #575)</li>
126   -<li>fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604)</li>
127   -<li>fixed option --relaxed (issue #596, PR #595)</li>
128   -<li>enabled relaxed mode by default (issues #477, #593)</li>
129   -<li>fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)</li>
130   -<li>replaced option --pcode by --show-pcode and --no-pcode, replaced optparse by argparse (PR #479)</li>
131   -</ul></li>
132   -<li>oleform: improved form parsing (PR #532)</li>
133   -<li>oleobj: &quot;Ole10Native&quot; is now case insensitive (issue #541)</li>
134   -<li>clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)</li>
135   -<li>ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)</li>
136   -</ul></li>
137   -<li><strong>2019-12-03 v0.55</strong>:
138   -<ul>
139   -<li>olevba:
140   -<ul>
141   -<li>added support for SLK files and XLM macro extraction from SLK</li>
142   -<li>VBA Stomping detection</li>
143   -<li>integrated pcodedmp to extract and disassemble P-code</li>
144   -<li>detection of suspicious keywords and IOCs in P-code</li>
145   -<li>new option --pcode to display P-code disassembly</li>
146   -<li>improved detection of auto execution triggers</li>
147   -</ul></li>
148   -<li>rtfobj: added URL carver for CVE-2017-0199</li>
149   -<li>better handling of unicode for systems with locale that does not support UTF-8, e.g. LANG=C (PR #365)</li>
150   -<li>tests:
151   -<ul>
152   -<li>test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215)</li>
153   -<li>tests that trigger antivirus alerts have been temporarily disabled (issue #215)</li>
154   -</ul></li>
  261 +<li>crypto: added PowerPoint transparent password '/01Hannes
  262 +Ruescher/01' (issue #627)</li>
  263 +<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional
  264 +dependencies</li>
155 265 </ul></li>
156 266 </ul>
157   -<p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p>
  267 +<p>See the <a
  268 +href="https://github.com/decalage2/oletools/wiki/Changelog">full
  269 +changelog</a> for more information.</p>
158 270 <h2 id="tools">Tools:</h2>
159   -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
160   -<ul>
161   -<li><a href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
162   -<li><a href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
163   -<li><a href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>: to detect malicious VBA Macros</li>
164   -<li><a href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
165   -<li><a href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
166   -<li><a href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to extract embedded objects from OLE files.</li>
167   -<li><a href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to extract embedded objects from RTF files.</li>
  271 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious
  272 +documents</h3>
  273 +<ul>
  274 +<li><a
  275 +href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to
  276 +analyze OLE files to detect specific characteristics usually found in
  277 +malicious files.</li>
  278 +<li><a
  279 +href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to
  280 +extract and analyze VBA Macro source code from MS Office documents (OLE
  281 +and OpenXML).</li>
  282 +<li><a
  283 +href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>:
  284 +to detect malicious VBA Macros</li>
  285 +<li><a
  286 +href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to
  287 +detect and extract DDE/DDEAUTO links from MS Office documents, RTF and
  288 +CSV</li>
  289 +<li><a
  290 +href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to
  291 +detect, extract and analyze Flash objects (SWF) that may be embedded in
  292 +files such as MS Office documents (e.g. Word, Excel) and RTF, which is
  293 +especially useful for malware analysis.</li>
  294 +<li><a
  295 +href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to
  296 +extract embedded objects from OLE files.</li>
  297 +<li><a
  298 +href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to
  299 +extract embedded objects from RTF files.</li>
168 300 </ul>
169   -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
  301 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze
  302 +the structure of OLE files</h3>
170 303 <ul>
171   -<li><a href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
172   -<li><a href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>: to extract all standard properties (metadata) from OLE files.</li>
173   -<li><a href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>: to extract creation and modification timestamps of all streams and storages.</li>
174   -<li><a href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
175   -<li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
  304 +<li><a
  305 +href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>:
  306 +A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint
  307 +documents), to view and extract individual data streams.</li>
  308 +<li><a
  309 +href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>:
  310 +to extract all standard properties (metadata) from OLE files.</li>
  311 +<li><a
  312 +href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>:
  313 +to extract creation and modification timestamps of all streams and
  314 +storages.</li>
  315 +<li><a
  316 +href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to
  317 +display all the directory entries of an OLE file, including free and
  318 +orphaned entries.</li>
  319 +<li><a
  320 +href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to
  321 +display a map of all the sectors in an OLE file.</li>
176 322 </ul>
177 323 <h2 id="projects-using-oletools">Projects using oletools:</h2>
178   -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime Platform/MQL</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>, <a href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
  324 +<p>oletools are used by a number of projects and online malware analysis
  325 +services, including <a
  326 +href="https://github.com/IntegralDefense/ACE">ACE</a>, <a
  327 +href="https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162">ADAPT</a>,
  328 +<a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a
  329 +href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a
  330 +href="https://github.com/binref/refinery">Binary Refinery</a>, <a
  331 +href="https://github.com/ctxis/CAPE">CAPE</a>, <a
  332 +href="https://cincan.io">CinCan</a>, <a
  333 +href="https://cortex.marketplace.pan.dev/marketplace/details/Oletools/">Cortex
  334 +XSOAR (Palo Alto)</a>, <a
  335 +href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a
  336 +href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a
  337 +href="https://sandbox.deepviz.com/">Deepviz</a>, <a
  338 +href="https://diario.elevenpaths.com/">DIARIO</a>, <a
  339 +href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a
  340 +href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a
  341 +href="https://pub.expmon.com/">EXPMON</a>, <a
  342 +href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a
  343 +href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a
  344 +href="https://www.glimps.fr/en/glimps-malware-2/">GLIMPS Malware</a>, <a
  345 +href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a
  346 +href="https://labs.inquest.net/">InQuest Labs</a>, <a
  347 +href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a
  348 +href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a
  349 +href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a
  350 +href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a
  351 +href="https://mailcow.email/">mailcow</a>, <a
  352 +href="https://malshare.io">malshare.io</a>, <a
  353 +href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a
  354 +href="https://www.adlice.com/download/mrf/">Malware Repository Framework
  355 +(MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a
  356 +href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a
  357 +href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a
  358 +href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a
  359 +href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a
  360 +href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a
  361 +href="https://www.quarkslab.com/products-qflow/">QFlow</a>, <a
  362 +href="https://github.com/CYB3RMX/Qu1cksc0pe">Qu1cksc0pe</a>, <a
  363 +href="https://github.com/tylabs/quicksand">Tylabs QuickSand</a>, <a
  364 +href="https://remnux.org/">REMnux</a>, <a
  365 +href="https://github.com/countercept/snake">Snake</a>, <a
  366 +href="https://app.sndbox.com">SNDBOX</a>, <a
  367 +href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365
  368 +Email</a>, <a
  369 +href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a
  370 +href="https://github.com/target/strelka">Strelka</a>, <a
  371 +href="https://stoq.punchcyber.com/">stoQ</a>, <a
  372 +href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime
  373 +Platform/MQL</a>, <a
  374 +href="https://github.com/jstrosch/subparse">Subparse</a>, <a
  375 +href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>,
  376 +<a href="https://s.threatbook.com/">ThreatBoook</a>, <a
  377 +href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a
  378 +href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a
  379 +href="http://viper.li/">Viper</a>, <a
  380 +href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a
  381 +href="https://yomi.yoroi.company">YOMI</a>, and probably <a
  382 +href="https://www.virustotal.com">VirusTotal</a>, <a
  383 +href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a
  384 +href="https://github.com/search?q=oletools&amp;type=Repositories">other
  385 +projects on GitHub</a>. (Please <a
  386 +href="(http://decalage.info/contact)">contact me</a> if you have or know
  387 +a project using oletools)</p>
179 388 <h2 id="download-and-install">Download and Install:</h2>
180   -<p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
  389 +<p>The recommended way to download and install/update the <strong>latest
  390 +stable release</strong> of oletools is to use <a
  391 +href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
181 392 <ul>
182   -<li>On Linux/Mac: <code>sudo -H pip install -U oletools[full]</code></li>
  393 +<li>On Linux/Mac:
  394 +<code>sudo -H pip install -U oletools[full]</code></li>
183 395 <li>On Windows: <code>pip install -U oletools[full]</code></li>
184 396 </ul>
185   -<p>This should automatically create command-line scripts to run each tool from any directory: <code>olevba</code>, <code>mraptor</code>, <code>rtfobj</code>, etc.</p>
186   -<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, just remove <code>[full]</code> from the command line.</p>
  397 +<p>This should automatically create command-line scripts to run each
  398 +tool from any directory: <code>olevba</code>, <code>mraptor</code>,
  399 +<code>rtfobj</code>, etc.</p>
  400 +<p>The keyword <code>[full]</code> means that all optional dependencies
  401 +will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
  402 +version without optional dependencies, just remove <code>[full]</code>
  403 +from the command line.</p>
187 404 <p>To get the <strong>latest development version</strong> instead:</p>
188 405 <ul>
189   -<li>On Linux/Mac: <code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
190   -<li>On Windows: <code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
  406 +<li>On Linux/Mac:
  407 +<code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
  408 +<li>On Windows:
  409 +<code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
191 410 </ul>
192   -<p>See the <a href="https://github.com/decalage2/oletools/wiki/Install">documentation</a> for other installation options.</p>
  411 +<p>See the <a
  412 +href="https://github.com/decalage2/oletools/wiki/Install">documentation</a>
  413 +for other installation options.</p>
193 414 <h2 id="documentation">Documentation:</h2>
194   -<p>The latest version of the documentation can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
195   -<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute:</h2>
196   -<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
197   -<p>To suggest improvements, report a bug or any issue, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>
198   -<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to provide feedback.</p>
199   -<p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
  415 +<p>The latest version of the documentation can be found <a
  416 +href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise
  417 +a copy is provided in the doc subfolder of the package.</p>
  418 +<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to
  419 +Suggest Improvements, Report Issues or Contribute:</h2>
  420 +<p>This is a personal open-source project, developed on my spare time.
  421 +Any contribution, suggestion, feedback or bug report is welcome.</p>
  422 +<p>To suggest improvements, report a bug or any issue, please use the <a
  423 +href="https://github.com/decalage2/oletools/issues">issue reporting
  424 +page</a>, providing all the information and files to reproduce the
  425 +problem.</p>
  426 +<p>You may also <a href="http://decalage.info/contact">contact the
  427 +author</a> directly to provide feedback.</p>
  428 +<p>The code is available in <a
  429 +href="https://github.com/decalage2/oletools">a GitHub repository</a>.
  430 +You may use it to submit enhancements using forks and pull requests.</p>
200 431 <h2 id="license">License</h2>
201   -<p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
202   -<p>The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec (http://www.decalage.info)</p>
  432 +<p>This license applies to the python-oletools package, apart from the
  433 +thirdparty folder which contains third-party files published with their
  434 +own license.</p>
  435 +<p>The python-oletools package is copyright (c) 2012-2024 Philippe
  436 +Lagadec (http://www.decalage.info)</p>
203 437 <p>All rights reserved.</p>
204   -<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
  438 +<p>Redistribution and use in source and binary forms, with or without
  439 +modification, are permitted provided that the following conditions are
  440 +met:</p>
205 441 <ul>
206   -<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
207   -<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
  442 +<li>Redistributions of source code must retain the above copyright
  443 +notice, this list of conditions and the following disclaimer.</li>
  444 +<li>Redistributions in binary form must reproduce the above copyright
  445 +notice, this list of conditions and the following disclaimer in the
  446 +documentation and/or other materials provided with the
  447 +distribution.</li>
208 448 </ul>
209   -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  449 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  450 +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  451 +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  452 +PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  453 +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  454 +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  455 +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  456 +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  457 +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  458 +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  459 +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
210 460 <hr />
211   -<p>olevba contains modified source code from the officeparser project, published under the following MIT License (MIT):</p>
  461 +<p>olevba contains modified source code from the officeparser project,
  462 +published under the following MIT License (MIT):</p>
212 463 <p>officeparser is copyright (c) 2014 John William Davison</p>
213   -<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
214   -<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
215   -<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
  464 +<p>Permission is hereby granted, free of charge, to any person obtaining
  465 +a copy of this software and associated documentation files (the
  466 +"Software"), to deal in the Software without restriction, including
  467 +without limitation the rights to use, copy, modify, merge, publish,
  468 +distribute, sublicense, and/or sell copies of the Software, and to
  469 +permit persons to whom the Software is furnished to do so, subject to
  470 +the following conditions:</p>
  471 +<p>The above copyright notice and this permission notice shall be
  472 +included in all copies or substantial portions of the Software.</p>
  473 +<p>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  474 +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  475 +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
  476 +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  477 +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  478 +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
  479 +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
216 480 </body>
217 481 </html>
... ...
oletools/README.rst
  View file @82b53b3
... ... @@ -7,10 +7,19 @@ python-oletools
7 7 python tools to analyze `Microsoft OLE2
8 8 files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`__
9 9 (also called Structured Storage, Compound File Binary Format or Compound
10   -Document File Format), such as Microsoft Office documents or Outlook
11   -messages, mainly for malware analysis, forensics and debugging. It is
12   -based on the `olefile <http://www.decalage.info/olefile>`__ parser. See
13   -http://www.decalage.info/python/oletools for more info.
  10 +Document File Format), such as Microsoft Office 97-2003 documents, MSI
  11 +files or Outlook messages, mainly for malware analysis, forensics and
  12 +debugging. It is based on the
  13 +`olefile <http://www.decalage.info/olefile>`__ parser.
  14 +
  15 +It also provides tools to analyze RTF files and files based on the
  16 +`OpenXML format <https://en.wikipedia.org/wiki/Office_Open_XML>`__ (aka
  17 +OOXML) such as MS Office 2007+ documents, XPS or MSIX files.
  18 +
  19 +For example, oletools can detect, extract and analyse VBA macros, OLE
  20 +objects, Excel 4 macros (XLM) and DDE links.
  21 +
  22 +See http://www.decalage.info/python/oletools for more info.
14 23  
15 24 **Quick links:** `Home
16 25 page <http://www.decalage.info/python/oletools>`__ -
... ... @@ -29,6 +38,24 @@ Software.
29 38 News
30 39 ----
31 40  
  41 +- **2024-06-27 v0.60.2**:
  42 +
  43 + - olevba:
  44 +
  45 + - fixed a bug in open_slk (issue #797, PR #769)
  46 + - fixed a bug due to new PROJECTCOMPATVERSION record in dir
  47 + stream (PR #723, issues #700, #701, #725, #791, #808, #811,
  48 + #833)
  49 +
  50 + - oleobj: fixed SyntaxError with Python 3.12 (PR #855),
  51 + SyntaxWarning (PR #774)
  52 + - rtfobj: fixed SyntaxError with Python 3.12 (PR #854)
  53 + - clsid: added CLSIDs for MSI, Zed
  54 + - ftguess: added MSI, PNG and OneNote formats
  55 + - pyxswf: fixed python 3.12 compatibility (PR #841, issue #813)
  56 + - setup/requirements: allow pyparsing 3 to solve install issues (PR
  57 + #812, issue #762)
  58 +
32 59 - **2022-05-09 v0.60.1**:
33 60  
34 61 - olevba:
... ... @@ -79,104 +106,6 @@ News
79 106 - setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional
80 107 dependencies
81 108  
82   -- **2021-05-07 v0.56.2**:
83   -
84   - - olevba:
85   -
86   - - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
87   -
88   - - olevba, mraptor:
89   -
90   - - added detection of Workbook_BeforeClose (issue #518)
91   -
92   - - rtfobj:
93   -
94   - - fixed bug when OLE package class name ends with null characters
95   - (issue #507, PR #648)
96   -
97   - - oleid:
98   -
99   - - fixed bug in check_excel (issue #584, PR #585)
100   -
101   - - clsid:
102   -
103   - - added several CLSIDs related to MS Office click-to-run issue
104   - CVE-2021-27058
105   - - added checks to ensure that all CLSIDs are uppercase (PR #678)
106   -
107   -- **2021-04-02 v0.56.1**:
108   -
109   - - olevba:
110   -
111   - - fixed bug when parsing some malformed files (issue #629)
112   -
113   - - oleobj:
114   -
115   - - fixed bug preventing detection of links 'externalReference',
116   - 'frame', 'hyperlink' (issue #641, PR #670)
117   -
118   - - setup:
119   -
120   - - avoid installing msoffcrypto-tool when platform is PyPy+Windows
121   - (issue #473)
122   - - PyPI version is now a wheel package to improve installation and
123   - avoid antivirus false positives due to test files (issues #215,
124   - #398)
125   -
126   -- **2020-09-28 v0.56**:
127   -
128   - - olevba/mraptor:
129   -
130   - - added detection of trigger \_OnConnecting
131   -
132   - - olevba:
133   -
134   - - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros
135   - parsing
136   - - added simple analysis of Excel 4/XLM macros in XLSM files (PR
137   - #569)
138   - - added detection of template injection (PR #569)
139   - - added detection of many suspicious keywords (PR #591 and #569,
140   - see https://www.certego.net/en/news/advanced-vba-macros/)
141   - - improved MHT detection (PR #532)
142   - - added --no-xlm option to disable Excel 4/XLM macros parsing (PR
143   - #532)
144   - - fixed bug when decompressing raw chunks in VBA (issue #575)
145   - - fixed bug with email package due to monkeypatch for MHT parsing
146   - (issue #602, PR #604)
147   - - fixed option --relaxed (issue #596, PR #595)
148   - - enabled relaxed mode by default (issues #477, #593)
149   - - fixed detect_vba_macros to always return VBA code as unicode on
150   - Python 3 (issues #455, #477, #587, #593)
151   - - replaced option --pcode by --show-pcode and --no-pcode,
152   - replaced optparse by argparse (PR #479)
153   -
154   - - oleform: improved form parsing (PR #532)
155   - - oleobj: "Ole10Native" is now case insensitive (issue #541)
156   - - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571)
157   - - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450)
158   -
159   -- **2019-12-03 v0.55**:
160   -
161   - - olevba:
162   -
163   - - added support for SLK files and XLM macro extraction from SLK
164   - - VBA Stomping detection
165   - - integrated pcodedmp to extract and disassemble P-code
166   - - detection of suspicious keywords and IOCs in P-code
167   - - new option --pcode to display P-code disassembly
168   - - improved detection of auto execution triggers
169   -
170   - - rtfobj: added URL carver for CVE-2017-0199
171   - - better handling of unicode for systems with locale that does not
172   - support UTF-8, e.g. LANG=C (PR #365)
173   - - tests:
174   -
175   - - test files can now be encrypted, to avoid antivirus alerts (PR
176   - #217, issue #215)
177   - - tests that trigger antivirus alerts have been temporarily
178   - disabled (issue #215)
179   -
180 109 See the `full
181 110 changelog <https://github.com/decalage2/oletools/wiki/Changelog>`__ for
182 111 more information.
... ... @@ -229,19 +158,25 @@ Projects using oletools:
229 158  
230 159 oletools are used by a number of projects and online malware analysis
231 160 services, including `ACE <https://github.com/IntegralDefense/ACE>`__,
  161 +`ADAPT <https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162>`__,
232 162 `Anlyz.io <https://sandbox.anlyz.io/>`__,
233   -`AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__,
  163 +`AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__, `Binary
  164 +Refinery <https://github.com/binref/refinery>`__,
234 165 `CAPE <https://github.com/ctxis/CAPE>`__,
235   -`CinCan <https://cincan.io>`__, `Cuckoo
236   -Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
  166 +`CinCan <https://cincan.io>`__, `Cortex XSOAR (Palo
  167 +Alto) <https://cortex.marketplace.pan.dev/marketplace/details/Oletools/>`__,
  168 +`Cuckoo Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
237 169 `DARKSURGEON <https://github.com/cryps1s/DARKSURGEON>`__,
238 170 `Deepviz <https://sandbox.deepviz.com/>`__,
239 171 `DIARIO <https://diario.elevenpaths.com/>`__,
240 172 `dridex.malwareconfig.com <https://dridex.malwareconfig.com>`__, `EML
241 173 Analyzer <https://github.com/ninoseki/eml_analyzer>`__,
  174 +`EXPMON <https://pub.expmon.com/>`__,
242 175 `FAME <https://certsocietegenerale.github.io/fame/>`__,
243   -`FLARE-VM <https://github.com/fireeye/flare-vm>`__,
244   -`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__,
  176 +`FLARE-VM <https://github.com/fireeye/flare-vm>`__, `GLIMPS
  177 +Malware <https://www.glimps.fr/en/glimps-malware-2/>`__,
  178 +`Hybrid-analysis.com <https://www.hybrid-analysis.com/>`__, `InQuest
  179 +Labs <https://labs.inquest.net/>`__,
245 180 `IntelOwl <https://github.com/certego/IntelOwl>`__, `Joe
246 181 Sandbox <https://www.document-analyzer.net/>`__, `Laika
247 182 BOSS <https://github.com/lmco/laikaboss>`__,
... ... @@ -256,6 +191,9 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
256 191 `PeekabooAV <https://github.com/scVENUS/PeekabooAV>`__,
257 192 `pcodedmp <https://github.com/bontchev/pcodedmp>`__,
258 193 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__,
  194 +`QFlow <https://www.quarkslab.com/products-qflow/>`__,
  195 +`Qu1cksc0pe <https://github.com/CYB3RMX/Qu1cksc0pe>`__, `Tylabs
  196 +QuickSand <https://github.com/tylabs/quicksand>`__,
259 197 `REMnux <https://remnux.org/>`__,
260 198 `Snake <https://github.com/countercept/snake>`__,
261 199 `SNDBOX <https://app.sndbox.com>`__, `Splunk add-on for MS O365
... ... @@ -264,8 +202,10 @@ Email &lt;https://splunkbase.splunk.com/app/5365/&gt;`__,
264 202 `Strelka <https://github.com/target/strelka>`__,
265 203 `stoQ <https://stoq.punchcyber.com/>`__, `Sublime
266 204 Platform/MQL <https://docs.sublimesecurity.com/docs/enrichment-functions>`__,
  205 +`Subparse <https://github.com/jstrosch/subparse>`__,
267 206 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__,
268   -`TSUGURI Linux <https://tsurugi-linux.org/>`__,
  207 +`ThreatBoook <https://s.threatbook.com/>`__, `TSUGURI
  208 +Linux <https://tsurugi-linux.org/>`__,
269 209 `Vba2Graph <https://github.com/MalwareCantFly/Vba2Graph>`__,
270 210 `Viper <http://viper.li/>`__,
271 211 `ViperMonkey <https://github.com/decalage2/ViperMonkey>`__,
... ... @@ -337,7 +277,7 @@ This license applies to the python-oletools package, apart from the
337 277 thirdparty folder which contains third-party files published with their
338 278 own license.
339 279  
340   -The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec
  280 +The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec
341 281 (http://www.decalage.info)
342 282  
343 283 All rights reserved.
... ...
oletools/doc/Contribute.html
  View file @82b53b3
... ... @@ -4,30 +4,182 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19   -<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute</h1>
20   -<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
21   -<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, and provide all the information and files to reproduce the problem.</p>
22   -<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>send feedback</strong>.</p>
23   -<p>The code is available in <a href="https://github.com/decalage2/oletools">a repository on GitHub</a>. You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>
  159 +<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to
  160 +Suggest Improvements, Report Issues or Contribute</h1>
  161 +<p>This is a personal open-source project, developed on my spare time.
  162 +Any contribution, suggestion, feedback or bug report is welcome.</p>
  163 +<p>To <strong>suggest improvements, report a bug or any issue</strong>,
  164 +please use the <a
  165 +href="https://github.com/decalage2/oletools/issues">issue reporting
  166 +page</a>, and provide all the information and files to reproduce the
  167 +problem.</p>
  168 +<p>You may also <a href="http://decalage.info/contact">contact the
  169 +author</a> directly to <strong>send feedback</strong>.</p>
  170 +<p>The code is available in <a
  171 +href="https://github.com/decalage2/oletools">a repository on GitHub</a>.
  172 +You may use it to <strong>submit enhancements</strong> using forks and
  173 +pull requests.</p>
24 174 <hr />
25   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  175 +<h2 id="python-oletools-documentation">python-oletools
  176 +documentation</h2>
26 177 <ul>
27 178 <li><a href="Home.html">Home</a></li>
28 179 <li><a href="License.html">License</a></li>
29 180 <li><a href="Install.html">Install</a></li>
30   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  181 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  182 +Report Issues</li>
31 183 <li>Tools:
32 184 <ul>
33 185 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/Contribute.md
  View file @82b53b3
... ... @@ -13,8 +13,6 @@ to **send feedback**.
13 13  
14 14 The code is available in [a repository on GitHub](https://github.com/decalage2/oletools).
15 15 You may use it to **submit enhancements** using forks and pull requests.
16   -When submitting a PR, GitHub will automatically check that unittests pass and
17   -`pylint -E` does not report anything for the code files you changed.
18 16  
19 17 --------------------------------------------------------------------------
20 18  
... ...
oletools/doc/Home.html
  View file @82b53b3
... ... @@ -4,50 +4,240 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19   -<h1 id="python-oletools-v0.56-documentation">python-oletools v0.56 documentation</h1>
20   -<p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
21   -<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
22   -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
23   -<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
  159 +<h1 id="python-oletools-documentation">python-oletools
  160 +documentation</h1>
  161 +<p>This is the home page of the documentation for python-oletools. The
  162 +latest version can be found <a
  163 +href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise
  164 +a copy is provided in the doc subfolder of the package.</p>
  165 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a
  166 +package of python tools to analyze <a
  167 +href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft
  168 +OLE2 files</a> (also called Structured Storage, Compound File Binary
  169 +Format or Compound Document File Format), such as Microsoft Office
  170 +97-2003 documents, MSI files or Outlook messages, mainly for malware
  171 +analysis, forensics and debugging. It is based on the <a
  172 +href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  173 +<p>It also provides tools to analyze RTF files and files based on the <a
  174 +href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>
  175 +(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  176 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE
  177 +objects, Excel 4 macros (XLM) and DDE links.</p>
  178 +<p>See <a
  179 +href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>
  180 +for more info.</p>
  181 +<p><strong>Quick links:</strong> <a
  182 +href="http://www.decalage.info/python/oletools">Home page</a> - <a
  183 +href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>
  184 +- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>
  185 +- <a href="https://github.com/decalage2/oletools/issues">Report
  186 +Issues/Suggestions/Questions</a> - <a
  187 +href="http://decalage.info/contact">Contact the Author</a> - <a
  188 +href="https://github.com/decalage2/oletools">Repository</a> - <a
  189 +href="https://twitter.com/decalage2">Updates on Twitter</a></p>
  190 +<p>Note: python-oletools is not related to OLETools published by BeCubed
  191 +Software.</p>
24 192 <h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>
25   -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
  193 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious
  194 +documents</h3>
26 195 <ul>
27   -<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
28   -<li><strong><a href="olevba.html">olevba</a></strong>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
29   -<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect malicious VBA Macros</li>
30   -<li><strong><a href="msodde.html">msodde</a></strong>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
31   -<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
32   -<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract embedded objects from OLE files.</li>
33   -<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract embedded objects from RTF files.</li>
  196 +<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE
  197 +files to detect specific characteristics usually found in malicious
  198 +files.</li>
  199 +<li><strong><a href="olevba.html">olevba</a></strong>: to extract and
  200 +analyze VBA Macro source code from MS Office documents (OLE and
  201 +OpenXML).</li>
  202 +<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect
  203 +malicious VBA Macros</li>
  204 +<li><strong><a href="msodde.html">msodde</a></strong>: to detect and
  205 +extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
  206 +<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect,
  207 +extract and analyze Flash objects (SWF) that may be embedded in files
  208 +such as MS Office documents (e.g. Word, Excel) and RTF, which is
  209 +especially useful for malware analysis.</li>
  210 +<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract
  211 +embedded objects from OLE files.</li>
  212 +<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract
  213 +embedded objects from RTF files.</li>
34 214 </ul>
35   -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
  215 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze
  216 +the structure of OLE files</h3>
36 217 <ul>
37   -<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
38   -<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all standard properties (metadata) from OLE files.</li>
39   -<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract creation and modification timestamps of all streams and storages.</li>
40   -<li><strong><a href="oledir.html">oledir</a></strong>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
41   -<li><strong><a href="olemap.html">olemap</a></strong>: to display a map of all the sectors in an OLE file.</li>
  218 +<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple
  219 +GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to
  220 +view and extract individual data streams.</li>
  221 +<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all
  222 +standard properties (metadata) from OLE files.</li>
  223 +<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract
  224 +creation and modification timestamps of all streams and storages.</li>
  225 +<li><strong><a href="oledir.html">oledir</a></strong>: to display all
  226 +the directory entries of an OLE file, including free and orphaned
  227 +entries.</li>
  228 +<li><strong><a href="olemap.html">olemap</a></strong>: to display a map
  229 +of all the sectors in an OLE file.</li>
42 230 <li>and a few others (coming soon)</li>
43 231 </ul>
44 232 <hr />
45   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  233 +<h2 id="python-oletools-documentation-1">python-oletools
  234 +documentation</h2>
46 235 <ul>
47 236 <li><a href="Home.html">Home</a></li>
48 237 <li><a href="License.html">License</a></li>
49 238 <li><a href="Install.html">Install</a></li>
50   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  239 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  240 +Report Issues</li>
51 241 <li>Tools:
52 242 <ul>
53 243 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/Home.md
  View file @82b53b3
1   -python-oletools v0.56 documentation
2   -===================================
  1 +python-oletools documentation
  2 +=============================
3 3  
4 4 This is the home page of the documentation for python-oletools. The latest version can be found
5 5 [online](https://github.com/decalage2/oletools/wiki), otherwise a copy is provided in the doc subfolder of the package.
6 6  
7   -[python-oletools](http://www.decalage.info/python/oletools) is a package of python tools to analyze
8   -[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  7 +[oletools](http://www.decalage.info/python/oletools) is a package of python tools to analyze
  8 +[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format)
9 9 (also called Structured Storage, Compound File Binary Format or Compound Document File Format),
10   -such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging.
  10 +such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis,
  11 +forensics and debugging.
11 12 It is based on the [olefile](http://www.decalage.info/olefile) parser.
12   -See [http://www.decalage.info/python/oletools](http://www.decalage.info/python/oletools) for more info.
  13 +
  14 +It also provides tools to analyze RTF files and files based on the [OpenXML format](https://en.wikipedia.org/wiki/Office_Open_XML)
  15 +(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.
  16 +
  17 +For example, oletools can detect, extract and analyse VBA macros, OLE objects, Excel 4 macros (XLM) and DDE links.
  18 +
  19 +See [http://www.decalage.info/python/oletools](http://www.decalage.info/python/oletools) for more info.
13 20  
14 21 **Quick links:**
15 22 [Home page](http://www.decalage.info/python/oletools) -
... ...
oletools/doc/Install.html
  View file @82b53b3
... ... @@ -4,73 +4,267 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19   -<h1 id="how-to-download-and-install-oletools">How to Download and Install oletools</h1>
  159 +<h1 id="how-to-download-and-install-oletools">How to Download and
  160 +Install oletools</h1>
20 161 <h2 id="pre-requisites">Pre-requisites</h2>
21   -<p>The recommended Python version to run oletools is the latest <strong>Python 3.x</strong> (3.9 for now). Python 2.7 is still supported for the moment, even if it reached end of life in 2020 (for projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly recommended to switch to Python 3 if possible.</p>
22   -<h2 id="recommended-way-to-downloadinstallupdate-oletools-pip">Recommended way to Download+Install/Update oletools: pip</h2>
23   -<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/</p>
  162 +<p>The recommended Python version to run oletools is the latest
  163 +<strong>Python 3.x</strong> (3.12 for now). Python 2.7 is still
  164 +supported for the moment, even if it reached end of life in 2020 (for
  165 +projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly
  166 +recommended to switch to Python 3 if possible.</p>
  167 +<h2
  168 +id="recommended-way-to-downloadinstallupdate-oletools-pip-or-pipx">Recommended
  169 +way to Download+Install/Update oletools: pip or pipx</h2>
  170 +<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not
  171 +installed on your system, either upgrade Python or see
  172 +https://pip.pypa.io/en/stable/installing/</p>
24 173 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3>
25   -<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a shell:</p>
  174 +<p>To download and install/update the latest release version of oletools
  175 +with all its dependencies, run the following command in a shell:</p>
26 176 <pre class="text"><code>sudo -H pip install -U oletools[full]</code></pre>
27   -<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
  177 +<p>The keyword <code>[full]</code> means that all optional dependencies
  178 +will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
  179 +version without optional dependencies, use the following command
  180 +instead:</p>
28 181 <pre class="text"><code>sudo -H pip install -U oletools</code></pre>
29   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
30   -<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts in /usr/local/bin to run all the oletools from any directory.</p>
  182 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
  183 +install on a specific Python version.</p>
  184 +<p>On some Linux distributions, it might not be allowed to install
  185 +system-wide python packages with pip. In that case, pipx may be a better
  186 +alternative to install oletools in a user virtual environment, and to
  187 +install the command-line scripts oleid, olevba, etc:</p>
  188 +<pre class="text"><code>pipx install oletools</code></pre>
  189 +<p><strong>Important</strong>: Since version 0.50, pip will
  190 +automatically create convenient command-line scripts in /usr/local/bin
  191 +to run all the oletools from any directory.</p>
31 192 <h3 id="windows">Windows</h3>
32   -<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a cmd window:</p>
  193 +<p>To download and install/update the latest release version of oletools
  194 +with all its dependencies, run the following command in a cmd
  195 +window:</p>
33 196 <pre class="text"><code>pip install -U oletools[full]</code></pre>
34   -<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
  197 +<p>The keyword <code>[full]</code> means that all optional dependencies
  198 +will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
  199 +version without optional dependencies, use the following command
  200 +instead:</p>
35 201 <pre class="text"><code>pip install -U oletools</code></pre>
36   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
37   -<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
  202 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
  203 +install on a specific Python version.</p>
  204 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd
  205 +window with Administrator privileges in order to run pip and install for
  206 +all users. If that is not possible, you may also install only for the
  207 +current user by adding the <code>--user</code> option:</p>
38 208 <pre class="text"><code>pip3 install -U --user oletools</code></pre>
39   -<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts to run all the oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>
40   -<h2 id="how-to-install-the-latest-development-version">How to install the latest development version</h2>
41   -<p>If you want to benefit from the latest improvements in the development version, you may also use pip:</p>
  209 +<p><strong>Important</strong>: Since version 0.50, pip will
  210 +automatically create convenient command-line scripts to run all the
  211 +oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>
  212 +<h2 id="how-to-install-the-latest-development-version">How to install
  213 +the latest development version</h2>
  214 +<p>If you want to benefit from the latest improvements in the
  215 +development version, you may also use pip:</p>
42 216 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3>
43 217 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
44   -<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
45   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  218 +<p>Note that it will install oletools without optional dependencies such
  219 +as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  220 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
  221 +install on a specific Python version.</p>
46 222 <h3 id="windows-1">Windows</h3>
47 223 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
48   -<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
49   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
50   -<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
  224 +<p>Note that it will install oletools without optional dependencies such
  225 +as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  226 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
  227 +install on a specific Python version.</p>
  228 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd
  229 +window with Administrator privileges in order to run pip and install for
  230 +all users. If that is not possible, you may also install only for the
  231 +current user by adding the <code>--user</code> option:</p>
51 232 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre>
52   -<h2 id="how-to-install-offline---computer-without-internet-access">How to install offline - Computer without Internet access</h2>
53   -<p>First, download the oletools archive on a computer with Internet access: * Latest stable version: from https://pypi.org/project/oletools/ or https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
  233 +<h2 id="how-to-install-offline---computer-without-internet-access">How
  234 +to install offline - Computer without Internet access</h2>
  235 +<p>First, download the oletools archive on a computer with Internet
  236 +access: * Latest stable version: from https://pypi.org/project/oletools/
  237 +or https://github.com/decalage2/oletools/releases * Development version:
  238 +https://github.com/decalage2/oletools/archive/master.zip</p>
54 239 <p>Copy the archive file to the target computer.</p>
55   -<p>On Linux, Mac OSX, Unix, run the following command using the filename of the archive that you downloaded:</p>
  240 +<p>On Linux, Mac OSX, Unix, run the following command using the filename
  241 +of the archive that you downloaded:</p>
56 242 <pre class="text"><code>sudo -H pip install -U oletools.zip</code></pre>
57 243 <p>On Windows:</p>
58 244 <pre class="text"><code>pip install -U oletools.zip</code></pre>
59   -<h2 id="old-school-install-using-setup.py">Old school install using setup.py</h2>
60   -<p>If you cannot use pip, it is still possible to run the setup.py script directly. However, this method will not create the command-line scripts automatically.</p>
61   -<p>First, download the oletools archive: * Latest stable version: from https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
62   -<p>Then extract the archive, open a shell and go to the oletools directory.</p>
  245 +<h2 id="old-school-install-using-setup.py">Old school install using
  246 +setup.py</h2>
  247 +<p>If you cannot use pip, it is still possible to run the setup.py
  248 +script directly. However, this method will not create the command-line
  249 +scripts automatically.</p>
  250 +<p>First, download the oletools archive: * Latest stable version: from
  251 +https://github.com/decalage2/oletools/releases * Development version:
  252 +https://github.com/decalage2/oletools/archive/master.zip</p>
  253 +<p>Then extract the archive, open a shell and go to the oletools
  254 +directory.</p>
63 255 <h3 id="linux-mac-osx-unix-2">Linux, Mac OSX, Unix</h3>
64 256 <pre class="text"><code>sudo -H python setup.py install</code></pre>
65 257 <h3 id="windows-2">Windows:</h3>
66 258 <pre class="text"><code>python setup.py install</code></pre>
67 259 <hr />
68   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  260 +<h2 id="python-oletools-documentation">python-oletools
  261 +documentation</h2>
69 262 <ul>
70 263 <li><a href="Home.html">Home</a></li>
71 264 <li><a href="License.html">License</a></li>
72 265 <li><a href="Install.html">Install</a></li>
73   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  266 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  267 +Report Issues</li>
74 268 <li>Tools:
75 269 <ul>
76 270 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/Install.md
  View file @82b53b3
... ... @@ -4,13 +4,13 @@ How to Download and Install oletools
4 4 Pre-requisites
5 5 --------------
6 6  
7   -The recommended Python version to run oletools is the latest **Python 3.x** (3.9 for now).
  7 +The recommended Python version to run oletools is the latest **Python 3.x** (3.12 for now).
8 8 Python 2.7 is still supported for the moment, even if it reached end of life in 2020
9 9 (for projects still using Python 2/PyPy 2 such as ViperMonkey).
10 10 It is highly recommended to switch to Python 3 if possible.
11 11  
12   -Recommended way to Download+Install/Update oletools: pip
13   ---------------------------------------------------------
  12 +Recommended way to Download+Install/Update oletools: pip or pipx
  13 +----------------------------------------------------------------
14 14  
15 15 Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your
16 16 system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/
... ... @@ -32,6 +32,15 @@ sudo -H pip install -U oletools
32 32  
33 33 Replace `pip` by `pip3` or `pip2` to install on a specific Python version.
34 34  
  35 +On some Linux distributions, it might not be allowed to install system-wide python packages
  36 +with pip. In that case, pipx may be a better alternative to install oletools in a user virtual
  37 +environment, and to install the command-line scripts oleid, olevba, etc:
  38 +
  39 +```text
  40 +pipx install oletools
  41 +```
  42 +
  43 +
35 44 **Important**: Since version 0.50, pip will automatically create convenient command-line scripts
36 45 in /usr/local/bin to run all the oletools from any directory.
37 46  
... ...
oletools/doc/License.html
  View file @82b53b3
... ... @@ -4,28 +4,189 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="license-for-python-oletools">License for python-oletools</h1>
20   -<p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
21   -<p>The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
  160 +<p>This license applies to the <a
  161 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  162 +package, apart from the thirdparty folder which contains third-party
  163 +files published with their own license.</p>
  164 +<p>The python-oletools package is copyright (c) 2012-2024 Philippe
  165 +Lagadec (<a
  166 +href="http://www.decalage.info">http://www.decalage.info</a>)</p>
22 167 <p>All rights reserved.</p>
23   -<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
  168 +<p>Redistribution and use in source and binary forms, with or without
  169 +modification, are permitted provided that the following conditions are
  170 +met:</p>
24 171 <ul>
25   -<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
26   -<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
  172 +<li>Redistributions of source code must retain the above copyright
  173 +notice, this list of conditions and the following disclaimer.</li>
  174 +<li>Redistributions in binary form must reproduce the above copyright
  175 +notice, this list of conditions and the following disclaimer in the
  176 +documentation and/or other materials provided with the
  177 +distribution.</li>
27 178 </ul>
28   -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  179 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  180 +“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  181 +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  182 +PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  183 +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  184 +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  185 +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  186 +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  187 +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  188 +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  189 +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
29 190 <table>
30 191 <tbody>
31 192 <tr class="odd">
... ... @@ -33,18 +194,35 @@
33 194 </tr>
34 195 </tbody>
35 196 </table>
36   -<p>olevba contains modified source code from the <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> project, published under the following MIT License (MIT):</p>
  197 +<p>olevba contains modified source code from the <a
  198 +href="https://github.com/unixfreak0037/officeparser">officeparser</a>
  199 +project, published under the following MIT License (MIT):</p>
37 200 <p>officeparser is copyright (c) 2014 John William Davison</p>
38   -<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
39   -<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
40   -<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
  201 +<p>Permission is hereby granted, free of charge, to any person obtaining
  202 +a copy of this software and associated documentation files (the
  203 +“Software”), to deal in the Software without restriction, including
  204 +without limitation the rights to use, copy, modify, merge, publish,
  205 +distribute, sublicense, and/or sell copies of the Software, and to
  206 +permit persons to whom the Software is furnished to do so, subject to
  207 +the following conditions:</p>
  208 +<p>The above copyright notice and this permission notice shall be
  209 +included in all copies or substantial portions of the Software.</p>
  210 +<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,
  211 +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  212 +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
  213 +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  214 +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  215 +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
  216 +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
41 217 <hr />
42   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  218 +<h2 id="python-oletools-documentation">python-oletools
  219 +documentation</h2>
43 220 <ul>
44 221 <li><a href="Home.html">Home</a></li>
45 222 <li><a href="License.html">License</a></li>
46 223 <li><a href="Install.html">Install</a></li>
47   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  224 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  225 +Report Issues</li>
48 226 <li>Tools:
49 227 <ul>
50 228 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/License.md
  View file @82b53b3
... ... @@ -4,7 +4,7 @@ License for python-oletools
4 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 5 thirdparty folder which contains third-party files published with their own license.
6 6  
7   -The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
  7 +The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8  
9 9 All rights reserved.
10 10  
... ...
oletools/doc/mraptor.html
  View file @82b53b3
... ... @@ -4,25 +4,177 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="mraptor-macroraptor">mraptor (MacroRaptor)</h1>
20   -<p>mraptor is a tool designed to detect most malicious VBA Macros using generic heuristics. Unlike antivirus engines, it does not rely on signatures.</p>
21   -<p>In a nutshell, mraptor detects keywords corresponding to the three following types of behaviour that are present in clear text in almost any macro malware: - A: Auto-execution trigger - W: Write to the file system or memory - X: Execute a file or any payload outside the VBA context</p>
22   -<p>mraptor considers that a macro is suspicious when A and (W or X) is true.</p>
23   -<p>For more information about mraptor’s detection algorithm, see the article <a href="http://www.decalage.info/mraptor">How to detect most malicious macros without an antivirus</a>.</p>
24   -<p>mraptor can be used either as a command-line tool, or as a python module from your own applications.</p>
25   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>mraptor is a tool designed to detect most malicious VBA Macros using
  161 +generic heuristics. Unlike antivirus engines, it does not rely on
  162 +signatures.</p>
  163 +<p>In a nutshell, mraptor detects keywords corresponding to the three
  164 +following types of behaviour that are present in clear text in almost
  165 +any macro malware: - A: Auto-execution trigger - W: Write to the file
  166 +system or memory - X: Execute a file or any payload outside the VBA
  167 +context</p>
  168 +<p>mraptor considers that a macro is suspicious when A and (W or X) is
  169 +true.</p>
  170 +<p>For more information about mraptor’s detection algorithm, see the
  171 +article <a href="http://www.decalage.info/mraptor">How to detect most
  172 +malicious macros without an antivirus</a>.</p>
  173 +<p>mraptor can be used either as a command-line tool, or as a python
  174 +module from your own applications.</p>
  175 +<p>It is part of the <a
  176 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  177 +package.</p>
26 178 <h2 id="usage">Usage</h2>
27 179 <pre class="text"><code>Usage: mraptor [options] &lt;filename&gt; [filename2 ...]
28 180  
... ... @@ -50,24 +202,34 @@ An exit code is returned based on the analysis result:
50 202 <h3 id="examples">Examples</h3>
51 203 <p>Scan a single file:</p>
52 204 <pre class="text"><code>mraptor file.doc</code></pre>
53   -<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
  205 +<p>Scan a single file, stored in a Zip archive with password
  206 +“infected”:</p>
54 207 <pre class="text"><code>mraptor malicious_file.xls.zip -z infected</code></pre>
55 208 <p>Scan a collection of files stored in a folder:</p>
56 209 <pre class="text"><code>mraptor &quot;MalwareZoo/VBA/*&quot;</code></pre>
57   -<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes around a file name when you use wildcards such as <code>*</code> and <code>?</code>. Otherwise, the shell may replace the argument with the actual list of files matching the wildcards before starting the script.</p>
  210 +<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes
  211 +around a file name when you use wildcards such as <code>*</code> and
  212 +<code>?</code>. Otherwise, the shell may replace the argument with the
  213 +actual list of files matching the wildcards before starting the
  214 +script.</p>
58 215 <p><img src="mraptor1.png" /></p>
59 216 <h2 id="python-3-support---mraptor3">Python 3 support - mraptor3</h2>
60   -<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3. There is no need to use mraptor3 anymore, however it is still present for backward compatibility.</p>
  217 +<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3.
  218 +There is no need to use mraptor3 anymore, however it is still present
  219 +for backward compatibility.</p>
61 220 <hr />
62   -<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in Python applications</h2>
  221 +<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in
  222 +Python applications</h2>
63 223 <p>TODO</p>
64 224 <hr />
65   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  225 +<h2 id="python-oletools-documentation">python-oletools
  226 +documentation</h2>
66 227 <ul>
67 228 <li><a href="Home.html">Home</a></li>
68 229 <li><a href="License.html">License</a></li>
69 230 <li><a href="Install.html">Install</a></li>
70   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  231 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  232 +Report Issues</li>
71 233 <li>Tools:
72 234 <ul>
73 235 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olebrowse.html
  View file @82b53b3
... ... @@ -4,30 +4,182 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="olebrowse">olebrowse</h1>
20   -<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</p>
21   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel,
  161 +Powerpoint documents), to view and extract individual data streams.</p>
  162 +<p>It is part of the <a
  163 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  164 +package.</p>
22 165 <h2 id="dependencies">Dependencies</h2>
23   -<p>olebrowse requires <a href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and MacOSX, it should be installed with Python, and olebrowse should work out of the box.</p>
24   -<p>However, on Linux it might be necessary to install the tkinter package for Python separately. For example, on Ubuntu this is done with the following command:</p>
  166 +<p>olebrowse requires <a
  167 +href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and
  168 +MacOSX, it should be installed with Python, and olebrowse should work
  169 +out of the box.</p>
  170 +<p>However, on Linux it might be necessary to install the tkinter
  171 +package for Python separately. For example, on Ubuntu this is done with
  172 +the following command:</p>
25 173 <pre><code>sudo apt-get install python-tk</code></pre>
26 174 <p>And for Python 3:</p>
27 175 <pre><code>sudo apt-get install python3-tk</code></pre>
28 176 <h2 id="usage">Usage</h2>
29 177 <pre><code>olebrowse [file]</code></pre>
30   -<p>If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.</p>
  178 +<p>If you provide a file it will be opened, else a dialog will allow you
  179 +to browse folders to open a file. Then if it is a valid OLE file, the
  180 +list of data streams will be displayed. You can select a stream, and
  181 +then either view its content in a builtin hexadecimal viewer, or save it
  182 +to a file for further analysis.</p>
31 183 <h2 id="screenshots">Screenshots</h2>
32 184 <p>Main menu, showing all streams in the OLE file:</p>
33 185 <p><img src="olebrowse1_menu.png" /></p>
... ... @@ -36,12 +188,14 @@
36 188 <p>Hex view for a stream:</p>
37 189 <p><img src="olebrowse3_hexview.png" /></p>
38 190 <hr />
39   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  191 +<h2 id="python-oletools-documentation">python-oletools
  192 +documentation</h2>
40 193 <ul>
41 194 <li><a href="Home.html">Home</a></li>
42 195 <li><a href="License.html">License</a></li>
43 196 <li><a href="Install.html">Install</a></li>
44   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  197 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  198 +Report Issues</li>
45 199 <li>Tools:
46 200 <ul>
47 201 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oledir.html
  View file @82b53b3
... ... @@ -4,22 +4,166 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="oledir">oledir</h1>
20   -<p>oledir is a script to display all the directory entries of an OLE file, including free and orphaned entries.</p>
21   -<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
22   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>oledir is a script to display all the directory entries of an OLE
  161 +file, including free and orphaned entries.</p>
  162 +<p>It can be used either as a command-line tool, or as a python module
  163 +from your own applications.</p>
  164 +<p>It is part of the <a
  165 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  166 +package.</p>
23 167 <h2 id="usage">Usage</h2>
24 168 <pre class="text"><code>Usage: oledir [options] &lt;filename&gt; [filename2 ...]
25 169  
... ... @@ -38,15 +182,18 @@ Options:
38 182 <pre class="text"><code>oledir file.doc</code></pre>
39 183 <p><img src="oledir.png" /></p>
40 184 <hr />
41   -<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in Python applications</h2>
  185 +<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in
  186 +Python applications</h2>
42 187 <p>TODO</p>
43 188 <hr />
44   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  189 +<h2 id="python-oletools-documentation">python-oletools
  190 +documentation</h2>
45 191 <ul>
46 192 <li><a href="Home.html">Home</a></li>
47 193 <li><a href="License.html">License</a></li>
48 194 <li><a href="Install.html">Install</a></li>
49   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  195 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  196 +Report Issues</li>
50 197 <li>Tools:
51 198 <ul>
52 199 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oleid.html
  View file @82b53b3
... ... @@ -4,89 +4,233 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + pre > code.sourceCode { white-space: pre; position: relative; }
  156 + pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
  157 + pre > code.sourceCode > span:empty { height: 1.2em; }
  158 + .sourceCode { overflow: visible; }
  159 + code.sourceCode > span { color: inherit; text-decoration: inherit; }
  160 + div.sourceCode { margin: 1em 0; }
  161 + pre.sourceCode { margin: 0; }
  162 + @media screen {
  163 + div.sourceCode { overflow: auto; }
  164 + }
  165 + @media print {
  166 + pre > code.sourceCode { white-space: pre-wrap; }
  167 + pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
  168 + }
  169 + pre.numberSource code
  170 + { counter-reset: source-line 0; }
  171 + pre.numberSource code > span
  172 + { position: relative; left: -4em; counter-increment: source-line; }
  173 + pre.numberSource code > span > a:first-child::before
  174 + { content: counter(source-line);
  175 + position: relative; left: -1em; text-align: right; vertical-align: baseline;
  176 + border: none; display: inline-block;
  177 + -webkit-touch-callout: none; -webkit-user-select: none;
  178 + -khtml-user-select: none; -moz-user-select: none;
  179 + -ms-user-select: none; user-select: none;
  180 + padding: 0 4px; width: 4em;
  181 + color: #aaaaaa;
  182 + }
  183 + pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  184 + div.sourceCode
  185 + { }
  186 + @media screen {
  187 + pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
  188 + }
  189 + code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  190 + code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  191 + code span.at { color: #7d9029; } /* Attribute */
  192 + code span.bn { color: #40a070; } /* BaseN */
  193 + code span.bu { color: #008000; } /* BuiltIn */
  194 + code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  195 + code span.ch { color: #4070a0; } /* Char */
  196 + code span.cn { color: #880000; } /* Constant */
  197 + code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  198 + code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  199 + code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  200 + code span.dt { color: #902000; } /* DataType */
  201 + code span.dv { color: #40a070; } /* DecVal */
  202 + code span.er { color: #ff0000; font-weight: bold; } /* Error */
  203 + code span.ex { } /* Extension */
  204 + code span.fl { color: #40a070; } /* Float */
  205 + code span.fu { color: #06287e; } /* Function */
  206 + code span.im { color: #008000; font-weight: bold; } /* Import */
  207 + code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  208 + code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  209 + code span.op { color: #666666; } /* Operator */
  210 + code span.ot { color: #007020; } /* Other */
  211 + code span.pp { color: #bc7a00; } /* Preprocessor */
  212 + code span.sc { color: #4070a0; } /* SpecialChar */
  213 + code span.ss { color: #bb6688; } /* SpecialString */
  214 + code span.st { color: #4070a0; } /* String */
  215 + code span.va { color: #19177c; } /* Variable */
  216 + code span.vs { color: #4070a0; } /* VerbatimString */
  217 + code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  218 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 219 </style>
14   - <style type="text/css">
15   -a.sourceLine { display: inline-block; line-height: 1.25; }
16   -a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
17   -a.sourceLine:empty { height: 1.2em; position: absolute; }
18   -.sourceCode { overflow: visible; }
19   -code.sourceCode { white-space: pre; position: relative; }
20   -div.sourceCode { margin: 1em 0; }
21   -pre.sourceCode { margin: 0; }
22   -@media screen {
23   -div.sourceCode { overflow: auto; }
24   -}
25   -@media print {
26   -code.sourceCode { white-space: pre-wrap; }
27   -a.sourceLine { text-indent: -1em; padding-left: 1em; }
28   -}
29   -pre.numberSource a.sourceLine
30   - { position: relative; }
31   -pre.numberSource a.sourceLine:empty
32   - { position: absolute; }
33   -pre.numberSource a.sourceLine::before
34   - { content: attr(data-line-number);
35   - position: absolute; left: -5em; text-align: right; vertical-align: baseline;
36   - border: none; pointer-events: all;
37   - -webkit-touch-callout: none; -webkit-user-select: none;
38   - -khtml-user-select: none; -moz-user-select: none;
39   - -ms-user-select: none; user-select: none;
40   - padding: 0 4px; width: 4em;
41   - color: #aaaaaa;
42   - }
43   -pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
44   -div.sourceCode
45   - { }
46   -@media screen {
47   -a.sourceLine::before { text-decoration: underline; }
48   -}
49   -code span.al { color: #ff0000; font-weight: bold; } /* Alert */
50   -code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
51   -code span.at { color: #7d9029; } /* Attribute */
52   -code span.bn { color: #40a070; } /* BaseN */
53   -code span.bu { } /* BuiltIn */
54   -code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
55   -code span.ch { color: #4070a0; } /* Char */
56   -code span.cn { color: #880000; } /* Constant */
57   -code span.co { color: #60a0b0; font-style: italic; } /* Comment */
58   -code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
59   -code span.do { color: #ba2121; font-style: italic; } /* Documentation */
60   -code span.dt { color: #902000; } /* DataType */
61   -code span.dv { color: #40a070; } /* DecVal */
62   -code span.er { color: #ff0000; font-weight: bold; } /* Error */
63   -code span.ex { } /* Extension */
64   -code span.fl { color: #40a070; } /* Float */
65   -code span.fu { color: #06287e; } /* Function */
66   -code span.im { } /* Import */
67   -code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
68   -code span.kw { color: #007020; font-weight: bold; } /* Keyword */
69   -code span.op { color: #666666; } /* Operator */
70   -code span.ot { color: #007020; } /* Other */
71   -code span.pp { color: #bc7a00; } /* Preprocessor */
72   -code span.sc { color: #4070a0; } /* SpecialChar */
73   -code span.ss { color: #bb6688; } /* SpecialString */
74   -code span.st { color: #4070a0; } /* String */
75   -code span.va { color: #19177c; } /* Variable */
76   -code span.vs { color: #4070a0; } /* VerbatimString */
77   -code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
78   - </style>
79   - <!--[if lt IE 9]>
80   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
81   - <![endif]-->
82 220 </head>
83 221 <body>
84 222 <h1 id="oleid">oleid</h1>
85   -<p>oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics usually found in malicious files (e.g. malware). For example it can detect VBA macros and embedded Flash objects.</p>
86   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  223 +<p>oleid is a script to analyze OLE files such as MS Office documents
  224 +(e.g. Word, Excel), to detect specific characteristics usually found in
  225 +malicious files (e.g. malware). For example it can detect VBA macros and
  226 +embedded Flash objects.</p>
  227 +<p>It is part of the <a
  228 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  229 +package.</p>
87 230 <h2 id="main-features">Main Features</h2>
88 231 <ul>
89   -<li>Detect OLE file type from its internal structure (e.g. MS Word, Excel, PowerPoint, …)</li>
  232 +<li>Detect OLE file type from its internal structure (e.g. MS Word,
  233 +Excel, PowerPoint, …)</li>
90 234 <li>Detect VBA Macros</li>
91 235 <li>Detect embedded Flash objects</li>
92 236 <li>Detect embedded OLE objects</li>
... ... @@ -101,7 +245,8 @@ code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warni
101 245 <li>Generic VBA macros detection</li>
102 246 <li>Detect auto-executable VBA macros</li>
103 247 <li>Extended OLE file types detection</li>
104   -<li>Detect unusual OLE structures (fragmentation, unused sectors, etc)</li>
  248 +<li>Detect unusual OLE structures (fragmentation, unused sectors,
  249 +etc)</li>
105 250 <li>Options to scan multiple files</li>
106 251 <li>Options to scan files from encrypted zip archives</li>
107 252 <li>CSV output</li>
... ... @@ -109,7 +254,8 @@ code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warni
109 254 <h2 id="usage">Usage</h2>
110 255 <pre class="text"><code>oleid &lt;file&gt;</code></pre>
111 256 <h3 id="example">Example</h3>
112   -<p>Analyzing a Word document containing a Flash object and VBA macros:</p>
  257 +<p>Analyzing a Word document containing a Flash object and VBA
  258 +macros:</p>
113 259 <pre class="text"><code>C:\oletools&gt;oleid word_flash_vba.doc
114 260  
115 261 Filename: word_flash_vba.doc
... ... @@ -128,35 +274,45 @@ Filename: word_flash_vba.doc
128 274 | ObjectPool | True |
129 275 | Flash objects | 1 |
130 276 +-------------------------------+-----------------------+</code></pre>
131   -<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid in your Python applications</h2>
132   -<p>First, import oletools.oleid, and create an <strong>OleID</strong> object to scan a file:</p>
133   -<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">import</span> oletools.oleid</a>
134   -<a class="sourceLine" id="cb3-2" data-line-number="2"></a>
135   -<a class="sourceLine" id="cb3-3" data-line-number="3">oid <span class="op">=</span> oletools.oleid.OleID(filename)</a></code></pre></div>
136   -<p>Note: filename can be a filename, a file-like object, or a bytes string containing the file to be analyzed.</p>
137   -<p>Second, call the <strong>check()</strong> method. It returns a list of <strong>Indicator</strong> objects.</p>
  277 +<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid
  278 +in your Python applications</h2>
  279 +<p>First, import oletools.oleid, and create an <strong>OleID</strong>
  280 +object to scan a file:</p>
  281 +<div class="sourceCode" id="cb3"><pre
  282 +class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">import</span> oletools.oleid</span>
  283 +<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a></span>
  284 +<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a>oid <span class="op">=</span> oletools.oleid.OleID(filename)</span></code></pre></div>
  285 +<p>Note: filename can be a filename, a file-like object, or a bytes
  286 +string containing the file to be analyzed.</p>
  287 +<p>Second, call the <strong>check()</strong> method. It returns a list
  288 +of <strong>Indicator</strong> objects.</p>
138 289 <p>Each Indicator object has the following attributes:</p>
139 290 <ul>
140 291 <li><strong>id</strong>: str, identifier for the indicator</li>
141 292 <li><strong>name</strong>: str, name to display the indicator</li>
142   -<li><strong>description</strong>: str, long description of the indicator</li>
143   -<li><strong>type</strong>: class of the indicator (e.g. bool, str, int)</li>
  293 +<li><strong>description</strong>: str, long description of the
  294 +indicator</li>
  295 +<li><strong>type</strong>: class of the indicator (e.g. bool, str,
  296 +int)</li>
144 297 <li><strong>value</strong>: value of the indicator</li>
145 298 </ul>
146 299 <p>For example, the following code displays all the indicators:</p>
147   -<div class="sourceCode" id="cb4"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb4-1" data-line-number="1">indicators <span class="op">=</span> oid.check()</a>
148   -<a class="sourceLine" id="cb4-2" data-line-number="2"><span class="cf">for</span> i <span class="kw">in</span> indicators:</a>
149   -<a class="sourceLine" id="cb4-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</a>
150   -<a class="sourceLine" id="cb4-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</a>
151   -<a class="sourceLine" id="cb4-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;&#39;</span></a></code></pre></div>
  300 +<div class="sourceCode" id="cb4"><pre
  301 +class="sourceCode python"><code class="sourceCode python"><span id="cb4-1"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a>indicators <span class="op">=</span> oid.check()</span>
  302 +<span id="cb4-2"><a href="#cb4-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> i <span class="kw">in</span> indicators:</span>
  303 +<span id="cb4-3"><a href="#cb4-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</span>
  304 +<span id="cb4-4"><a href="#cb4-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</span>
  305 +<span id="cb4-5"><a href="#cb4-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;&#39;</span></span></code></pre></div>
152 306 <p>See the source code of oleid.py for more details.</p>
153 307 <hr />
154   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  308 +<h2 id="python-oletools-documentation">python-oletools
  309 +documentation</h2>
155 310 <ul>
156 311 <li><a href="Home.html">Home</a></li>
157 312 <li><a href="License.html">License</a></li>
158 313 <li><a href="Install.html">Install</a></li>
159   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  314 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  315 +Report Issues</li>
160 316 <li>Tools:
161 317 <ul>
162 318 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olemap.html
  View file @82b53b3
... ... @@ -4,22 +4,166 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="olemap">olemap</h1>
20   -<p>olemap is a script to display a map of all the sectors in an OLE file.</p>
21   -<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
22   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>olemap is a script to display a map of all the sectors in an OLE
  161 +file.</p>
  162 +<p>It can be used either as a command-line tool, or as a python module
  163 +from your own applications.</p>
  164 +<p>It is part of the <a
  165 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  166 +package.</p>
23 167 <h2 id="usage">Usage</h2>
24 168 <pre class="text"><code>Usage: olemap &lt;filename&gt;</code></pre>
25 169 <h3 id="examples">Examples</h3>
... ... @@ -28,15 +172,18 @@
28 172 <p><img src="olemap1.png" /></p>
29 173 <p><img src="olemap2.png" /></p>
30 174 <hr />
31   -<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in Python applications</h2>
  175 +<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in
  176 +Python applications</h2>
32 177 <p>TODO</p>
33 178 <hr />
34   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  179 +<h2 id="python-oletools-documentation">python-oletools
  180 +documentation</h2>
35 181 <ul>
36 182 <li><a href="Home.html">Home</a></li>
37 183 <li><a href="License.html">License</a></li>
38 184 <li><a href="Install.html">Install</a></li>
39   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  185 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  186 +Report Issues</li>
40 187 <li>Tools:
41 188 <ul>
42 189 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olemeta.html
  View file @82b53b3
... ... @@ -4,34 +4,181 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="olemeta">olemeta</h1>
20   -<p>olemeta is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract all standard properties present in the OLE file.</p>
21   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>olemeta is a script to parse OLE files such as MS Office documents
  161 +(e.g. Word, Excel), to extract all standard properties present in the
  162 +OLE file.</p>
  163 +<p>It is part of the <a
  164 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  165 +package.</p>
22 166 <h2 id="usage">Usage</h2>
23 167 <pre class="text"><code>olemeta &lt;file&gt;</code></pre>
24 168 <h3 id="example">Example</h3>
25 169 <p><img src="olemeta1.png" /></p>
26   -<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in Python applications</h2>
  170 +<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in
  171 +Python applications</h2>
27 172 <p>TODO</p>
28 173 <hr />
29   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  174 +<h2 id="python-oletools-documentation">python-oletools
  175 +documentation</h2>
30 176 <ul>
31 177 <li><a href="Home.html">Home</a></li>
32 178 <li><a href="License.html">License</a></li>
33 179 <li><a href="Install.html">Install</a></li>
34   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  180 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  181 +Report Issues</li>
35 182 <li>Tools:
36 183 <ul>
37 184 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oleobj.html
  View file @82b53b3
... ... @@ -4,35 +4,181 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="oleobj">oleobj</h1>
20 160 <p>oleobj is a script to extract embedded objects from OLE files.</p>
21   -<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
22   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  161 +<p>It can be used either as a command-line tool, or as a python module
  162 +from your own applications.</p>
  163 +<p>It is part of the <a
  164 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  165 +package.</p>
23 166 <h2 id="usage">Usage</h2>
24 167 <pre class="text"><code>TODO</code></pre>
25 168 <hr />
26   -<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in Python applications</h2>
  169 +<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in
  170 +Python applications</h2>
27 171 <p>See rtfobj.py source code.</p>
28 172 <p>TODO</p>
29 173 <hr />
30   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  174 +<h2 id="python-oletools-documentation">python-oletools
  175 +documentation</h2>
31 176 <ul>
32 177 <li><a href="Home.html">Home</a></li>
33 178 <li><a href="License.html">License</a></li>
34 179 <li><a href="Install.html">Install</a></li>
35   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  180 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  181 +Report Issues</li>
36 182 <li>Tools:
37 183 <ul>
38 184 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oletimes.html
  View file @82b53b3
... ... @@ -4,25 +4,170 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="oletimes">oletimes</h1>
20   -<p>oletimes is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract creation and modification times of all streams and storages in the OLE file.</p>
21   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  160 +<p>oletimes is a script to parse OLE files such as MS Office documents
  161 +(e.g. Word, Excel), to extract creation and modification times of all
  162 +streams and storages in the OLE file.</p>
  163 +<p>It is part of the <a
  164 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  165 +package.</p>
22 166 <h2 id="usage">Usage</h2>
23 167 <pre class="text"><code>oletimes &lt;file&gt;</code></pre>
24 168 <h3 id="example">Example</h3>
25   -<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  169 +<p>Checking the malware sample <a
  170 +href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
26 171 <pre class="text"><code>&gt;oletimes DIAN_caso-5415.doc
27 172  
28 173 +----------------------------+---------------------+---------------------+
... ... @@ -48,15 +193,18 @@
48 193 | &#39;Macros/VBA/dir&#39; | None | None |
49 194 | &#39;WordDocument&#39; | None | None |
50 195 +----------------------------+---------------------+---------------------+</code></pre>
51   -<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes in Python applications</h2>
  196 +<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes
  197 +in Python applications</h2>
52 198 <p>TODO</p>
53 199 <hr />
54   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  200 +<h2 id="python-oletools-documentation">python-oletools
  201 +documentation</h2>
55 202 <ul>
56 203 <li><a href="Home.html">Home</a></li>
57 204 <li><a href="License.html">License</a></li>
58 205 <li><a href="Install.html">Install</a></li>
59   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  206 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  207 +Report Issues</li>
60 208 <li>Tools:
61 209 <ul>
62 210 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olevba.html
  View file @82b53b3
... ... @@ -4,88 +4,242 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + pre > code.sourceCode { white-space: pre; position: relative; }
  156 + pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
  157 + pre > code.sourceCode > span:empty { height: 1.2em; }
  158 + .sourceCode { overflow: visible; }
  159 + code.sourceCode > span { color: inherit; text-decoration: inherit; }
  160 + div.sourceCode { margin: 1em 0; }
  161 + pre.sourceCode { margin: 0; }
  162 + @media screen {
  163 + div.sourceCode { overflow: auto; }
  164 + }
  165 + @media print {
  166 + pre > code.sourceCode { white-space: pre-wrap; }
  167 + pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
  168 + }
  169 + pre.numberSource code
  170 + { counter-reset: source-line 0; }
  171 + pre.numberSource code > span
  172 + { position: relative; left: -4em; counter-increment: source-line; }
  173 + pre.numberSource code > span > a:first-child::before
  174 + { content: counter(source-line);
  175 + position: relative; left: -1em; text-align: right; vertical-align: baseline;
  176 + border: none; display: inline-block;
  177 + -webkit-touch-callout: none; -webkit-user-select: none;
  178 + -khtml-user-select: none; -moz-user-select: none;
  179 + -ms-user-select: none; user-select: none;
  180 + padding: 0 4px; width: 4em;
  181 + color: #aaaaaa;
  182 + }
  183 + pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  184 + div.sourceCode
  185 + { }
  186 + @media screen {
  187 + pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
  188 + }
  189 + code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  190 + code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  191 + code span.at { color: #7d9029; } /* Attribute */
  192 + code span.bn { color: #40a070; } /* BaseN */
  193 + code span.bu { color: #008000; } /* BuiltIn */
  194 + code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  195 + code span.ch { color: #4070a0; } /* Char */
  196 + code span.cn { color: #880000; } /* Constant */
  197 + code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  198 + code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  199 + code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  200 + code span.dt { color: #902000; } /* DataType */
  201 + code span.dv { color: #40a070; } /* DecVal */
  202 + code span.er { color: #ff0000; font-weight: bold; } /* Error */
  203 + code span.ex { } /* Extension */
  204 + code span.fl { color: #40a070; } /* Float */
  205 + code span.fu { color: #06287e; } /* Function */
  206 + code span.im { color: #008000; font-weight: bold; } /* Import */
  207 + code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  208 + code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  209 + code span.op { color: #666666; } /* Operator */
  210 + code span.ot { color: #007020; } /* Other */
  211 + code span.pp { color: #bc7a00; } /* Preprocessor */
  212 + code span.sc { color: #4070a0; } /* SpecialChar */
  213 + code span.ss { color: #bb6688; } /* SpecialString */
  214 + code span.st { color: #4070a0; } /* String */
  215 + code span.va { color: #19177c; } /* Variable */
  216 + code span.vs { color: #4070a0; } /* VerbatimString */
  217 + code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  218 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 219 </style>
14   - <style type="text/css">
15   -a.sourceLine { display: inline-block; line-height: 1.25; }
16   -a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
17   -a.sourceLine:empty { height: 1.2em; position: absolute; }
18   -.sourceCode { overflow: visible; }
19   -code.sourceCode { white-space: pre; position: relative; }
20   -div.sourceCode { margin: 1em 0; }
21   -pre.sourceCode { margin: 0; }
22   -@media screen {
23   -div.sourceCode { overflow: auto; }
24   -}
25   -@media print {
26   -code.sourceCode { white-space: pre-wrap; }
27   -a.sourceLine { text-indent: -1em; padding-left: 1em; }
28   -}
29   -pre.numberSource a.sourceLine
30   - { position: relative; }
31   -pre.numberSource a.sourceLine:empty
32   - { position: absolute; }
33   -pre.numberSource a.sourceLine::before
34   - { content: attr(data-line-number);
35   - position: absolute; left: -5em; text-align: right; vertical-align: baseline;
36   - border: none; pointer-events: all;
37   - -webkit-touch-callout: none; -webkit-user-select: none;
38   - -khtml-user-select: none; -moz-user-select: none;
39   - -ms-user-select: none; user-select: none;
40   - padding: 0 4px; width: 4em;
41   - color: #aaaaaa;
42   - }
43   -pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
44   -div.sourceCode
45   - { }
46   -@media screen {
47   -a.sourceLine::before { text-decoration: underline; }
48   -}
49   -code span.al { color: #ff0000; font-weight: bold; } /* Alert */
50   -code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
51   -code span.at { color: #7d9029; } /* Attribute */
52   -code span.bn { color: #40a070; } /* BaseN */
53   -code span.bu { } /* BuiltIn */
54   -code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
55   -code span.ch { color: #4070a0; } /* Char */
56   -code span.cn { color: #880000; } /* Constant */
57   -code span.co { color: #60a0b0; font-style: italic; } /* Comment */
58   -code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
59   -code span.do { color: #ba2121; font-style: italic; } /* Documentation */
60   -code span.dt { color: #902000; } /* DataType */
61   -code span.dv { color: #40a070; } /* DecVal */
62   -code span.er { color: #ff0000; font-weight: bold; } /* Error */
63   -code span.ex { } /* Extension */
64   -code span.fl { color: #40a070; } /* Float */
65   -code span.fu { color: #06287e; } /* Function */
66   -code span.im { } /* Import */
67   -code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
68   -code span.kw { color: #007020; font-weight: bold; } /* Keyword */
69   -code span.op { color: #666666; } /* Operator */
70   -code span.ot { color: #007020; } /* Other */
71   -code span.pp { color: #bc7a00; } /* Preprocessor */
72   -code span.sc { color: #4070a0; } /* SpecialChar */
73   -code span.ss { color: #bb6688; } /* SpecialString */
74   -code span.st { color: #4070a0; } /* String */
75   -code span.va { color: #19177c; } /* Variable */
76   -code span.vs { color: #4070a0; } /* VerbatimString */
77   -code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
78   - </style>
79   - <!--[if lt IE 9]>
80   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
81   - <![endif]-->
82 220 </head>
83 221 <body>
84 222 <h1 id="olevba">olevba</h1>
85   -<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text, and detect security-related patterns such as <strong>auto-executable macros</strong>, <strong>suspicious VBA keywords</strong> used by malware, anti-sandboxing and anti-virtualization techniques, and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common <strong>obfuscation methods including Hex encoding, StrReverse, Base64, Dridex, VBA expressions</strong>, and extracts IOCs from decoded strings. XLM/Excel 4 Macros are also supported in Excel and SLK files.</p>
86   -<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
87   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
88   -<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison, with significant modifications.</p>
  223 +<p>olevba is a script to parse OLE and OpenXML files such as MS Office
  224 +documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>,
  225 +extract their <strong>source code</strong> in clear text, and detect
  226 +security-related patterns such as <strong>auto-executable
  227 +macros</strong>, <strong>suspicious VBA keywords</strong> used by
  228 +malware, anti-sandboxing and anti-virtualization techniques, and
  229 +potential <strong>IOCs</strong> (IP addresses, URLs, executable
  230 +filenames, etc). It also detects and decodes several common
  231 +<strong>obfuscation methods including Hex encoding, StrReverse, Base64,
  232 +Dridex, VBA expressions</strong>, and extracts IOCs from decoded
  233 +strings. XLM/Excel 4 Macros are also supported in Excel and SLK
  234 +files.</p>
  235 +<p>It can be used either as a command-line tool, or as a python module
  236 +from your own applications.</p>
  237 +<p>It is part of the <a
  238 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  239 +package.</p>
  240 +<p>olevba is based on source code from <a
  241 +href="https://github.com/unixfreak0037/officeparser">officeparser</a> by
  242 +John William Davison, with significant modifications.</p>
89 243 <h2 id="supported-formats">Supported formats</h2>
90 244 <ul>
91 245 <li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li>
... ... @@ -101,31 +255,50 @@ code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warni
101 255 </ul>
102 256 <p>S## Main Features</p>
103 257 <ul>
104   -<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML, MHT</li>
  258 +<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML,
  259 +MHT</li>
105 260 <li>Extract VBA macro source code</li>
106 261 <li>Detect auto-executable macros</li>
107 262 <li>Detect suspicious VBA keywords often used by malware</li>
108 263 <li>Detect anti-sandboxing and anti-virtualization techniques</li>
109   -<li>Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex</li>
110   -<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val, StrReverse, Environ, +, &amp;, using a VBA parser built with <a href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom Hex and Base64 encodings</li>
111   -<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</li>
112   -<li>Scan multiple files and sample collections (wildcards, recursive)</li>
  264 +<li>Detect and decodes strings obfuscated with
  265 +Hex/Base64/StrReverse/Dridex</li>
  266 +<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val,
  267 +StrReverse, Environ, +, &amp;, using a VBA parser built with <a
  268 +href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom
  269 +Hex and Base64 encodings</li>
  270 +<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail
  271 +addresses and executable file names</li>
  272 +<li>Scan multiple files and sample collections (wildcards,
  273 +recursive)</li>
113 274 <li>Triage mode for a summary view of multiple files</li>
114 275 <li>Scan malware samples in password-protected Zip archives</li>
115 276 <li>Python API to use olevba from your applications</li>
116 277 </ul>
117   -<p>MS Office files encrypted with a password are also supported, because VBA macro code is never encrypted, only the content of the document.</p>
  278 +<p>MS Office files encrypted with a password are also supported, because
  279 +VBA macro code is never encrypted, only the content of the document.</p>
118 280 <h2 id="about-vba-macros">About VBA Macros</h2>
119   -<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros and how they are stored in MS Office documents.</p>
  281 +<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a>
  282 +for more information and technical details about VBA Macros and how they
  283 +are stored in MS Office documents.</p>
120 284 <h2 id="how-it-works">How it works</h2>
121 285 <ol type="1">
122   -<li>olevba checks the file type: If it is an OLE file (i.e MS Office 97-2003), it is parsed right away.</li>
123   -<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba looks for all OLE files stored in it (e.g. vbaProject.bin, editdata.mso), and opens them.</li>
124   -<li>olevba identifies all the VBA projects stored in the OLE structure.</li>
125   -<li>Each VBA project is parsed to find the corresponding OLE streams containing macro code.</li>
126   -<li>In each of these OLE streams, the VBA macro source code is extracted and decompressed (RLE compression).</li>
127   -<li>olevba looks for specific strings obfuscated with various algorithms (Hex, Base64, StrReverse, Dridex, VBA expressions).</li>
128   -<li>olevba scans the macro source code and the deobfuscated strings to find suspicious keywords, auto-executable macros and potential IOCs (URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>
  286 +<li>olevba checks the file type: If it is an OLE file (i.e MS Office
  287 +97-2003), it is parsed right away.</li>
  288 +<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba
  289 +looks for all OLE files stored in it (e.g. vbaProject.bin,
  290 +editdata.mso), and opens them.</li>
  291 +<li>olevba identifies all the VBA projects stored in the OLE
  292 +structure.</li>
  293 +<li>Each VBA project is parsed to find the corresponding OLE streams
  294 +containing macro code.</li>
  295 +<li>In each of these OLE streams, the VBA macro source code is extracted
  296 +and decompressed (RLE compression).</li>
  297 +<li>olevba looks for specific strings obfuscated with various algorithms
  298 +(Hex, Base64, StrReverse, Dridex, VBA expressions).</li>
  299 +<li>olevba scans the macro source code and the deobfuscated strings to
  300 +find suspicious keywords, auto-executable macros and potential IOCs
  301 +(URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>
129 302 </ol>
130 303 <h2 id="usage">Usage</h2>
131 304 <pre class="text"><code>Usage: olevba [options] &lt;filename&gt; [filename2 ...]
... ... @@ -164,28 +337,37 @@ Options:
164 337 -d, --detailed detailed mode, display full results (default for
165 338 single file)
166 339 -j, --json json mode, detailed in json format (never default)</code></pre>
167   -<p><strong>New in v0.54:</strong> the -p option can now be used to decrypt encrypted documents using the provided password(s).</p>
  340 +<p><strong>New in v0.54:</strong> the -p option can now be used to
  341 +decrypt encrypted documents using the provided password(s).</p>
168 342 <h3 id="examples">Examples</h3>
169 343 <p>Scan a single file:</p>
170 344 <pre class="text"><code>olevba file.doc</code></pre>
171   -<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
  345 +<p>Scan a single file, stored in a Zip archive with password
  346 +“infected”:</p>
172 347 <pre class="text"><code>olevba malicious_file.xls.zip -z infected</code></pre>
173 348 <p>Scan a single file, showing all obfuscated strings decoded:</p>
174 349 <pre class="text"><code>olevba file.doc --decode</code></pre>
175   -<p>Scan a single file, showing the macro source code with VBA strings deobfuscated:</p>
  350 +<p>Scan a single file, showing the macro source code with VBA strings
  351 +deobfuscated:</p>
176 352 <pre class="text"><code>olevba file.doc --reveal</code></pre>
177 353 <p>Scan VBA source code extracted into a text file:</p>
178 354 <pre class="text"><code>olevba source_code.vba</code></pre>
179 355 <p>Scan a collection of files stored in a folder:</p>
180 356 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*&quot;</code></pre>
181   -<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add double quotes around wildcards. Otherwise, they will be expanded by the shell instead of olevba.</p>
  357 +<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add
  358 +double quotes around wildcards. Otherwise, they will be expanded by the
  359 +shell instead of olevba.</p>
182 360 <p>Scan all .doc and .xls files, recursively in all subfolders:</p>
183 361 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.doc&quot; &quot;MalwareZoo/VBA/*.xls&quot; -r</code></pre>
184   -<p>Scan all .doc files within all .zip files with password, recursively:</p>
  362 +<p>Scan all .doc files within all .zip files with password,
  363 +recursively:</p>
185 364 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.zip&quot; -r -z infected -f &quot;*.doc&quot;</code></pre>
186   -<h3 id="detailed-analysis-mode-default-for-single-file">Detailed analysis mode (default for single file)</h3>
187   -<p>When a single file is scanned, or when using the option -d, all details of the analysis are displayed.</p>
188   -<p>For example, checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  365 +<h3 id="detailed-analysis-mode-default-for-single-file">Detailed
  366 +analysis mode (default for single file)</h3>
  367 +<p>When a single file is scanned, or when using the option -d, all
  368 +details of the analysis are displayed.</p>
  369 +<p>For example, checking the malware sample <a
  370 +href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
189 371 <pre class="text"><code>&gt;olevba c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected
190 372 ===============================================================================
191 373 FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip
... ... @@ -237,23 +419,32 @@ ANALYSIS:
237 419 | IOC | test.exe | Executable file name |
238 420 | IOC | sfjozjero.exe | Executable file name |
239 421 +------------+----------------------+-----------------------------------------+</code></pre>
240   -<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for multiple files)</h3>
241   -<p>When several files are scanned, or when using the option -t, a summary of the analysis for each file is displayed. This is more convenient for quick triage of a collection of suspicious files.</p>
  422 +<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for
  423 +multiple files)</h3>
  424 +<p>When several files are scanned, or when using the option -t, a
  425 +summary of the analysis for each file is displayed. This is more
  426 +convenient for quick triage of a collection of suspicious files.</p>
242 427 <p>The following flags show the results of the analysis:</p>
243 428 <ul>
244   -<li><strong>OLE</strong>: the file type is OLE, for example MS Office 97-2003</li>
245   -<li><strong>OpX</strong>: the file type is OpenXML, for example MS Office 2007+</li>
  429 +<li><strong>OLE</strong>: the file type is OLE, for example MS Office
  430 +97-2003</li>
  431 +<li><strong>OpX</strong>: the file type is OpenXML, for example MS
  432 +Office 2007+</li>
246 433 <li><strong>XML</strong>: the file type is Word 2003 XML</li>
247   -<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File Web Page (.mht)</li>
  434 +<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File
  435 +Web Page (.mht)</li>
248 436 <li><strong>?</strong>: the file type is not supported</li>
249 437 <li><strong>M</strong>: contains VBA Macros</li>
250 438 <li><strong>A</strong>: auto-executable macros</li>
251 439 <li><strong>S</strong>: suspicious VBA keywords</li>
252 440 <li><strong>I</strong>: potential IOCs</li>
253 441 <li><strong>H</strong>: hex-encoded strings (potential obfuscation)</li>
254   -<li><strong>B</strong>: Base64-encoded strings (potential obfuscation)</li>
255   -<li><strong>D</strong>: Dridex-encoded strings (potential obfuscation)</li>
256   -<li><strong>V</strong>: VBA string expressions (potential obfuscation)</li>
  442 +<li><strong>B</strong>: Base64-encoded strings (potential
  443 +obfuscation)</li>
  444 +<li><strong>D</strong>: Dridex-encoded strings (potential
  445 +obfuscation)</li>
  446 +<li><strong>V</strong>: VBA string expressions (potential
  447 +obfuscation)</li>
257 448 </ul>
258 449 <p>Here is an example:</p>
259 450 <pre class="text"><code>c:\&gt;olevba \MalwareZoo\VBA\samples\*
... ... @@ -276,146 +467,253 @@ OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware
276 467 OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware
277 468 OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre>
278 469 <h2 id="python-3-support---olevba3">Python 3 support - olevba3</h2>
279   -<p>Since v0.54, olevba is fully compatible with both Python 2 and 3. There is no need to use olevba3 anymore, however it is still present for backward compatibility.</p>
  470 +<p>Since v0.54, olevba is fully compatible with both Python 2 and 3.
  471 +There is no need to use olevba3 anymore, however it is still present for
  472 +backward compatibility.</p>
280 473 <hr />
281   -<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2>
282   -<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code from your own python applications.</p>
283   -<p>IMPORTANT: olevba is currently under active development, therefore this API is likely to change.</p>
  474 +<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in
  475 +Python applications</h2>
  476 +<p>olevba may be used to open a MS Office file, detect if it contains
  477 +VBA macros, extract and analyze the VBA source code from your own python
  478 +applications.</p>
  479 +<p>IMPORTANT: olevba is currently under active development, therefore
  480 +this API is likely to change.</p>
284 481 <h3 id="import-olevba">Import olevba</h3>
285   -<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser and VBA_Scanner classes:</p>
286   -<div class="sourceCode" id="cb12"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb12-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</a></code></pre></div>
287   -<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file - VBA_Parser</h3>
288   -<p>To parse a file on disk, create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter. For example:</p>
289   -<div class="sourceCode" id="cb13"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb13-1" data-line-number="1">vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</a></code></pre></div>
290   -<p>The file may also be provided as a bytes string containing its data. In that case, the actual filename must be provided for reference, and the file content with the data parameter. For example:</p>
291   -<div class="sourceCode" id="cb14"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb14-1" data-line-number="1">myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></a>
292   -<a class="sourceLine" id="cb14-2" data-line-number="2">filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</a>
293   -<a class="sourceLine" id="cb14-3" data-line-number="3">vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</a></code></pre></div>
294   -<p>VBA_Parser will raise an exception if the file is not a supported format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+), MHTML or Word 2003 XML.</p>
295   -<p>After parsing the file, the attribute <strong>VBA_Parser.type</strong> is a string indicating the file type. It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or TYPE_MHTML. (constants defined in the olevba module)</p>
  482 +<p>First, import the <strong>oletools.olevba</strong> package, using at
  483 +least the VBA_Parser and VBA_Scanner classes:</p>
  484 +<div class="sourceCode" id="cb12"><pre
  485 +class="sourceCode python"><code class="sourceCode python"><span id="cb12-1"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</span></code></pre></div>
  486 +<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file -
  487 +VBA_Parser</h3>
  488 +<p>To parse a file on disk, create an instance of the
  489 +<strong>VBA_Parser</strong> class, providing the name of the file to
  490 +open as parameter. For example:</p>
  491 +<div class="sourceCode" id="cb13"><pre
  492 +class="sourceCode python"><code class="sourceCode python"><span id="cb13-1"><a href="#cb13-1" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</span></code></pre></div>
  493 +<p>The file may also be provided as a bytes string containing its data.
  494 +In that case, the actual filename must be provided for reference, and
  495 +the file content with the data parameter. For example:</p>
  496 +<div class="sourceCode" id="cb14"><pre
  497 +class="sourceCode python"><code class="sourceCode python"><span id="cb14-1"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a>myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></span>
  498 +<span id="cb14-2"><a href="#cb14-2" aria-hidden="true" tabindex="-1"></a>filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</span>
  499 +<span id="cb14-3"><a href="#cb14-3" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</span></code></pre></div>
  500 +<p>VBA_Parser will raise an exception if the file is not a supported
  501 +format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+),
  502 +MHTML or Word 2003 XML.</p>
  503 +<p>After parsing the file, the attribute
  504 +<strong>VBA_Parser.type</strong> is a string indicating the file type.
  505 +It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or
  506 +TYPE_MHTML. (constants defined in the olevba module)</p>
296 507 <h3 id="detect-vba-macros">Detect VBA macros</h3>
297   -<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object returns True if VBA macros have been found in the file, False otherwise.</p>
298   -<div class="sourceCode" id="cb15"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb15-1" data-line-number="1"><span class="cf">if</span> vbaparser.detect_vba_macros():</a>
299   -<a class="sourceLine" id="cb15-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></a>
300   -<a class="sourceLine" id="cb15-3" data-line-number="3"><span class="cf">else</span>:</a>
301   -<a class="sourceLine" id="cb15-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></a></code></pre></div>
302   -<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will always return False because VBA Macros are stored in a different way which is not yet supported by olevba.</p>
303   -<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method may return True if the embedded document contains VBA Macros, even if the main document does not.</p>
304   -<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3>
305   -<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) for each VBA macro found.</p>
  508 +<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object
  509 +returns True if VBA macros have been found in the file, False
  510 +otherwise.</p>
  511 +<div class="sourceCode" id="cb15"><pre
  512 +class="sourceCode python"><code class="sourceCode python"><span id="cb15-1"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> vbaparser.detect_vba_macros():</span>
  513 +<span id="cb15-2"><a href="#cb15-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></span>
  514 +<span id="cb15-3"><a href="#cb15-3" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
  515 +<span id="cb15-4"><a href="#cb15-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></span></code></pre></div>
  516 +<p>Note: The detection algorithm looks for streams and storage with
  517 +specific names in the OLE structure, which works fine for all the
  518 +supported formats listed above. However, for some formats such as
  519 +PowerPoint 97-2003, this method will always return False because VBA
  520 +Macros are stored in a different way which is not yet supported by
  521 +olevba.</p>
  522 +<p>Moreover, if the file contains an embedded document (e.g. an Excel
  523 +workbook inserted into a Word document), this method may return True if
  524 +the embedded document contains VBA Macros, even if the main document
  525 +does not.</p>
  526 +<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source
  527 +Code</h3>
  528 +<p>The method <strong>extract_macros</strong> extracts and decompresses
  529 +source code for each VBA macro found in the file (possibly including
  530 +embedded files). It is a generator yielding a tuple (filename,
  531 +stream_path, vba_filename, vba_code) for each VBA macro found.</p>
306 532 <ul>
307   -<li>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin.</li>
308   -<li>stream_path: path of the OLE stream containing the VBA macro source code</li>
  533 +<li>filename: If the file is OLE (MS Office 97-2003), filename is the
  534 +path of the file. If the file is OpenXML (MS Office 2007+), filename is
  535 +the path of the OLE subfile containing VBA macros within the zip
  536 +archive, e.g. word/vbaProject.bin.</li>
  537 +<li>stream_path: path of the OLE stream containing the VBA macro source
  538 +code</li>
309 539 <li>vba_filename: corresponding VBA filename</li>
310 540 <li>vba_code: string containing the VBA source code in clear text</li>
311 541 </ul>
312 542 <p>Example:</p>
313   -<div class="sourceCode" id="cb16"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb16-1" data-line-number="1"><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</a>
314   -<a class="sourceLine" id="cb16-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></a>
315   -<a class="sourceLine" id="cb16-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</a>
316   -<a class="sourceLine" id="cb16-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</a>
317   -<a class="sourceLine" id="cb16-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</a>
318   -<a class="sourceLine" id="cb16-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></a>
319   -<a class="sourceLine" id="cb16-7" data-line-number="7"> <span class="bu">print</span> vba_code</a></code></pre></div>
320   -<p>Alternatively, the VBA_Parser method <strong>extract_all_macros</strong> returns the same results as a list of tuples.</p>
  543 +<div class="sourceCode" id="cb16"><pre
  544 +class="sourceCode python"><code class="sourceCode python"><span id="cb16-1"><a href="#cb16-1" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</span>
  545 +<span id="cb16-2"><a href="#cb16-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></span>
  546 +<span id="cb16-3"><a href="#cb16-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</span>
  547 +<span id="cb16-4"><a href="#cb16-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</span>
  548 +<span id="cb16-5"><a href="#cb16-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</span>
  549 +<span id="cb16-6"><a href="#cb16-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></span>
  550 +<span id="cb16-7"><a href="#cb16-7" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> vba_code</span></code></pre></div>
  551 +<p>Alternatively, the VBA_Parser method
  552 +<strong>extract_all_macros</strong> returns the same results as a list
  553 +of tuples.</p>
321 554 <h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3>
322   -<p>Since version 0.40, the VBA_Parser class provides simpler methods than VBA_Scanner to analyze all macros contained in a file:</p>
323   -<p>The method <strong>analyze_macros</strong> from the class <strong>VBA_Parser</strong> can be used to scan the source code of all VBA modules to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
324   -<p>analyze_macros() takes an optional argument show_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value. By default, it will only include the strings which contain printable characters.</p>
325   -<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
  555 +<p>Since version 0.40, the VBA_Parser class provides simpler methods
  556 +than VBA_Scanner to analyze all macros contained in a file:</p>
  557 +<p>The method <strong>analyze_macros</strong> from the class
  558 +<strong>VBA_Parser</strong> can be used to scan the source code of all
  559 +VBA modules to find obfuscated strings, suspicious keywords, IOCs,
  560 +auto-executable macros, etc.</p>
  561 +<p>analyze_macros() takes an optional argument show_decoded_strings: if
  562 +set to True, the results will contain all the encoded strings found in
  563 +the code (Hex, Base64, Dridex) with their decoded value. By default, it
  564 +will only include the strings which contain printable characters.</p>
  565 +<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples
  566 +(type, keyword, description), one for each item in the results.</p>
326 567 <ul>
327   -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>
328   -<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
329   -<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
  568 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,
  569 +‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>
  570 +<li>keyword is the string found for auto-executable macros, suspicious
  571 +keywords or IOCs. For obfuscated strings, it is the decoded value of the
  572 +string.</li>
  573 +<li>description provides a description of the keyword. For obfuscated
  574 +strings, it is the encoded value of the string.</li>
330 575 </ul>
331 576 <p>Example:</p>
332   -<div class="sourceCode" id="cb17"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb17-1" data-line-number="1">results <span class="op">=</span> vbaparser.analyze_macros()</a>
333   -<a class="sourceLine" id="cb17-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
334   -<a class="sourceLine" id="cb17-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
335   -<p>After calling analyze_macros, the following VBA_Parser attributes also provide the number of items found for each category:</p>
336   -<div class="sourceCode" id="cb18"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb18-1" data-line-number="1"><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</a>
337   -<a class="sourceLine" id="cb18-2" data-line-number="2"><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</a>
338   -<a class="sourceLine" id="cb18-3" data-line-number="3"><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</a>
339   -<a class="sourceLine" id="cb18-4" data-line-number="4"><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</a>
340   -<a class="sourceLine" id="cb18-5" data-line-number="5"><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</a>
341   -<a class="sourceLine" id="cb18-6" data-line-number="6"><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</a>
342   -<a class="sourceLine" id="cb18-7" data-line-number="7"><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</a></code></pre></div>
343   -<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source Code</h3>
344   -<p>The method <strong>reveal</strong> attempts to deobfuscate the macro source code by replacing all the obfuscated strings by their decoded content. Returns a single string.</p>
  577 +<div class="sourceCode" id="cb17"><pre
  578 +class="sourceCode python"><code class="sourceCode python"><span id="cb17-1"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vbaparser.analyze_macros()</span>
  579 +<span id="cb17-2"><a href="#cb17-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
  580 +<span id="cb17-3"><a href="#cb17-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
  581 +<p>After calling analyze_macros, the following VBA_Parser attributes
  582 +also provide the number of items found for each category:</p>
  583 +<div class="sourceCode" id="cb18"><pre
  584 +class="sourceCode python"><code class="sourceCode python"><span id="cb18-1"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</span>
  585 +<span id="cb18-2"><a href="#cb18-2" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</span>
  586 +<span id="cb18-3"><a href="#cb18-3" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</span>
  587 +<span id="cb18-4"><a href="#cb18-4" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</span>
  588 +<span id="cb18-5"><a href="#cb18-5" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</span>
  589 +<span id="cb18-6"><a href="#cb18-6" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</span>
  590 +<span id="cb18-7"><a href="#cb18-7" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</span></code></pre></div>
  591 +<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source
  592 +Code</h3>
  593 +<p>The method <strong>reveal</strong> attempts to deobfuscate the macro
  594 +source code by replacing all the obfuscated strings by their decoded
  595 +content. Returns a single string.</p>
345 596 <p>Example:</p>
346   -<div class="sourceCode" id="cb19"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb19-1" data-line-number="1"><span class="bu">print</span> vbaparser.reveal()</a></code></pre></div>
  597 +<div class="sourceCode" id="cb19"><pre
  598 +class="sourceCode python"><code class="sourceCode python"><span id="cb19-1"><a href="#cb19-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> vbaparser.reveal()</span></code></pre></div>
347 599 <h3 id="close-the-vba_parser">Close the VBA_Parser</h3>
348   -<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed, especially if your application is parsing many files.</p>
349   -<div class="sourceCode" id="cb20"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb20-1" data-line-number="1">vbaparser.close()</a></code></pre></div>
  600 +<p>After usage, it is better to call the <strong>close</strong> method
  601 +of the VBA_Parser object, to make sure the file is closed, especially if
  602 +your application is parsing many files.</p>
  603 +<div class="sourceCode" id="cb20"><pre
  604 +class="sourceCode python"><code class="sourceCode python"><span id="cb20-1"><a href="#cb20-1" aria-hidden="true" tabindex="-1"></a>vbaparser.close()</span></code></pre></div>
350 605 <hr />
351 606 <h2 id="deprecated-api">Deprecated API</h2>
352   -<p>The following methods and functions are still functional, but their usage is not recommended since they have been replaced by better solutions.</p>
  607 +<p>The following methods and functions are still functional, but their
  608 +usage is not recommended since they have been replaced by better
  609 +solutions.</p>
353 610 <h3 id="vba_scanner-deprecated">VBA_Scanner (deprecated)</h3>
354   -<p>The class <strong>VBA_Scanner</strong> can be used to scan the source code of a VBA module to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
355   -<p>First, create a VBA_Scanner object with a string containing the VBA source code (for example returned by the extract_macros method). Then call the methods <strong>scan</strong> or <strong>scan_summary</strong> to get the results of the analysis.</p>
356   -<p>scan() takes an optional argument include_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value.</p>
357   -<p><strong>scan</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
  611 +<p>The class <strong>VBA_Scanner</strong> can be used to scan the source
  612 +code of a VBA module to find obfuscated strings, suspicious keywords,
  613 +IOCs, auto-executable macros, etc.</p>
  614 +<p>First, create a VBA_Scanner object with a string containing the VBA
  615 +source code (for example returned by the extract_macros method). Then
  616 +call the methods <strong>scan</strong> or <strong>scan_summary</strong>
  617 +to get the results of the analysis.</p>
  618 +<p>scan() takes an optional argument include_decoded_strings: if set to
  619 +True, the results will contain all the encoded strings found in the code
  620 +(Hex, Base64, Dridex) with their decoded value.</p>
  621 +<p><strong>scan</strong> returns a list of tuples (type, keyword,
  622 +description), one for each item in the results.</p>
358 623 <ul>
359   -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’ or ‘Dridex String’.</li>
360   -<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
361   -<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
  624 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,
  625 +‘Base64 String’ or ‘Dridex String’.</li>
  626 +<li>keyword is the string found for auto-executable macros, suspicious
  627 +keywords or IOCs. For obfuscated strings, it is the decoded value of the
  628 +string.</li>
  629 +<li>description provides a description of the keyword. For obfuscated
  630 +strings, it is the encoded value of the string.</li>
362 631 </ul>
363 632 <p>Example:</p>
364   -<div class="sourceCode" id="cb21"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb21-1" data-line-number="1">vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</a>
365   -<a class="sourceLine" id="cb21-2" data-line-number="2">results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
366   -<a class="sourceLine" id="cb21-3" data-line-number="3"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
367   -<a class="sourceLine" id="cb21-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
368   -<p>The function <strong>scan_vba</strong> is a shortcut for VBA_Scanner(vba_code).scan():</p>
369   -<div class="sourceCode" id="cb22"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb22-1" data-line-number="1">results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
370   -<a class="sourceLine" id="cb22-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
371   -<a class="sourceLine" id="cb22-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
372   -<p><strong>scan_summary</strong> returns a tuple with the number of items found for each category: (autoexec, suspicious, IOCs, hex, base64, dridex).</p>
373   -<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable macros (deprecated)</h3>
374   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
375   -<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names that will be triggered when the document/workbook is opened, closed, changed, etc.</p>
376   -<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the trigger. (See the malware example above)</p>
  633 +<div class="sourceCode" id="cb21"><pre
  634 +class="sourceCode python"><code class="sourceCode python"><span id="cb21-1"><a href="#cb21-1" aria-hidden="true" tabindex="-1"></a>vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</span>
  635 +<span id="cb21-2"><a href="#cb21-2" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>
  636 +<span id="cb21-3"><a href="#cb21-3" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
  637 +<span id="cb21-4"><a href="#cb21-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
  638 +<p>The function <strong>scan_vba</strong> is a shortcut for
  639 +VBA_Scanner(vba_code).scan():</p>
  640 +<div class="sourceCode" id="cb22"><pre
  641 +class="sourceCode python"><code class="sourceCode python"><span id="cb22-1"><a href="#cb22-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>
  642 +<span id="cb22-2"><a href="#cb22-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
  643 +<span id="cb22-3"><a href="#cb22-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
  644 +<p><strong>scan_summary</strong> returns a tuple with the number of
  645 +items found for each category: (autoexec, suspicious, IOCs, hex, base64,
  646 +dridex).</p>
  647 +<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable
  648 +macros (deprecated)</h3>
  649 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
  650 +or VBA_Scanner to get all results at once.</p>
  651 +<p>The function <strong>detect_autoexec</strong> checks if VBA macro
  652 +code contains specific macro names that will be triggered when the
  653 +document/workbook is opened, closed, changed, etc.</p>
  654 +<p>It returns a list of tuples containing two strings, the detected
  655 +keyword, and the description of the trigger. (See the malware example
  656 +above)</p>
377 657 <p>Sample usage:</p>
378   -<div class="sourceCode" id="cb23"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb23-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</a>
379   -<a class="sourceLine" id="cb23-2" data-line-number="2">autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</a>
380   -<a class="sourceLine" id="cb23-3" data-line-number="3"><span class="cf">if</span> autoexec_keywords:</a>
381   -<a class="sourceLine" id="cb23-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></a>
382   -<a class="sourceLine" id="cb23-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</a>
383   -<a class="sourceLine" id="cb23-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
384   -<a class="sourceLine" id="cb23-7" data-line-number="7"><span class="cf">else</span>:</a>
385   -<a class="sourceLine" id="cb23-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></a></code></pre></div>
386   -<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA keywords (deprecated)</h3>
387   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
388   -<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific keywords often used by malware to act on the system (create files, run commands or applications, write to the registry, etc).</p>
389   -<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the corresponding malicious behaviour. (See the malware example above)</p>
  658 +<div class="sourceCode" id="cb23"><pre
  659 +class="sourceCode python"><code class="sourceCode python"><span id="cb23-1"><a href="#cb23-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</span>
  660 +<span id="cb23-2"><a href="#cb23-2" aria-hidden="true" tabindex="-1"></a>autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</span>
  661 +<span id="cb23-3"><a href="#cb23-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> autoexec_keywords:</span>
  662 +<span id="cb23-4"><a href="#cb23-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></span>
  663 +<span id="cb23-5"><a href="#cb23-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</span>
  664 +<span id="cb23-6"><a href="#cb23-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>
  665 +<span id="cb23-7"><a href="#cb23-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
  666 +<span id="cb23-8"><a href="#cb23-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></span></code></pre></div>
  667 +<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA
  668 +keywords (deprecated)</h3>
  669 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
  670 +or VBA_Scanner to get all results at once.</p>
  671 +<p>The function <strong>detect_suspicious</strong> checks if VBA macro
  672 +code contains specific keywords often used by malware to act on the
  673 +system (create files, run commands or applications, write to the
  674 +registry, etc).</p>
  675 +<p>It returns a list of tuples containing two strings, the detected
  676 +keyword, and the description of the corresponding malicious behaviour.
  677 +(See the malware example above)</p>
390 678 <p>Sample usage:</p>
391   -<div class="sourceCode" id="cb24"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb24-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</a>
392   -<a class="sourceLine" id="cb24-2" data-line-number="2">suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</a>
393   -<a class="sourceLine" id="cb24-3" data-line-number="3"><span class="cf">if</span> suspicious_keywords:</a>
394   -<a class="sourceLine" id="cb24-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></a>
395   -<a class="sourceLine" id="cb24-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</a>
396   -<a class="sourceLine" id="cb24-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
397   -<a class="sourceLine" id="cb24-7" data-line-number="7"><span class="cf">else</span>:</a>
398   -<a class="sourceLine" id="cb24-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></a></code></pre></div>
399   -<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs (deprecated)</h3>
400   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
401   -<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific patterns of interest, that may be useful for malware analysis and detection (potential Indicators of Compromise): IP addresses, e-mail addresses, URLs, executable file names.</p>
402   -<p>It returns a list of tuples containing two strings, the pattern type, and the extracted value. (See the malware example above)</p>
  679 +<div class="sourceCode" id="cb24"><pre
  680 +class="sourceCode python"><code class="sourceCode python"><span id="cb24-1"><a href="#cb24-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</span>
  681 +<span id="cb24-2"><a href="#cb24-2" aria-hidden="true" tabindex="-1"></a>suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</span>
  682 +<span id="cb24-3"><a href="#cb24-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> suspicious_keywords:</span>
  683 +<span id="cb24-4"><a href="#cb24-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></span>
  684 +<span id="cb24-5"><a href="#cb24-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</span>
  685 +<span id="cb24-6"><a href="#cb24-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>
  686 +<span id="cb24-7"><a href="#cb24-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
  687 +<span id="cb24-8"><a href="#cb24-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></span></code></pre></div>
  688 +<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs
  689 +(deprecated)</h3>
  690 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
  691 +or VBA_Scanner to get all results at once.</p>
  692 +<p>The function <strong>detect_patterns</strong> checks if VBA macro
  693 +code contains specific patterns of interest, that may be useful for
  694 +malware analysis and detection (potential Indicators of Compromise): IP
  695 +addresses, e-mail addresses, URLs, executable file names.</p>
  696 +<p>It returns a list of tuples containing two strings, the pattern type,
  697 +and the extracted value. (See the malware example above)</p>
403 698 <p>Sample usage:</p>
404   -<div class="sourceCode" id="cb25"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb25-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</a>
405   -<a class="sourceLine" id="cb25-2" data-line-number="2">patterns <span class="op">=</span> detect_patterns(vba_code)</a>
406   -<a class="sourceLine" id="cb25-3" data-line-number="3"><span class="cf">if</span> patterns:</a>
407   -<a class="sourceLine" id="cb25-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></a>
408   -<a class="sourceLine" id="cb25-5" data-line-number="5"> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</a>
409   -<a class="sourceLine" id="cb25-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</a>
410   -<a class="sourceLine" id="cb25-7" data-line-number="7"><span class="cf">else</span>:</a>
411   -<a class="sourceLine" id="cb25-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></a></code></pre></div>
  699 +<div class="sourceCode" id="cb25"><pre
  700 +class="sourceCode python"><code class="sourceCode python"><span id="cb25-1"><a href="#cb25-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</span>
  701 +<span id="cb25-2"><a href="#cb25-2" aria-hidden="true" tabindex="-1"></a>patterns <span class="op">=</span> detect_patterns(vba_code)</span>
  702 +<span id="cb25-3"><a href="#cb25-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> patterns:</span>
  703 +<span id="cb25-4"><a href="#cb25-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></span>
  704 +<span id="cb25-5"><a href="#cb25-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</span>
  705 +<span id="cb25-6"><a href="#cb25-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</span>
  706 +<span id="cb25-7"><a href="#cb25-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
  707 +<span id="cb25-8"><a href="#cb25-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></span></code></pre></div>
412 708 <hr />
413   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  709 +<h2 id="python-oletools-documentation">python-oletools
  710 +documentation</h2>
414 711 <ul>
415 712 <li><a href="Home.html">Home</a></li>
416 713 <li><a href="License.html">License</a></li>
417 714 <li><a href="Install.html">Install</a></li>
418   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  715 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  716 +Report Issues</li>
419 717 <li>Tools:
420 718 <ul>
421 719 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/pyxswf.html
  View file @82b53b3
... ... @@ -4,25 +4,177 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 156 </style>
14   - <!--[if lt IE 9]>
15   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
16   - <![endif]-->
17 157 </head>
18 158 <body>
19 159 <h1 id="pyxswf">pyxswf</h1>
20   -<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may be embedded in files such as MS Office documents (e.g. Word, Excel), which is especially useful for malware analysis.</p>
21   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
22   -<p>pyxswf is an extension to <a href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a> published by Alexander Hanel.</p>
23   -<p>Compared to xxxswf, it can extract streams from MS Office documents by parsing their OLE structure properly, which is necessary when streams are fragmented. Stream fragmentation is a known obfuscation technique, as explained on <a href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
24   -<p>It can also extract Flash objects from RTF documents, by parsing embedded objects encoded in hexadecimal format (-f option).</p>
25   -<p>For this, simply add the -o option to work on OLE streams rather than raw files, or the -f option to work on RTF files.</p>
  160 +<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF
  161 +files) that may be embedded in files such as MS Office documents
  162 +(e.g. Word, Excel), which is especially useful for malware analysis.</p>
  163 +<p>It is part of the <a
  164 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  165 +package.</p>
  166 +<p>pyxswf is an extension to <a
  167 +href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a>
  168 +published by Alexander Hanel.</p>
  169 +<p>Compared to xxxswf, it can extract streams from MS Office documents
  170 +by parsing their OLE structure properly, which is necessary when streams
  171 +are fragmented. Stream fragmentation is a known obfuscation technique,
  172 +as explained on <a
  173 +href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
  174 +<p>It can also extract Flash objects from RTF documents, by parsing
  175 +embedded objects encoded in hexadecimal format (-f option).</p>
  176 +<p>For this, simply add the -o option to work on OLE streams rather than
  177 +raw files, or the -f option to work on RTF files.</p>
26 178 <h2 id="usage">Usage</h2>
27 179 <pre class="text"><code>Usage: pyxswf [options] &lt;file.bad&gt;
28 180  
... ... @@ -45,7 +197,10 @@ Options:
45 197 Will recursively scan a directory for files that
46 198 contain SWFs. Must provide path in quotes
47 199 -c, --compress Compresses the SWF using Zlib</code></pre>
48   -<h3 id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example 1 - detecting and extracting a SWF file from a Word document on Windows:</h3>
  200 +<h3
  201 +id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example
  202 +1 - detecting and extracting a SWF file from a Word document on
  203 +Windows:</h3>
49 204 <pre class="text"><code>C:\oletools&gt;pyxswf -o word_flash.doc
50 205 OLE stream: &#39;Contents&#39;
51 206 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
... ... @@ -56,22 +211,28 @@ OLE stream: &amp;#39;Contents&amp;#39;
56 211 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
57 212 [ADDR] SWF 1 at 0x8 - FWS Header
58 213 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
59   -<h3 id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example 2 - detecting and extracting a SWF file from a RTF document on Windows:</h3>
  214 +<h3
  215 +id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example
  216 +2 - detecting and extracting a SWF file from a RTF document on
  217 +Windows:</h3>
60 218 <pre class="text"><code>C:\oletools&gt;pyxswf -xf &quot;rtf_flash.rtf&quot;
61 219 RTF embedded object size 1498557 at index 000036DD
62 220 [SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0
63 221 00036DD
64 222 [ADDR] SWF 1 at 0xc40 - FWS Header
65 223 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
66   -<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in Python applications</h2>
  224 +<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in
  225 +Python applications</h2>
67 226 <p>TODO</p>
68 227 <hr />
69   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  228 +<h2 id="python-oletools-documentation">python-oletools
  229 +documentation</h2>
70 230 <ul>
71 231 <li><a href="Home.html">Home</a></li>
72 232 <li><a href="License.html">License</a></li>
73 233 <li><a href="Install.html">Install</a></li>
74   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  234 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  235 +Report Issues</li>
75 236 <li>Tools:
76 237 <ul>
77 238 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/rtfobj.html
  View file @82b53b3
... ... @@ -4,88 +4,234 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>Untitled</title>
8   - <style type="text/css">
9   - code{white-space: pre-wrap;}
10   - span.smallcaps{font-variant: small-caps;}
11   - span.underline{text-decoration: underline;}
12   - div.column{display: inline-block; vertical-align: top; width: 50%;}
  7 + <title>-</title>
  8 + <style>
  9 + html {
  10 + line-height: 1.5;
  11 + font-family: Georgia, serif;
  12 + font-size: 20px;
  13 + color: #1a1a1a;
  14 + background-color: #fdfdfd;
  15 + }
  16 + body {
  17 + margin: 0 auto;
  18 + max-width: 36em;
  19 + padding-left: 50px;
  20 + padding-right: 50px;
  21 + padding-top: 50px;
  22 + padding-bottom: 50px;
  23 + hyphens: auto;
  24 + overflow-wrap: break-word;
  25 + text-rendering: optimizeLegibility;
  26 + font-kerning: normal;
  27 + }
  28 + @media (max-width: 600px) {
  29 + body {
  30 + font-size: 0.9em;
  31 + padding: 1em;
  32 + }
  33 + h1 {
  34 + font-size: 1.8em;
  35 + }
  36 + }
  37 + @media print {
  38 + body {
  39 + background-color: transparent;
  40 + color: black;
  41 + font-size: 12pt;
  42 + }
  43 + p, h2, h3 {
  44 + orphans: 3;
  45 + widows: 3;
  46 + }
  47 + h2, h3, h4 {
  48 + page-break-after: avoid;
  49 + }
  50 + }
  51 + p {
  52 + margin: 1em 0;
  53 + }
  54 + a {
  55 + color: #1a1a1a;
  56 + }
  57 + a:visited {
  58 + color: #1a1a1a;
  59 + }
  60 + img {
  61 + max-width: 100%;
  62 + }
  63 + h1, h2, h3, h4, h5, h6 {
  64 + margin-top: 1.4em;
  65 + }
  66 + h5, h6 {
  67 + font-size: 1em;
  68 + font-style: italic;
  69 + }
  70 + h6 {
  71 + font-weight: normal;
  72 + }
  73 + ol, ul {
  74 + padding-left: 1.7em;
  75 + margin-top: 1em;
  76 + }
  77 + li > ol, li > ul {
  78 + margin-top: 0;
  79 + }
  80 + blockquote {
  81 + margin: 1em 0 1em 1.7em;
  82 + padding-left: 1em;
  83 + border-left: 2px solid #e6e6e6;
  84 + color: #606060;
  85 + }
  86 + code {
  87 + font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
  88 + font-size: 85%;
  89 + margin: 0;
  90 + }
  91 + pre {
  92 + margin: 1em 0;
  93 + overflow: auto;
  94 + }
  95 + pre code {
  96 + padding: 0;
  97 + overflow: visible;
  98 + overflow-wrap: normal;
  99 + }
  100 + .sourceCode {
  101 + background-color: transparent;
  102 + overflow: visible;
  103 + }
  104 + hr {
  105 + background-color: #1a1a1a;
  106 + border: none;
  107 + height: 1px;
  108 + margin: 1em 0;
  109 + }
  110 + table {
  111 + margin: 1em 0;
  112 + border-collapse: collapse;
  113 + width: 100%;
  114 + overflow-x: auto;
  115 + display: block;
  116 + font-variant-numeric: lining-nums tabular-nums;
  117 + }
  118 + table caption {
  119 + margin-bottom: 0.75em;
  120 + }
  121 + tbody {
  122 + margin-top: 0.5em;
  123 + border-top: 1px solid #1a1a1a;
  124 + border-bottom: 1px solid #1a1a1a;
  125 + }
  126 + th {
  127 + border-top: 1px solid #1a1a1a;
  128 + padding: 0.25em 0.5em 0.25em 0.5em;
  129 + }
  130 + td {
  131 + padding: 0.125em 0.5em 0.25em 0.5em;
  132 + }
  133 + header {
  134 + margin-bottom: 4em;
  135 + text-align: center;
  136 + }
  137 + #TOC li {
  138 + list-style: none;
  139 + }
  140 + #TOC ul {
  141 + padding-left: 1.3em;
  142 + }
  143 + #TOC > ul {
  144 + padding-left: 0;
  145 + }
  146 + #TOC a:not(:hover) {
  147 + text-decoration: none;
  148 + }
  149 + code{white-space: pre-wrap;}
  150 + span.smallcaps{font-variant: small-caps;}
  151 + span.underline{text-decoration: underline;}
  152 + div.column{display: inline-block; vertical-align: top; width: 50%;}
  153 + div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
  154 + ul.task-list{list-style: none;}
  155 + pre > code.sourceCode { white-space: pre; position: relative; }
  156 + pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
  157 + pre > code.sourceCode > span:empty { height: 1.2em; }
  158 + .sourceCode { overflow: visible; }
  159 + code.sourceCode > span { color: inherit; text-decoration: inherit; }
  160 + div.sourceCode { margin: 1em 0; }
  161 + pre.sourceCode { margin: 0; }
  162 + @media screen {
  163 + div.sourceCode { overflow: auto; }
  164 + }
  165 + @media print {
  166 + pre > code.sourceCode { white-space: pre-wrap; }
  167 + pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
  168 + }
  169 + pre.numberSource code
  170 + { counter-reset: source-line 0; }
  171 + pre.numberSource code > span
  172 + { position: relative; left: -4em; counter-increment: source-line; }
  173 + pre.numberSource code > span > a:first-child::before
  174 + { content: counter(source-line);
  175 + position: relative; left: -1em; text-align: right; vertical-align: baseline;
  176 + border: none; display: inline-block;
  177 + -webkit-touch-callout: none; -webkit-user-select: none;
  178 + -khtml-user-select: none; -moz-user-select: none;
  179 + -ms-user-select: none; user-select: none;
  180 + padding: 0 4px; width: 4em;
  181 + color: #aaaaaa;
  182 + }
  183 + pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  184 + div.sourceCode
  185 + { }
  186 + @media screen {
  187 + pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
  188 + }
  189 + code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  190 + code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  191 + code span.at { color: #7d9029; } /* Attribute */
  192 + code span.bn { color: #40a070; } /* BaseN */
  193 + code span.bu { color: #008000; } /* BuiltIn */
  194 + code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  195 + code span.ch { color: #4070a0; } /* Char */
  196 + code span.cn { color: #880000; } /* Constant */
  197 + code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  198 + code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  199 + code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  200 + code span.dt { color: #902000; } /* DataType */
  201 + code span.dv { color: #40a070; } /* DecVal */
  202 + code span.er { color: #ff0000; font-weight: bold; } /* Error */
  203 + code span.ex { } /* Extension */
  204 + code span.fl { color: #40a070; } /* Float */
  205 + code span.fu { color: #06287e; } /* Function */
  206 + code span.im { color: #008000; font-weight: bold; } /* Import */
  207 + code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  208 + code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  209 + code span.op { color: #666666; } /* Operator */
  210 + code span.ot { color: #007020; } /* Other */
  211 + code span.pp { color: #bc7a00; } /* Preprocessor */
  212 + code span.sc { color: #4070a0; } /* SpecialChar */
  213 + code span.ss { color: #bb6688; } /* SpecialString */
  214 + code span.st { color: #4070a0; } /* String */
  215 + code span.va { color: #19177c; } /* Variable */
  216 + code span.vs { color: #4070a0; } /* VerbatimString */
  217 + code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  218 + .display.math{display: block; text-align: center; margin: 0.5rem auto;}
13 219 </style>
14   - <style type="text/css">
15   -a.sourceLine { display: inline-block; line-height: 1.25; }
16   -a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
17   -a.sourceLine:empty { height: 1.2em; position: absolute; }
18   -.sourceCode { overflow: visible; }
19   -code.sourceCode { white-space: pre; position: relative; }
20   -div.sourceCode { margin: 1em 0; }
21   -pre.sourceCode { margin: 0; }
22   -@media screen {
23   -div.sourceCode { overflow: auto; }
24   -}
25   -@media print {
26   -code.sourceCode { white-space: pre-wrap; }
27   -a.sourceLine { text-indent: -1em; padding-left: 1em; }
28   -}
29   -pre.numberSource a.sourceLine
30   - { position: relative; }
31   -pre.numberSource a.sourceLine:empty
32   - { position: absolute; }
33   -pre.numberSource a.sourceLine::before
34   - { content: attr(data-line-number);
35   - position: absolute; left: -5em; text-align: right; vertical-align: baseline;
36   - border: none; pointer-events: all;
37   - -webkit-touch-callout: none; -webkit-user-select: none;
38   - -khtml-user-select: none; -moz-user-select: none;
39   - -ms-user-select: none; user-select: none;
40   - padding: 0 4px; width: 4em;
41   - color: #aaaaaa;
42   - }
43   -pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
44   -div.sourceCode
45   - { }
46   -@media screen {
47   -a.sourceLine::before { text-decoration: underline; }
48   -}
49   -code span.al { color: #ff0000; font-weight: bold; } /* Alert */
50   -code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
51   -code span.at { color: #7d9029; } /* Attribute */
52   -code span.bn { color: #40a070; } /* BaseN */
53   -code span.bu { } /* BuiltIn */
54   -code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
55   -code span.ch { color: #4070a0; } /* Char */
56   -code span.cn { color: #880000; } /* Constant */
57   -code span.co { color: #60a0b0; font-style: italic; } /* Comment */
58   -code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
59   -code span.do { color: #ba2121; font-style: italic; } /* Documentation */
60   -code span.dt { color: #902000; } /* DataType */
61   -code span.dv { color: #40a070; } /* DecVal */
62   -code span.er { color: #ff0000; font-weight: bold; } /* Error */
63   -code span.ex { } /* Extension */
64   -code span.fl { color: #40a070; } /* Float */
65   -code span.fu { color: #06287e; } /* Function */
66   -code span.im { } /* Import */
67   -code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
68   -code span.kw { color: #007020; font-weight: bold; } /* Keyword */
69   -code span.op { color: #666666; } /* Operator */
70   -code span.ot { color: #007020; } /* Other */
71   -code span.pp { color: #bc7a00; } /* Preprocessor */
72   -code span.sc { color: #4070a0; } /* SpecialChar */
73   -code span.ss { color: #bb6688; } /* SpecialString */
74   -code span.st { color: #4070a0; } /* String */
75   -code span.va { color: #19177c; } /* Variable */
76   -code span.vs { color: #4070a0; } /* VerbatimString */
77   -code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
78   - </style>
79   - <!--[if lt IE 9]>
80   - <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
81   - <![endif]-->
82 220 </head>
83 221 <body>
84 222 <h1 id="rtfobj">rtfobj</h1>
85   -<p>rtfobj is a Python module to detect and extract embedded objects stored in RTF files, such as OLE objects. It can also detect OLE Package objects, and extract the embedded files.</p>
86   -<p>Since v0.50, rtfobj contains a custom RTF parser that has been designed to match MS Word’s behaviour, in order to handle obfuscated RTF files. See my article <a href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in Weaponized RTF”</a> for some concrete examples.</p>
  223 +<p>rtfobj is a Python module to detect and extract embedded objects
  224 +stored in RTF files, such as OLE objects. It can also detect OLE Package
  225 +objects, and extract the embedded files.</p>
  226 +<p>Since v0.50, rtfobj contains a custom RTF parser that has been
  227 +designed to match MS Word’s behaviour, in order to handle obfuscated RTF
  228 +files. See my article <a
  229 +href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in
  230 +Weaponized RTF”</a> for some concrete examples.</p>
87 231 <p>rtfobj can be used as a Python library or a command-line tool.</p>
88   -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  232 +<p>It is part of the <a
  233 +href="http://www.decalage.info/python/oletools">python-oletools</a>
  234 +package.</p>
89 235 <h2 id="usage">Usage</h2>
90 236 <pre class="text"><code>rtfobj [options] &lt;filename&gt; [filename2 ...]
91 237  
... ... @@ -107,28 +253,41 @@ Options:
107 253 to a file, for example &quot;-s 2&quot;. Use &quot;-s all&quot; to save
108 254 all objects at once.
109 255 -d OUTPUT_DIR use specified directory to save output files.</code></pre>
110   -<p>rtfobj displays a list of the OLE and Package objects that have been detected, with their attributes such as class and filename.</p>
111   -<p>When an OLE Package object contains an executable file or script, it is highlighted as such. For example:</p>
  256 +<p>rtfobj displays a list of the OLE and Package objects that have been
  257 +detected, with their attributes such as class and filename.</p>
  258 +<p>When an OLE Package object contains an executable file or script, it
  259 +is highlighted as such. For example:</p>
112 260 <p><img src="rtfobj1.png" /></p>
113   -<p>To extract an object or file, use the option -s followed by the object number as shown in the table.</p>
  261 +<p>To extract an object or file, use the option -s followed by the
  262 +object number as shown in the table.</p>
114 263 <p>Example:</p>
115 264 <pre class="text"><code>rtfobj -s 0</code></pre>
116   -<p>It extracts and decodes the corresponding object, and saves it as a file named “object_xxxx.bin”, xxxx being the location of the object in the RTF file.</p>
117   -<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in Python applications</h2>
118   -<p>As of v0.50, the API has changed significantly and it is not final yet. For now, see the class RtfObjectParser in the code.</p>
119   -<h3 id="deprecated-api-still-functional">Deprecated API (still functional):</h3>
120   -<p>rtf_iter_objects(filename) is an iterator which yields a tuple (index, orig_len, object) providing the index of each hexadecimal stream in the RTF file, and the corresponding decoded object.</p>
  265 +<p>It extracts and decodes the corresponding object, and saves it as a
  266 +file named “object_xxxx.bin”, xxxx being the location of the object in
  267 +the RTF file.</p>
  268 +<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in
  269 +Python applications</h2>
  270 +<p>As of v0.50, the API has changed significantly and it is not final
  271 +yet. For now, see the class RtfObjectParser in the code.</p>
  272 +<h3 id="deprecated-api-still-functional">Deprecated API (still
  273 +functional):</h3>
  274 +<p>rtf_iter_objects(filename) is an iterator which yields a tuple
  275 +(index, orig_len, object) providing the index of each hexadecimal stream
  276 +in the RTF file, and the corresponding decoded object.</p>
121 277 <p>Example:</p>
122   -<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">from</span> oletools <span class="im">import</span> rtfobj</a>
123   -<a class="sourceLine" id="cb3-2" data-line-number="2"><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</a>
124   -<a class="sourceLine" id="cb3-3" data-line-number="3"> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</a></code></pre></div>
  278 +<div class="sourceCode" id="cb3"><pre
  279 +class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools <span class="im">import</span> rtfobj</span>
  280 +<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</span>
  281 +<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</span></code></pre></div>
125 282 <hr />
126   -<h2 id="python-oletools-documentation">python-oletools documentation</h2>
  283 +<h2 id="python-oletools-documentation">python-oletools
  284 +documentation</h2>
127 285 <ul>
128 286 <li><a href="Home.html">Home</a></li>
129 287 <li><a href="License.html">License</a></li>
130 288 <li><a href="Install.html">Install</a></li>
131   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  289 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
  290 +Report Issues</li>
132 291 <li>Tools:
133 292 <ul>
134 293 <li><a href="mraptor.html">mraptor</a></li>
... ...