Peter M. Groen / oletools

Commit ab9a0433ce3443f4078fb5f54744f87992d5f238

Authored by decalage2
1 parent 5641d8d0

fix(olevba): prevent display of ANSI escape codes on the CLI (PR #873), bump to v0.60.3

Inline Side-by-side
Showing 22 changed files with 727 additions and 3583 deletions
LICENSE.md
  View file @ab9a043
1 1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
2 2 published with their own license.
3 3  
4   -The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec (http://www.decalage.info)
  4 +The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec (http://www.decalage.info)
5 5  
6 6 All rights reserved.
7 7  
... ...
README.md
  View file @ab9a043
... ... @@ -33,6 +33,8 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
33 33 News
34 34 ----
35 35  
  36 +- **2025-05-21 v0.60.3**:
  37 + - olevba: fixed a security issue in the CLI display when ANSI escape codes are present (PR #873)
36 38 - **2024-07-02 v0.60.2**:
37 39 - olevba:
38 40 - fixed a bug in open_slk (issue #797, PR #769)
... ...
oletools/README.html
  View file @ab9a043
... ... @@ -4,231 +4,61 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="python-oletools">python-oletools</h1>
160   -<p><a href="https://pypi.org/project/oletools/"><img
161   -src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a
162   -href="https://travis-ci.org/decalage2/oletools"><img
163   -src="https://travis-ci.org/decalage2/oletools.svg?branch=master"
164   -alt="Build Status" /></a> <a
165   -href="https://saythanks.io/to/decalage2"><img
166   -src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg"
167   -alt="Say Thanks!" /></a></p>
168   -<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a
169   -package of python tools to analyze <a
170   -href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft
171   -OLE2 files</a> (also called Structured Storage, Compound File Binary
172   -Format or Compound Document File Format), such as Microsoft Office
173   -97-2003 documents, MSI files or Outlook messages, mainly for malware
174   -analysis, forensics and debugging. It is based on the <a
175   -href="http://www.decalage.info/olefile">olefile</a> parser.</p>
176   -<p>It also provides tools to analyze RTF files and files based on the <a
177   -href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>
178   -(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
179   -<p>For example, oletools can detect, extract and analyse VBA macros, OLE
180   -objects, Excel 4 macros (XLM) and DDE links.</p>
181   -<p>See <a
182   -href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>
183   -for more info.</p>
184   -<p><strong>Quick links:</strong> <a
185   -href="http://www.decalage.info/python/oletools">Home page</a> - <a
186   -href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>
187   -- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>
188   -- <a href="https://github.com/decalage2/oletools/issues">Report
189   -Issues/Suggestions/Questions</a> - <a
190   -href="http://decalage.info/contact">Contact the Author</a> - <a
191   -href="https://github.com/decalage2/oletools">Repository</a> - <a
192   -href="https://twitter.com/decalage2">Updates on Twitter</a> <a
193   -href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>
194   -<p>Note: python-oletools is not related to OLETools published by BeCubed
195   -Software.</p>
  20 +<p><a href="https://pypi.org/project/oletools/"><img src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a href="https://travis-ci.org/decalage2/oletools"><img src="https://travis-ci.org/decalage2/oletools.svg?branch=master" alt="Build Status" /></a> <a href="https://saythanks.io/to/decalage2"><img src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg" alt="Say Thanks!" /></a></p>
  21 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  22 +<p>It also provides tools to analyze RTF files and files based on the <a href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a> (aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  23 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE objects, Excel 4 macros (XLM) and DDE links.</p>
  24 +<p>See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
  25 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a> <a href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>
  26 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
196 27 <h2 id="news">News</h2>
197 28 <ul>
  29 +<li><strong>2025-05-21 v0.60.3</strong>:
  30 +<ul>
  31 +<li>olevba: fixed a security issue in the CLI display when ANSI escape codes are present (PR #873)</li>
  32 +</ul></li>
198 33 <li><strong>2024-07-02 v0.60.2</strong>:
199 34 <ul>
200 35 <li>olevba:
201 36 <ul>
202 37 <li>fixed a bug in open_slk (issue #797, PR #769)</li>
203   -<li>fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR
204   -#723, issues #700, #701, #725, #791, #808, #811, #833)</li>
  38 +<li>fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR #723, issues #700, #701, #725, #791, #808, #811, #833)</li>
205 39 </ul></li>
206   -<li>oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning
207   -(PR #774)</li>
  40 +<li>oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning (PR #774)</li>
208 41 <li>rtfobj: fixed SyntaxError with Python 3.12 (PR #854)</li>
209 42 <li>clsid: added CLSIDs for MSI, Zed</li>
210 43 <li>ftguess: added MSI, PNG and OneNote formats</li>
211 44 <li>pyxswf: fixed python 3.12 compatibility (PR #841, issue #813)</li>
212   -<li>setup/requirements: allow pyparsing 3 to solve install issues (PR
213   -#812, issue #762)</li>
  45 +<li>setup/requirements: allow pyparsing 3 to solve install issues (PR #812, issue #762)</li>
214 46 </ul></li>
215 47 <li><strong>2022-05-09 v0.60.1</strong>:
216 48 <ul>
217 49 <li>olevba:
218 50 <ul>
219 51 <li>fixed a bug when calling XLMMacroDeobfuscator (PR #737)</li>
220   -<li>removed keyword "sample" causing false positives</li>
  52 +<li>removed keyword &quot;sample&quot; causing false positives</li>
221 53 </ul></li>
222 54 <li>oleid: fixed OleID init issue (issue #695, PR #696)</li>
223 55 <li>oleobj:
224 56 <ul>
225 57 <li>added simple detection of CVE-2021-40444 initial stage</li>
226 58 <li>added detection for customUI onLoad</li>
227   -<li>improved handling of incorrect filenames in OLE package (PR
228   -#451)</li>
  59 +<li>improved handling of incorrect filenames in OLE package (PR #451)</li>
229 60 </ul></li>
230   -<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue
231   -#692)</li>
  61 +<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue #692)</li>
232 62 <li>ftguess:
233 63 <ul>
234 64 <li>added PowerPoint and XPS formats (PR #716)</li>
... ... @@ -239,8 +69,7 @@ Software.&lt;/p&gt;
239 69 </ul></li>
240 70 <li><strong>2021-06-02 v0.60</strong>:
241 71 <ul>
242   -<li>ftguess: new tool to identify file formats and containers (issue
243   -#680)</li>
  72 +<li>ftguess: new tool to identify file formats and containers (issue #680)</li>
244 73 <li>oleid: (issue #679)
245 74 <ul>
246 75 <li>each indicator now has a risk level</li>
... ... @@ -250,232 +79,75 @@ Software.&lt;/p&gt;
250 79 </ul></li>
251 80 <li>olevba:
252 81 <ul>
253   -<li>when XLMMacroDeobfuscator is available, use it to extract and
254   -deobfuscate XLM macros</li>
  82 +<li>when XLMMacroDeobfuscator is available, use it to extract and deobfuscate XLM macros</li>
255 83 </ul></li>
256 84 <li>rtfobj:
257 85 <ul>
258 86 <li>use ftguess to identify file type of OLE Package (issue #682)</li>
259 87 <li>fixed bug in re_executable_extensions</li>
260 88 </ul></li>
261   -<li>crypto: added PowerPoint transparent password '/01Hannes
262   -Ruescher/01' (issue #627)</li>
263   -<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional
264   -dependencies</li>
  89 +<li>crypto: added PowerPoint transparent password '/01Hannes Ruescher/01' (issue #627)</li>
  90 +<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional dependencies</li>
265 91 </ul></li>
266 92 </ul>
267   -<p>See the <a
268   -href="https://github.com/decalage2/oletools/wiki/Changelog">full
269   -changelog</a> for more information.</p>
  93 +<p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p>
270 94 <h2 id="tools">Tools:</h2>
271   -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious
272   -documents</h3>
273   -<ul>
274   -<li><a
275   -href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to
276   -analyze OLE files to detect specific characteristics usually found in
277   -malicious files.</li>
278   -<li><a
279   -href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to
280   -extract and analyze VBA Macro source code from MS Office documents (OLE
281   -and OpenXML).</li>
282   -<li><a
283   -href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>:
284   -to detect malicious VBA Macros</li>
285   -<li><a
286   -href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to
287   -detect and extract DDE/DDEAUTO links from MS Office documents, RTF and
288   -CSV</li>
289   -<li><a
290   -href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to
291   -detect, extract and analyze Flash objects (SWF) that may be embedded in
292   -files such as MS Office documents (e.g. Word, Excel) and RTF, which is
293   -especially useful for malware analysis.</li>
294   -<li><a
295   -href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to
296   -extract embedded objects from OLE files.</li>
297   -<li><a
298   -href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to
299   -extract embedded objects from RTF files.</li>
  95 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
  96 +<ul>
  97 +<li><a href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
  98 +<li><a href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
  99 +<li><a href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>: to detect malicious VBA Macros</li>
  100 +<li><a href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
  101 +<li><a href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
  102 +<li><a href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to extract embedded objects from OLE files.</li>
  103 +<li><a href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to extract embedded objects from RTF files.</li>
300 104 </ul>
301   -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze
302   -the structure of OLE files</h3>
  105 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
303 106 <ul>
304   -<li><a
305   -href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>:
306   -A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint
307   -documents), to view and extract individual data streams.</li>
308   -<li><a
309   -href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>:
310   -to extract all standard properties (metadata) from OLE files.</li>
311   -<li><a
312   -href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>:
313   -to extract creation and modification timestamps of all streams and
314   -storages.</li>
315   -<li><a
316   -href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to
317   -display all the directory entries of an OLE file, including free and
318   -orphaned entries.</li>
319   -<li><a
320   -href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to
321   -display a map of all the sectors in an OLE file.</li>
  107 +<li><a href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
  108 +<li><a href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>: to extract all standard properties (metadata) from OLE files.</li>
  109 +<li><a href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>: to extract creation and modification timestamps of all streams and storages.</li>
  110 +<li><a href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
  111 +<li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
322 112 </ul>
323 113 <h2 id="projects-using-oletools">Projects using oletools:</h2>
324   -<p>oletools are used by a number of projects and online malware analysis
325   -services, including <a
326   -href="https://github.com/IntegralDefense/ACE">ACE</a>, <a
327   -href="https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162">ADAPT</a>,
328   -<a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a
329   -href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a
330   -href="https://github.com/binref/refinery">Binary Refinery</a>, <a
331   -href="https://github.com/ctxis/CAPE">CAPE</a>, <a
332   -href="https://cincan.io">CinCan</a>, <a
333   -href="https://cortex.marketplace.pan.dev/marketplace/details/Oletools/">Cortex
334   -XSOAR (Palo Alto)</a>, <a
335   -href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a
336   -href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a
337   -href="https://sandbox.deepviz.com/">Deepviz</a>, <a
338   -href="https://diario.elevenpaths.com/">DIARIO</a>, <a
339   -href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a
340   -href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a
341   -href="https://pub.expmon.com/">EXPMON</a>, <a
342   -href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a
343   -href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a
344   -href="https://www.glimps.fr/en/glimps-malware-2/">GLIMPS Malware</a>, <a
345   -href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a
346   -href="https://labs.inquest.net/">InQuest Labs</a>, <a
347   -href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a
348   -href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a
349   -href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a
350   -href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a
351   -href="https://mailcow.email/">mailcow</a>, <a
352   -href="https://malshare.io">malshare.io</a>, <a
353   -href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a
354   -href="https://www.adlice.com/download/mrf/">Malware Repository Framework
355   -(MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a
356   -href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a
357   -href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a
358   -href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a
359   -href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a
360   -href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a
361   -href="https://www.quarkslab.com/products-qflow/">QFlow</a>, <a
362   -href="https://github.com/CYB3RMX/Qu1cksc0pe">Qu1cksc0pe</a>, <a
363   -href="https://github.com/tylabs/quicksand">Tylabs QuickSand</a>, <a
364   -href="https://remnux.org/">REMnux</a>, <a
365   -href="https://github.com/countercept/snake">Snake</a>, <a
366   -href="https://app.sndbox.com">SNDBOX</a>, <a
367   -href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365
368   -Email</a>, <a
369   -href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a
370   -href="https://github.com/target/strelka">Strelka</a>, <a
371   -href="https://stoq.punchcyber.com/">stoQ</a>, <a
372   -href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime
373   -Platform/MQL</a>, <a
374   -href="https://github.com/jstrosch/subparse">Subparse</a>, <a
375   -href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>,
376   -<a href="https://s.threatbook.com/">ThreatBoook</a>, <a
377   -href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a
378   -href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a
379   -href="http://viper.li/">Viper</a>, <a
380   -href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a
381   -href="https://yomi.yoroi.company">YOMI</a>, and probably <a
382   -href="https://www.virustotal.com">VirusTotal</a>, <a
383   -href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a
384   -href="https://github.com/search?q=oletools&amp;type=Repositories">other
385   -projects on GitHub</a>. (Please <a
386   -href="(http://decalage.info/contact)">contact me</a> if you have or know
387   -a project using oletools)</p>
  114 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162">ADAPT</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/binref/refinery">Binary Refinery</a>, <a href="https://github.com/kevoreilly/CAPEv2">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://cortex.marketplace.pan.dev/marketplace/details/Oletools/">Cortex XSOAR (Palo Alto)</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://pub.expmon.com/">EXPMON</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.glimps.fr/en/glimps-malware-2/">GLIMPS Malware</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://labs.inquest.net/">InQuest Labs</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://www.quarkslab.com/products-qflow/">QFlow</a>, <a href="https://github.com/CYB3RMX/Qu1cksc0pe">Qu1cksc0pe</a>, <a href="https://github.com/tylabs/quicksand">Tylabs QuickSand</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime Platform/MQL</a>, <a href="https://github.com/jstrosch/subparse">Subparse</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://s.threatbook.com/">ThreatBoook</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>, <a href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
388 115 <h2 id="download-and-install">Download and Install:</h2>
389   -<p>The recommended way to download and install/update the <strong>latest
390   -stable release</strong> of oletools is to use <a
391   -href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
  116 +<p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
392 117 <ul>
393   -<li>On Linux/Mac:
394   -<code>sudo -H pip install -U oletools[full]</code></li>
  118 +<li>On Linux/Mac: <code>sudo -H pip install -U oletools[full]</code></li>
395 119 <li>On Windows: <code>pip install -U oletools[full]</code></li>
396 120 </ul>
397   -<p>This should automatically create command-line scripts to run each
398   -tool from any directory: <code>olevba</code>, <code>mraptor</code>,
399   -<code>rtfobj</code>, etc.</p>
400   -<p>The keyword <code>[full]</code> means that all optional dependencies
401   -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
402   -version without optional dependencies, just remove <code>[full]</code>
403   -from the command line.</p>
  121 +<p>This should automatically create command-line scripts to run each tool from any directory: <code>olevba</code>, <code>mraptor</code>, <code>rtfobj</code>, etc.</p>
  122 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, just remove <code>[full]</code> from the command line.</p>
404 123 <p>To get the <strong>latest development version</strong> instead:</p>
405 124 <ul>
406   -<li>On Linux/Mac:
407   -<code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
408   -<li>On Windows:
409   -<code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
  125 +<li>On Linux/Mac: <code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
  126 +<li>On Windows: <code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
410 127 </ul>
411   -<p>See the <a
412   -href="https://github.com/decalage2/oletools/wiki/Install">documentation</a>
413   -for other installation options.</p>
  128 +<p>See the <a href="https://github.com/decalage2/oletools/wiki/Install">documentation</a> for other installation options.</p>
414 129 <h2 id="documentation">Documentation:</h2>
415   -<p>The latest version of the documentation can be found <a
416   -href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise
417   -a copy is provided in the doc subfolder of the package.</p>
418   -<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to
419   -Suggest Improvements, Report Issues or Contribute:</h2>
420   -<p>This is a personal open-source project, developed on my spare time.
421   -Any contribution, suggestion, feedback or bug report is welcome.</p>
422   -<p>To suggest improvements, report a bug or any issue, please use the <a
423   -href="https://github.com/decalage2/oletools/issues">issue reporting
424   -page</a>, providing all the information and files to reproduce the
425   -problem.</p>
426   -<p>You may also <a href="http://decalage.info/contact">contact the
427   -author</a> directly to provide feedback.</p>
428   -<p>The code is available in <a
429   -href="https://github.com/decalage2/oletools">a GitHub repository</a>.
430   -You may use it to submit enhancements using forks and pull requests.</p>
  130 +<p>The latest version of the documentation can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  131 +<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute:</h2>
  132 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  133 +<p>To suggest improvements, report a bug or any issue, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>
  134 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to provide feedback.</p>
  135 +<p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
431 136 <h2 id="license">License</h2>
432   -<p>This license applies to the python-oletools package, apart from the
433   -thirdparty folder which contains third-party files published with their
434   -own license.</p>
435   -<p>The python-oletools package is copyright (c) 2012-2024 Philippe
436   -Lagadec (http://www.decalage.info)</p>
  137 +<p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
  138 +<p>The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec (http://www.decalage.info)</p>
437 139 <p>All rights reserved.</p>
438   -<p>Redistribution and use in source and binary forms, with or without
439   -modification, are permitted provided that the following conditions are
440   -met:</p>
  140 +<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
441 141 <ul>
442   -<li>Redistributions of source code must retain the above copyright
443   -notice, this list of conditions and the following disclaimer.</li>
444   -<li>Redistributions in binary form must reproduce the above copyright
445   -notice, this list of conditions and the following disclaimer in the
446   -documentation and/or other materials provided with the
447   -distribution.</li>
  142 +<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
  143 +<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
448 144 </ul>
449   -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
450   -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
451   -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
452   -PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
453   -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
454   -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
455   -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
456   -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
457   -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
458   -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
459   -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  145 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
460 146 <hr />
461   -<p>olevba contains modified source code from the officeparser project,
462   -published under the following MIT License (MIT):</p>
  147 +<p>olevba contains modified source code from the officeparser project, published under the following MIT License (MIT):</p>
463 148 <p>officeparser is copyright (c) 2014 John William Davison</p>
464   -<p>Permission is hereby granted, free of charge, to any person obtaining
465   -a copy of this software and associated documentation files (the
466   -"Software"), to deal in the Software without restriction, including
467   -without limitation the rights to use, copy, modify, merge, publish,
468   -distribute, sublicense, and/or sell copies of the Software, and to
469   -permit persons to whom the Software is furnished to do so, subject to
470   -the following conditions:</p>
471   -<p>The above copyright notice and this permission notice shall be
472   -included in all copies or substantial portions of the Software.</p>
473   -<p>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
474   -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
475   -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
476   -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
477   -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
478   -TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
479   -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
  149 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
  150 +<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
  151 +<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
480 152 </body>
481 153 </html>
... ...
oletools/README.rst
  View file @ab9a043
... ... @@ -38,6 +38,11 @@ Software.
38 38 News
39 39 ----
40 40  
  41 +- **2025-05-21 v0.60.3**:
  42 +
  43 + - olevba: fixed a security issue in the CLI display when ANSI escape
  44 + codes are present (PR #873)
  45 +
41 46 - **2024-07-02 v0.60.2**:
42 47  
43 48 - olevba:
... ... @@ -162,7 +167,7 @@ services, including `ACE &lt;https://github.com/IntegralDefense/ACE&gt;`__,
162 167 `Anlyz.io <https://sandbox.anlyz.io/>`__,
163 168 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__, `Binary
164 169 Refinery <https://github.com/binref/refinery>`__,
165   -`CAPE <https://github.com/ctxis/CAPE>`__,
  170 +`CAPE <https://github.com/kevoreilly/CAPEv2>`__,
166 171 `CinCan <https://cincan.io>`__, `Cortex XSOAR (Palo
167 172 Alto) <https://cortex.marketplace.pan.dev/marketplace/details/Oletools/>`__,
168 173 `Cuckoo Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
... ...
oletools/doc/Contribute.html
  View file @ab9a043
... ... @@ -4,182 +4,30 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159   -<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to
160   -Suggest Improvements, Report Issues or Contribute</h1>
161   -<p>This is a personal open-source project, developed on my spare time.
162   -Any contribution, suggestion, feedback or bug report is welcome.</p>
163   -<p>To <strong>suggest improvements, report a bug or any issue</strong>,
164   -please use the <a
165   -href="https://github.com/decalage2/oletools/issues">issue reporting
166   -page</a>, and provide all the information and files to reproduce the
167   -problem.</p>
168   -<p>You may also <a href="http://decalage.info/contact">contact the
169   -author</a> directly to <strong>send feedback</strong>.</p>
170   -<p>The code is available in <a
171   -href="https://github.com/decalage2/oletools">a repository on GitHub</a>.
172   -You may use it to <strong>submit enhancements</strong> using forks and
173   -pull requests.</p>
  19 +<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute</h1>
  20 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  21 +<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, and provide all the information and files to reproduce the problem.</p>
  22 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>send feedback</strong>.</p>
  23 +<p>The code is available in <a href="https://github.com/decalage2/oletools">a repository on GitHub</a>. You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>
174 24 <hr />
175   -<h2 id="python-oletools-documentation">python-oletools
176   -documentation</h2>
  25 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
177 26 <ul>
178 27 <li><a href="Home.html">Home</a></li>
179 28 <li><a href="License.html">License</a></li>
180 29 <li><a href="Install.html">Install</a></li>
181   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
182   -Report Issues</li>
  30 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
183 31 <li>Tools:
184 32 <ul>
185 33 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/Home.html
  View file @ab9a043
... ... @@ -4,240 +4,53 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159   -<h1 id="python-oletools-documentation">python-oletools
160   -documentation</h1>
161   -<p>This is the home page of the documentation for python-oletools. The
162   -latest version can be found <a
163   -href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise
164   -a copy is provided in the doc subfolder of the package.</p>
165   -<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a
166   -package of python tools to analyze <a
167   -href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft
168   -OLE2 files</a> (also called Structured Storage, Compound File Binary
169   -Format or Compound Document File Format), such as Microsoft Office
170   -97-2003 documents, MSI files or Outlook messages, mainly for malware
171   -analysis, forensics and debugging. It is based on the <a
172   -href="http://www.decalage.info/olefile">olefile</a> parser.</p>
173   -<p>It also provides tools to analyze RTF files and files based on the <a
174   -href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>
175   -(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
176   -<p>For example, oletools can detect, extract and analyse VBA macros, OLE
177   -objects, Excel 4 macros (XLM) and DDE links.</p>
178   -<p>See <a
179   -href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>
180   -for more info.</p>
181   -<p><strong>Quick links:</strong> <a
182   -href="http://www.decalage.info/python/oletools">Home page</a> - <a
183   -href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>
184   -- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>
185   -- <a href="https://github.com/decalage2/oletools/issues">Report
186   -Issues/Suggestions/Questions</a> - <a
187   -href="http://decalage.info/contact">Contact the Author</a> - <a
188   -href="https://github.com/decalage2/oletools">Repository</a> - <a
189   -href="https://twitter.com/decalage2">Updates on Twitter</a></p>
190   -<p>Note: python-oletools is not related to OLETools published by BeCubed
191   -Software.</p>
  19 +<h1 id="python-oletools-documentation">python-oletools documentation</h1>
  20 +<p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  21 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  22 +<p>It also provides tools to analyze RTF files and files based on the <a href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a> (aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  23 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE objects, Excel 4 macros (XLM) and DDE links.</p>
  24 +<p>See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
  25 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
  26 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
192 27 <h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>
193   -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious
194   -documents</h3>
  28 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
195 29 <ul>
196   -<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE
197   -files to detect specific characteristics usually found in malicious
198   -files.</li>
199   -<li><strong><a href="olevba.html">olevba</a></strong>: to extract and
200   -analyze VBA Macro source code from MS Office documents (OLE and
201   -OpenXML).</li>
202   -<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect
203   -malicious VBA Macros</li>
204   -<li><strong><a href="msodde.html">msodde</a></strong>: to detect and
205   -extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
206   -<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect,
207   -extract and analyze Flash objects (SWF) that may be embedded in files
208   -such as MS Office documents (e.g. Word, Excel) and RTF, which is
209   -especially useful for malware analysis.</li>
210   -<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract
211   -embedded objects from OLE files.</li>
212   -<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract
213   -embedded objects from RTF files.</li>
  30 +<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
  31 +<li><strong><a href="olevba.html">olevba</a></strong>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
  32 +<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect malicious VBA Macros</li>
  33 +<li><strong><a href="msodde.html">msodde</a></strong>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
  34 +<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
  35 +<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract embedded objects from OLE files.</li>
  36 +<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract embedded objects from RTF files.</li>
214 37 </ul>
215   -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze
216   -the structure of OLE files</h3>
  38 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
217 39 <ul>
218   -<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple
219   -GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to
220   -view and extract individual data streams.</li>
221   -<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all
222   -standard properties (metadata) from OLE files.</li>
223   -<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract
224   -creation and modification timestamps of all streams and storages.</li>
225   -<li><strong><a href="oledir.html">oledir</a></strong>: to display all
226   -the directory entries of an OLE file, including free and orphaned
227   -entries.</li>
228   -<li><strong><a href="olemap.html">olemap</a></strong>: to display a map
229   -of all the sectors in an OLE file.</li>
  40 +<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
  41 +<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all standard properties (metadata) from OLE files.</li>
  42 +<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract creation and modification timestamps of all streams and storages.</li>
  43 +<li><strong><a href="oledir.html">oledir</a></strong>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
  44 +<li><strong><a href="olemap.html">olemap</a></strong>: to display a map of all the sectors in an OLE file.</li>
230 45 <li>and a few others (coming soon)</li>
231 46 </ul>
232 47 <hr />
233   -<h2 id="python-oletools-documentation-1">python-oletools
234   -documentation</h2>
  48 +<h2 id="python-oletools-documentation-1">python-oletools documentation</h2>
235 49 <ul>
236 50 <li><a href="Home.html">Home</a></li>
237 51 <li><a href="License.html">License</a></li>
238 52 <li><a href="Install.html">Install</a></li>
239   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
240   -Report Issues</li>
  53 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
241 54 <li>Tools:
242 55 <ul>
243 56 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/Install.html
  View file @ab9a043
... ... @@ -4,267 +4,75 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159   -<h1 id="how-to-download-and-install-oletools">How to Download and
160   -Install oletools</h1>
  19 +<h1 id="how-to-download-and-install-oletools">How to Download and Install oletools</h1>
161 20 <h2 id="pre-requisites">Pre-requisites</h2>
162   -<p>The recommended Python version to run oletools is the latest
163   -<strong>Python 3.x</strong> (3.12 for now). Python 2.7 is still
164   -supported for the moment, even if it reached end of life in 2020 (for
165   -projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly
166   -recommended to switch to Python 3 if possible.</p>
167   -<h2
168   -id="recommended-way-to-downloadinstallupdate-oletools-pip-or-pipx">Recommended
169   -way to Download+Install/Update oletools: pip or pipx</h2>
170   -<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not
171   -installed on your system, either upgrade Python or see
172   -https://pip.pypa.io/en/stable/installing/</p>
  21 +<p>The recommended Python version to run oletools is the latest <strong>Python 3.x</strong> (3.12 for now). Python 2.7 is still supported for the moment, even if it reached end of life in 2020 (for projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly recommended to switch to Python 3 if possible.</p>
  22 +<h2 id="recommended-way-to-downloadinstallupdate-oletools-pip-or-pipx">Recommended way to Download+Install/Update oletools: pip or pipx</h2>
  23 +<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/</p>
173 24 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3>
174   -<p>To download and install/update the latest release version of oletools
175   -with all its dependencies, run the following command in a shell:</p>
  25 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a shell:</p>
176 26 <pre class="text"><code>sudo -H pip install -U oletools[full]</code></pre>
177   -<p>The keyword <code>[full]</code> means that all optional dependencies
178   -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
179   -version without optional dependencies, use the following command
180   -instead:</p>
  27 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
181 28 <pre class="text"><code>sudo -H pip install -U oletools</code></pre>
182   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
183   -install on a specific Python version.</p>
184   -<p>On some Linux distributions, it might not be allowed to install
185   -system-wide python packages with pip. In that case, pipx may be a better
186   -alternative to install oletools in a user virtual environment, and to
187   -install the command-line scripts oleid, olevba, etc:</p>
  29 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  30 +<p>On some Linux distributions, it might not be allowed to install system-wide python packages with pip. In that case, pipx may be a better alternative to install oletools in a user virtual environment, and to install the command-line scripts oleid, olevba, etc:</p>
188 31 <pre class="text"><code>pipx install oletools</code></pre>
189   -<p><strong>Important</strong>: Since version 0.50, pip will
190   -automatically create convenient command-line scripts in /usr/local/bin
191   -to run all the oletools from any directory.</p>
  32 +<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts in /usr/local/bin to run all the oletools from any directory.</p>
192 33 <h3 id="windows">Windows</h3>
193   -<p>To download and install/update the latest release version of oletools
194   -with all its dependencies, run the following command in a cmd
195   -window:</p>
  34 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a cmd window:</p>
196 35 <pre class="text"><code>pip install -U oletools[full]</code></pre>
197   -<p>The keyword <code>[full]</code> means that all optional dependencies
198   -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter
199   -version without optional dependencies, use the following command
200   -instead:</p>
  36 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
201 37 <pre class="text"><code>pip install -U oletools</code></pre>
202   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
203   -install on a specific Python version.</p>
204   -<p><strong>Note</strong>: with Python 3, you may need to open a cmd
205   -window with Administrator privileges in order to run pip and install for
206   -all users. If that is not possible, you may also install only for the
207   -current user by adding the <code>--user</code> option:</p>
  38 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  39 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
208 40 <pre class="text"><code>pip3 install -U --user oletools</code></pre>
209   -<p><strong>Important</strong>: Since version 0.50, pip will
210   -automatically create convenient command-line scripts to run all the
211   -oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>
212   -<h2 id="how-to-install-the-latest-development-version">How to install
213   -the latest development version</h2>
214   -<p>If you want to benefit from the latest improvements in the
215   -development version, you may also use pip:</p>
  41 +<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts to run all the oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>
  42 +<h2 id="how-to-install-the-latest-development-version">How to install the latest development version</h2>
  43 +<p>If you want to benefit from the latest improvements in the development version, you may also use pip:</p>
216 44 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3>
217 45 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
218   -<p>Note that it will install oletools without optional dependencies such
219   -as XLMMacroDeobfuscator, so you may need to install them separately.</p>
220   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
221   -install on a specific Python version.</p>
  46 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  47 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
222 48 <h3 id="windows-1">Windows</h3>
223 49 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
224   -<p>Note that it will install oletools without optional dependencies such
225   -as XLMMacroDeobfuscator, so you may need to install them separately.</p>
226   -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to
227   -install on a specific Python version.</p>
228   -<p><strong>Note</strong>: with Python 3, you may need to open a cmd
229   -window with Administrator privileges in order to run pip and install for
230   -all users. If that is not possible, you may also install only for the
231   -current user by adding the <code>--user</code> option:</p>
  50 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  51 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  52 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
232 53 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre>
233   -<h2 id="how-to-install-offline---computer-without-internet-access">How
234   -to install offline - Computer without Internet access</h2>
235   -<p>First, download the oletools archive on a computer with Internet
236   -access: * Latest stable version: from https://pypi.org/project/oletools/
237   -or https://github.com/decalage2/oletools/releases * Development version:
238   -https://github.com/decalage2/oletools/archive/master.zip</p>
  54 +<h2 id="how-to-install-offline---computer-without-internet-access">How to install offline - Computer without Internet access</h2>
  55 +<p>First, download the oletools archive on a computer with Internet access: * Latest stable version: from https://pypi.org/project/oletools/ or https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
239 56 <p>Copy the archive file to the target computer.</p>
240   -<p>On Linux, Mac OSX, Unix, run the following command using the filename
241   -of the archive that you downloaded:</p>
  57 +<p>On Linux, Mac OSX, Unix, run the following command using the filename of the archive that you downloaded:</p>
242 58 <pre class="text"><code>sudo -H pip install -U oletools.zip</code></pre>
243 59 <p>On Windows:</p>
244 60 <pre class="text"><code>pip install -U oletools.zip</code></pre>
245   -<h2 id="old-school-install-using-setup.py">Old school install using
246   -setup.py</h2>
247   -<p>If you cannot use pip, it is still possible to run the setup.py
248   -script directly. However, this method will not create the command-line
249   -scripts automatically.</p>
250   -<p>First, download the oletools archive: * Latest stable version: from
251   -https://github.com/decalage2/oletools/releases * Development version:
252   -https://github.com/decalage2/oletools/archive/master.zip</p>
253   -<p>Then extract the archive, open a shell and go to the oletools
254   -directory.</p>
  61 +<h2 id="old-school-install-using-setup.py">Old school install using setup.py</h2>
  62 +<p>If you cannot use pip, it is still possible to run the setup.py script directly. However, this method will not create the command-line scripts automatically.</p>
  63 +<p>First, download the oletools archive: * Latest stable version: from https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
  64 +<p>Then extract the archive, open a shell and go to the oletools directory.</p>
255 65 <h3 id="linux-mac-osx-unix-2">Linux, Mac OSX, Unix</h3>
256 66 <pre class="text"><code>sudo -H python setup.py install</code></pre>
257 67 <h3 id="windows-2">Windows:</h3>
258 68 <pre class="text"><code>python setup.py install</code></pre>
259 69 <hr />
260   -<h2 id="python-oletools-documentation">python-oletools
261   -documentation</h2>
  70 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
262 71 <ul>
263 72 <li><a href="Home.html">Home</a></li>
264 73 <li><a href="License.html">License</a></li>
265 74 <li><a href="Install.html">Install</a></li>
266   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
267   -Report Issues</li>
  75 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
268 76 <li>Tools:
269 77 <ul>
270 78 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/License.html
  View file @ab9a043
... ... @@ -4,189 +4,28 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="license-for-python-oletools">License for python-oletools</h1>
160   -<p>This license applies to the <a
161   -href="http://www.decalage.info/python/oletools">python-oletools</a>
162   -package, apart from the thirdparty folder which contains third-party
163   -files published with their own license.</p>
164   -<p>The python-oletools package is copyright (c) 2012-2024 Philippe
165   -Lagadec (<a
166   -href="http://www.decalage.info">http://www.decalage.info</a>)</p>
  20 +<p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
  21 +<p>The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
167 22 <p>All rights reserved.</p>
168   -<p>Redistribution and use in source and binary forms, with or without
169   -modification, are permitted provided that the following conditions are
170   -met:</p>
  23 +<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
171 24 <ul>
172   -<li>Redistributions of source code must retain the above copyright
173   -notice, this list of conditions and the following disclaimer.</li>
174   -<li>Redistributions in binary form must reproduce the above copyright
175   -notice, this list of conditions and the following disclaimer in the
176   -documentation and/or other materials provided with the
177   -distribution.</li>
  25 +<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
  26 +<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
178 27 </ul>
179   -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
180   -“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
181   -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
182   -PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
183   -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
184   -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
185   -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
186   -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
187   -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
188   -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
189   -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  28 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
190 29 <table>
191 30 <tbody>
192 31 <tr class="odd">
... ... @@ -194,35 +33,18 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.&lt;/p&gt;
194 33 </tr>
195 34 </tbody>
196 35 </table>
197   -<p>olevba contains modified source code from the <a
198   -href="https://github.com/unixfreak0037/officeparser">officeparser</a>
199   -project, published under the following MIT License (MIT):</p>
  36 +<p>olevba contains modified source code from the <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> project, published under the following MIT License (MIT):</p>
200 37 <p>officeparser is copyright (c) 2014 John William Davison</p>
201   -<p>Permission is hereby granted, free of charge, to any person obtaining
202   -a copy of this software and associated documentation files (the
203   -“Software”), to deal in the Software without restriction, including
204   -without limitation the rights to use, copy, modify, merge, publish,
205   -distribute, sublicense, and/or sell copies of the Software, and to
206   -permit persons to whom the Software is furnished to do so, subject to
207   -the following conditions:</p>
208   -<p>The above copyright notice and this permission notice shall be
209   -included in all copies or substantial portions of the Software.</p>
210   -<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,
211   -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
212   -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
213   -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
214   -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
215   -TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
216   -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
  38 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
  39 +<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
  40 +<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
217 41 <hr />
218   -<h2 id="python-oletools-documentation">python-oletools
219   -documentation</h2>
  42 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
220 43 <ul>
221 44 <li><a href="Home.html">Home</a></li>
222 45 <li><a href="License.html">License</a></li>
223 46 <li><a href="Install.html">Install</a></li>
224   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
225   -Report Issues</li>
  47 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
226 48 <li>Tools:
227 49 <ul>
228 50 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/License.md
  View file @ab9a043
... ... @@ -4,7 +4,7 @@ License for python-oletools
4 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 5 thirdparty folder which contains third-party files published with their own license.
6 6  
7   -The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
  7 +The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8  
9 9 All rights reserved.
10 10  
... ...
oletools/doc/mraptor.html
  View file @ab9a043
... ... @@ -4,177 +4,25 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="mraptor-macroraptor">mraptor (MacroRaptor)</h1>
160   -<p>mraptor is a tool designed to detect most malicious VBA Macros using
161   -generic heuristics. Unlike antivirus engines, it does not rely on
162   -signatures.</p>
163   -<p>In a nutshell, mraptor detects keywords corresponding to the three
164   -following types of behaviour that are present in clear text in almost
165   -any macro malware: - A: Auto-execution trigger - W: Write to the file
166   -system or memory - X: Execute a file or any payload outside the VBA
167   -context</p>
168   -<p>mraptor considers that a macro is suspicious when A and (W or X) is
169   -true.</p>
170   -<p>For more information about mraptor’s detection algorithm, see the
171   -article <a href="http://www.decalage.info/mraptor">How to detect most
172   -malicious macros without an antivirus</a>.</p>
173   -<p>mraptor can be used either as a command-line tool, or as a python
174   -module from your own applications.</p>
175   -<p>It is part of the <a
176   -href="http://www.decalage.info/python/oletools">python-oletools</a>
177   -package.</p>
  20 +<p>mraptor is a tool designed to detect most malicious VBA Macros using generic heuristics. Unlike antivirus engines, it does not rely on signatures.</p>
  21 +<p>In a nutshell, mraptor detects keywords corresponding to the three following types of behaviour that are present in clear text in almost any macro malware: - A: Auto-execution trigger - W: Write to the file system or memory - X: Execute a file or any payload outside the VBA context</p>
  22 +<p>mraptor considers that a macro is suspicious when A and (W or X) is true.</p>
  23 +<p>For more information about mraptor’s detection algorithm, see the article <a href="http://www.decalage.info/mraptor">How to detect most malicious macros without an antivirus</a>.</p>
  24 +<p>mraptor can be used either as a command-line tool, or as a python module from your own applications.</p>
  25 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
178 26 <h2 id="usage">Usage</h2>
179 27 <pre class="text"><code>Usage: mraptor [options] &lt;filename&gt; [filename2 ...]
180 28  
... ... @@ -202,34 +50,24 @@ An exit code is returned based on the analysis result:
202 50 <h3 id="examples">Examples</h3>
203 51 <p>Scan a single file:</p>
204 52 <pre class="text"><code>mraptor file.doc</code></pre>
205   -<p>Scan a single file, stored in a Zip archive with password
206   -“infected”:</p>
  53 +<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
207 54 <pre class="text"><code>mraptor malicious_file.xls.zip -z infected</code></pre>
208 55 <p>Scan a collection of files stored in a folder:</p>
209 56 <pre class="text"><code>mraptor &quot;MalwareZoo/VBA/*&quot;</code></pre>
210   -<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes
211   -around a file name when you use wildcards such as <code>*</code> and
212   -<code>?</code>. Otherwise, the shell may replace the argument with the
213   -actual list of files matching the wildcards before starting the
214   -script.</p>
  57 +<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes around a file name when you use wildcards such as <code>*</code> and <code>?</code>. Otherwise, the shell may replace the argument with the actual list of files matching the wildcards before starting the script.</p>
215 58 <p><img src="mraptor1.png" /></p>
216 59 <h2 id="python-3-support---mraptor3">Python 3 support - mraptor3</h2>
217   -<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3.
218   -There is no need to use mraptor3 anymore, however it is still present
219   -for backward compatibility.</p>
  60 +<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3. There is no need to use mraptor3 anymore, however it is still present for backward compatibility.</p>
220 61 <hr />
221   -<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in
222   -Python applications</h2>
  62 +<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in Python applications</h2>
223 63 <p>TODO</p>
224 64 <hr />
225   -<h2 id="python-oletools-documentation">python-oletools
226   -documentation</h2>
  65 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
227 66 <ul>
228 67 <li><a href="Home.html">Home</a></li>
229 68 <li><a href="License.html">License</a></li>
230 69 <li><a href="Install.html">Install</a></li>
231   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
232   -Report Issues</li>
  70 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
233 71 <li>Tools:
234 72 <ul>
235 73 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olebrowse.html
  View file @ab9a043
... ... @@ -4,182 +4,30 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="olebrowse">olebrowse</h1>
160   -<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel,
161   -Powerpoint documents), to view and extract individual data streams.</p>
162   -<p>It is part of the <a
163   -href="http://www.decalage.info/python/oletools">python-oletools</a>
164   -package.</p>
  20 +<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
165 22 <h2 id="dependencies">Dependencies</h2>
166   -<p>olebrowse requires <a
167   -href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and
168   -MacOSX, it should be installed with Python, and olebrowse should work
169   -out of the box.</p>
170   -<p>However, on Linux it might be necessary to install the tkinter
171   -package for Python separately. For example, on Ubuntu this is done with
172   -the following command:</p>
  23 +<p>olebrowse requires <a href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and MacOSX, it should be installed with Python, and olebrowse should work out of the box.</p>
  24 +<p>However, on Linux it might be necessary to install the tkinter package for Python separately. For example, on Ubuntu this is done with the following command:</p>
173 25 <pre><code>sudo apt-get install python-tk</code></pre>
174 26 <p>And for Python 3:</p>
175 27 <pre><code>sudo apt-get install python3-tk</code></pre>
176 28 <h2 id="usage">Usage</h2>
177 29 <pre><code>olebrowse [file]</code></pre>
178   -<p>If you provide a file it will be opened, else a dialog will allow you
179   -to browse folders to open a file. Then if it is a valid OLE file, the
180   -list of data streams will be displayed. You can select a stream, and
181   -then either view its content in a builtin hexadecimal viewer, or save it
182   -to a file for further analysis.</p>
  30 +<p>If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.</p>
183 31 <h2 id="screenshots">Screenshots</h2>
184 32 <p>Main menu, showing all streams in the OLE file:</p>
185 33 <p><img src="olebrowse1_menu.png" /></p>
... ... @@ -188,14 +36,12 @@ to a file for further analysis.&lt;/p&gt;
188 36 <p>Hex view for a stream:</p>
189 37 <p><img src="olebrowse3_hexview.png" /></p>
190 38 <hr />
191   -<h2 id="python-oletools-documentation">python-oletools
192   -documentation</h2>
  39 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
193 40 <ul>
194 41 <li><a href="Home.html">Home</a></li>
195 42 <li><a href="License.html">License</a></li>
196 43 <li><a href="Install.html">Install</a></li>
197   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
198   -Report Issues</li>
  44 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
199 45 <li>Tools:
200 46 <ul>
201 47 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oledir.html
  View file @ab9a043
... ... @@ -4,166 +4,22 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="oledir">oledir</h1>
160   -<p>oledir is a script to display all the directory entries of an OLE
161   -file, including free and orphaned entries.</p>
162   -<p>It can be used either as a command-line tool, or as a python module
163   -from your own applications.</p>
164   -<p>It is part of the <a
165   -href="http://www.decalage.info/python/oletools">python-oletools</a>
166   -package.</p>
  20 +<p>oledir is a script to display all the directory entries of an OLE file, including free and orphaned entries.</p>
  21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
167 23 <h2 id="usage">Usage</h2>
168 24 <pre class="text"><code>Usage: oledir [options] &lt;filename&gt; [filename2 ...]
169 25  
... ... @@ -182,18 +38,15 @@ Options:
182 38 <pre class="text"><code>oledir file.doc</code></pre>
183 39 <p><img src="oledir.png" /></p>
184 40 <hr />
185   -<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in
186   -Python applications</h2>
  41 +<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in Python applications</h2>
187 42 <p>TODO</p>
188 43 <hr />
189   -<h2 id="python-oletools-documentation">python-oletools
190   -documentation</h2>
  44 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
191 45 <ul>
192 46 <li><a href="Home.html">Home</a></li>
193 47 <li><a href="License.html">License</a></li>
194 48 <li><a href="Install.html">Install</a></li>
195   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
196   -Report Issues</li>
  49 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
197 50 <li>Tools:
198 51 <ul>
199 52 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oleid.html
  View file @ab9a043
... ... @@ -4,233 +4,89 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - pre > code.sourceCode { white-space: pre; position: relative; }
156   - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
157   - pre > code.sourceCode > span:empty { height: 1.2em; }
158   - .sourceCode { overflow: visible; }
159   - code.sourceCode > span { color: inherit; text-decoration: inherit; }
160   - div.sourceCode { margin: 1em 0; }
161   - pre.sourceCode { margin: 0; }
162   - @media screen {
163   - div.sourceCode { overflow: auto; }
164   - }
165   - @media print {
166   - pre > code.sourceCode { white-space: pre-wrap; }
167   - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
168   - }
169   - pre.numberSource code
170   - { counter-reset: source-line 0; }
171   - pre.numberSource code > span
172   - { position: relative; left: -4em; counter-increment: source-line; }
173   - pre.numberSource code > span > a:first-child::before
174   - { content: counter(source-line);
175   - position: relative; left: -1em; text-align: right; vertical-align: baseline;
176   - border: none; display: inline-block;
177   - -webkit-touch-callout: none; -webkit-user-select: none;
178   - -khtml-user-select: none; -moz-user-select: none;
179   - -ms-user-select: none; user-select: none;
180   - padding: 0 4px; width: 4em;
181   - color: #aaaaaa;
182   - }
183   - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
184   - div.sourceCode
185   - { }
186   - @media screen {
187   - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
188   - }
189   - code span.al { color: #ff0000; font-weight: bold; } /* Alert */
190   - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
191   - code span.at { color: #7d9029; } /* Attribute */
192   - code span.bn { color: #40a070; } /* BaseN */
193   - code span.bu { color: #008000; } /* BuiltIn */
194   - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
195   - code span.ch { color: #4070a0; } /* Char */
196   - code span.cn { color: #880000; } /* Constant */
197   - code span.co { color: #60a0b0; font-style: italic; } /* Comment */
198   - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
199   - code span.do { color: #ba2121; font-style: italic; } /* Documentation */
200   - code span.dt { color: #902000; } /* DataType */
201   - code span.dv { color: #40a070; } /* DecVal */
202   - code span.er { color: #ff0000; font-weight: bold; } /* Error */
203   - code span.ex { } /* Extension */
204   - code span.fl { color: #40a070; } /* Float */
205   - code span.fu { color: #06287e; } /* Function */
206   - code span.im { color: #008000; font-weight: bold; } /* Import */
207   - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
208   - code span.kw { color: #007020; font-weight: bold; } /* Keyword */
209   - code span.op { color: #666666; } /* Operator */
210   - code span.ot { color: #007020; } /* Other */
211   - code span.pp { color: #bc7a00; } /* Preprocessor */
212   - code span.sc { color: #4070a0; } /* SpecialChar */
213   - code span.ss { color: #bb6688; } /* SpecialString */
214   - code span.st { color: #4070a0; } /* String */
215   - code span.va { color: #19177c; } /* Variable */
216   - code span.vs { color: #4070a0; } /* VerbatimString */
217   - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
218   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 82 </head>
221 83 <body>
222 84 <h1 id="oleid">oleid</h1>
223   -<p>oleid is a script to analyze OLE files such as MS Office documents
224   -(e.g. Word, Excel), to detect specific characteristics usually found in
225   -malicious files (e.g. malware). For example it can detect VBA macros and
226   -embedded Flash objects.</p>
227   -<p>It is part of the <a
228   -href="http://www.decalage.info/python/oletools">python-oletools</a>
229   -package.</p>
  85 +<p>oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics usually found in malicious files (e.g. malware). For example it can detect VBA macros and embedded Flash objects.</p>
  86 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
230 87 <h2 id="main-features">Main Features</h2>
231 88 <ul>
232   -<li>Detect OLE file type from its internal structure (e.g. MS Word,
233   -Excel, PowerPoint, …)</li>
  89 +<li>Detect OLE file type from its internal structure (e.g. MS Word, Excel, PowerPoint, …)</li>
234 90 <li>Detect VBA Macros</li>
235 91 <li>Detect embedded Flash objects</li>
236 92 <li>Detect embedded OLE objects</li>
... ... @@ -245,8 +101,7 @@ Excel, PowerPoint, …)&lt;/li&gt;
245 101 <li>Generic VBA macros detection</li>
246 102 <li>Detect auto-executable VBA macros</li>
247 103 <li>Extended OLE file types detection</li>
248   -<li>Detect unusual OLE structures (fragmentation, unused sectors,
249   -etc)</li>
  104 +<li>Detect unusual OLE structures (fragmentation, unused sectors, etc)</li>
250 105 <li>Options to scan multiple files</li>
251 106 <li>Options to scan files from encrypted zip archives</li>
252 107 <li>CSV output</li>
... ... @@ -254,8 +109,7 @@ etc)&lt;/li&gt;
254 109 <h2 id="usage">Usage</h2>
255 110 <pre class="text"><code>oleid &lt;file&gt;</code></pre>
256 111 <h3 id="example">Example</h3>
257   -<p>Analyzing a Word document containing a Flash object and VBA
258   -macros:</p>
  112 +<p>Analyzing a Word document containing a Flash object and VBA macros:</p>
259 113 <pre class="text"><code>C:\oletools&gt;oleid word_flash_vba.doc
260 114  
261 115 Filename: word_flash_vba.doc
... ... @@ -274,45 +128,35 @@ Filename: word_flash_vba.doc
274 128 | ObjectPool | True |
275 129 | Flash objects | 1 |
276 130 +-------------------------------+-----------------------+</code></pre>
277   -<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid
278   -in your Python applications</h2>
279   -<p>First, import oletools.oleid, and create an <strong>OleID</strong>
280   -object to scan a file:</p>
281   -<div class="sourceCode" id="cb3"><pre
282   -class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">import</span> oletools.oleid</span>
283   -<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a></span>
284   -<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a>oid <span class="op">=</span> oletools.oleid.OleID(filename)</span></code></pre></div>
285   -<p>Note: filename can be a filename, a file-like object, or a bytes
286   -string containing the file to be analyzed.</p>
287   -<p>Second, call the <strong>check()</strong> method. It returns a list
288   -of <strong>Indicator</strong> objects.</p>
  131 +<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid in your Python applications</h2>
  132 +<p>First, import oletools.oleid, and create an <strong>OleID</strong> object to scan a file:</p>
  133 +<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">import</span> oletools.oleid</a>
  134 +<a class="sourceLine" id="cb3-2" data-line-number="2"></a>
  135 +<a class="sourceLine" id="cb3-3" data-line-number="3">oid <span class="op">=</span> oletools.oleid.OleID(filename)</a></code></pre></div>
  136 +<p>Note: filename can be a filename, a file-like object, or a bytes string containing the file to be analyzed.</p>
  137 +<p>Second, call the <strong>check()</strong> method. It returns a list of <strong>Indicator</strong> objects.</p>
289 138 <p>Each Indicator object has the following attributes:</p>
290 139 <ul>
291 140 <li><strong>id</strong>: str, identifier for the indicator</li>
292 141 <li><strong>name</strong>: str, name to display the indicator</li>
293   -<li><strong>description</strong>: str, long description of the
294   -indicator</li>
295   -<li><strong>type</strong>: class of the indicator (e.g. bool, str,
296   -int)</li>
  142 +<li><strong>description</strong>: str, long description of the indicator</li>
  143 +<li><strong>type</strong>: class of the indicator (e.g. bool, str, int)</li>
297 144 <li><strong>value</strong>: value of the indicator</li>
298 145 </ul>
299 146 <p>For example, the following code displays all the indicators:</p>
300   -<div class="sourceCode" id="cb4"><pre
301   -class="sourceCode python"><code class="sourceCode python"><span id="cb4-1"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a>indicators <span class="op">=</span> oid.check()</span>
302   -<span id="cb4-2"><a href="#cb4-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> i <span class="kw">in</span> indicators:</span>
303   -<span id="cb4-3"><a href="#cb4-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</span>
304   -<span id="cb4-4"><a href="#cb4-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</span>
305   -<span id="cb4-5"><a href="#cb4-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;&#39;</span></span></code></pre></div>
  147 +<div class="sourceCode" id="cb4"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb4-1" data-line-number="1">indicators <span class="op">=</span> oid.check()</a>
  148 +<a class="sourceLine" id="cb4-2" data-line-number="2"><span class="cf">for</span> i <span class="kw">in</span> indicators:</a>
  149 +<a class="sourceLine" id="cb4-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</a>
  150 +<a class="sourceLine" id="cb4-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</a>
  151 +<a class="sourceLine" id="cb4-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;&#39;</span></a></code></pre></div>
306 152 <p>See the source code of oleid.py for more details.</p>
307 153 <hr />
308   -<h2 id="python-oletools-documentation">python-oletools
309   -documentation</h2>
  154 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
310 155 <ul>
311 156 <li><a href="Home.html">Home</a></li>
312 157 <li><a href="License.html">License</a></li>
313 158 <li><a href="Install.html">Install</a></li>
314   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
315   -Report Issues</li>
  159 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
316 160 <li>Tools:
317 161 <ul>
318 162 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olemap.html
  View file @ab9a043
... ... @@ -4,166 +4,22 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="olemap">olemap</h1>
160   -<p>olemap is a script to display a map of all the sectors in an OLE
161   -file.</p>
162   -<p>It can be used either as a command-line tool, or as a python module
163   -from your own applications.</p>
164   -<p>It is part of the <a
165   -href="http://www.decalage.info/python/oletools">python-oletools</a>
166   -package.</p>
  20 +<p>olemap is a script to display a map of all the sectors in an OLE file.</p>
  21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
167 23 <h2 id="usage">Usage</h2>
168 24 <pre class="text"><code>Usage: olemap &lt;filename&gt;</code></pre>
169 25 <h3 id="examples">Examples</h3>
... ... @@ -172,18 +28,15 @@ package.&lt;/p&gt;
172 28 <p><img src="olemap1.png" /></p>
173 29 <p><img src="olemap2.png" /></p>
174 30 <hr />
175   -<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in
176   -Python applications</h2>
  31 +<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in Python applications</h2>
177 32 <p>TODO</p>
178 33 <hr />
179   -<h2 id="python-oletools-documentation">python-oletools
180   -documentation</h2>
  34 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
181 35 <ul>
182 36 <li><a href="Home.html">Home</a></li>
183 37 <li><a href="License.html">License</a></li>
184 38 <li><a href="Install.html">Install</a></li>
185   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
186   -Report Issues</li>
  39 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
187 40 <li>Tools:
188 41 <ul>
189 42 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olemeta.html
  View file @ab9a043
... ... @@ -4,181 +4,34 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="olemeta">olemeta</h1>
160   -<p>olemeta is a script to parse OLE files such as MS Office documents
161   -(e.g. Word, Excel), to extract all standard properties present in the
162   -OLE file.</p>
163   -<p>It is part of the <a
164   -href="http://www.decalage.info/python/oletools">python-oletools</a>
165   -package.</p>
  20 +<p>olemeta is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract all standard properties present in the OLE file.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 22 <h2 id="usage">Usage</h2>
167 23 <pre class="text"><code>olemeta &lt;file&gt;</code></pre>
168 24 <h3 id="example">Example</h3>
169 25 <p><img src="olemeta1.png" /></p>
170   -<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in
171   -Python applications</h2>
  26 +<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in Python applications</h2>
172 27 <p>TODO</p>
173 28 <hr />
174   -<h2 id="python-oletools-documentation">python-oletools
175   -documentation</h2>
  29 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
176 30 <ul>
177 31 <li><a href="Home.html">Home</a></li>
178 32 <li><a href="License.html">License</a></li>
179 33 <li><a href="Install.html">Install</a></li>
180   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
181   -Report Issues</li>
  34 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
182 35 <li>Tools:
183 36 <ul>
184 37 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oleobj.html
  View file @ab9a043
... ... @@ -4,181 +4,35 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="oleobj">oleobj</h1>
160 20 <p>oleobj is a script to extract embedded objects from OLE files.</p>
161   -<p>It can be used either as a command-line tool, or as a python module
162   -from your own applications.</p>
163   -<p>It is part of the <a
164   -href="http://www.decalage.info/python/oletools">python-oletools</a>
165   -package.</p>
  21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 23 <h2 id="usage">Usage</h2>
167 24 <pre class="text"><code>TODO</code></pre>
168 25 <hr />
169   -<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in
170   -Python applications</h2>
  26 +<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in Python applications</h2>
171 27 <p>See rtfobj.py source code.</p>
172 28 <p>TODO</p>
173 29 <hr />
174   -<h2 id="python-oletools-documentation">python-oletools
175   -documentation</h2>
  30 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
176 31 <ul>
177 32 <li><a href="Home.html">Home</a></li>
178 33 <li><a href="License.html">License</a></li>
179 34 <li><a href="Install.html">Install</a></li>
180   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
181   -Report Issues</li>
  35 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
182 36 <li>Tools:
183 37 <ul>
184 38 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/oletimes.html
  View file @ab9a043
... ... @@ -4,170 +4,25 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="oletimes">oletimes</h1>
160   -<p>oletimes is a script to parse OLE files such as MS Office documents
161   -(e.g. Word, Excel), to extract creation and modification times of all
162   -streams and storages in the OLE file.</p>
163   -<p>It is part of the <a
164   -href="http://www.decalage.info/python/oletools">python-oletools</a>
165   -package.</p>
  20 +<p>oletimes is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract creation and modification times of all streams and storages in the OLE file.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 22 <h2 id="usage">Usage</h2>
167 23 <pre class="text"><code>oletimes &lt;file&gt;</code></pre>
168 24 <h3 id="example">Example</h3>
169   -<p>Checking the malware sample <a
170   -href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  25 +<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
171 26 <pre class="text"><code>&gt;oletimes DIAN_caso-5415.doc
172 27  
173 28 +----------------------------+---------------------+---------------------+
... ... @@ -193,18 +48,15 @@ href=&quot;https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/&quot;&gt;D
193 48 | &#39;Macros/VBA/dir&#39; | None | None |
194 49 | &#39;WordDocument&#39; | None | None |
195 50 +----------------------------+---------------------+---------------------+</code></pre>
196   -<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes
197   -in Python applications</h2>
  51 +<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes in Python applications</h2>
198 52 <p>TODO</p>
199 53 <hr />
200   -<h2 id="python-oletools-documentation">python-oletools
201   -documentation</h2>
  54 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
202 55 <ul>
203 56 <li><a href="Home.html">Home</a></li>
204 57 <li><a href="License.html">License</a></li>
205 58 <li><a href="Install.html">Install</a></li>
206   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
207   -Report Issues</li>
  59 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
208 60 <li>Tools:
209 61 <ul>
210 62 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/olevba.html
  View file @ab9a043
... ... @@ -4,242 +4,88 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - pre > code.sourceCode { white-space: pre; position: relative; }
156   - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
157   - pre > code.sourceCode > span:empty { height: 1.2em; }
158   - .sourceCode { overflow: visible; }
159   - code.sourceCode > span { color: inherit; text-decoration: inherit; }
160   - div.sourceCode { margin: 1em 0; }
161   - pre.sourceCode { margin: 0; }
162   - @media screen {
163   - div.sourceCode { overflow: auto; }
164   - }
165   - @media print {
166   - pre > code.sourceCode { white-space: pre-wrap; }
167   - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
168   - }
169   - pre.numberSource code
170   - { counter-reset: source-line 0; }
171   - pre.numberSource code > span
172   - { position: relative; left: -4em; counter-increment: source-line; }
173   - pre.numberSource code > span > a:first-child::before
174   - { content: counter(source-line);
175   - position: relative; left: -1em; text-align: right; vertical-align: baseline;
176   - border: none; display: inline-block;
177   - -webkit-touch-callout: none; -webkit-user-select: none;
178   - -khtml-user-select: none; -moz-user-select: none;
179   - -ms-user-select: none; user-select: none;
180   - padding: 0 4px; width: 4em;
181   - color: #aaaaaa;
182   - }
183   - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
184   - div.sourceCode
185   - { }
186   - @media screen {
187   - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
188   - }
189   - code span.al { color: #ff0000; font-weight: bold; } /* Alert */
190   - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
191   - code span.at { color: #7d9029; } /* Attribute */
192   - code span.bn { color: #40a070; } /* BaseN */
193   - code span.bu { color: #008000; } /* BuiltIn */
194   - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
195   - code span.ch { color: #4070a0; } /* Char */
196   - code span.cn { color: #880000; } /* Constant */
197   - code span.co { color: #60a0b0; font-style: italic; } /* Comment */
198   - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
199   - code span.do { color: #ba2121; font-style: italic; } /* Documentation */
200   - code span.dt { color: #902000; } /* DataType */
201   - code span.dv { color: #40a070; } /* DecVal */
202   - code span.er { color: #ff0000; font-weight: bold; } /* Error */
203   - code span.ex { } /* Extension */
204   - code span.fl { color: #40a070; } /* Float */
205   - code span.fu { color: #06287e; } /* Function */
206   - code span.im { color: #008000; font-weight: bold; } /* Import */
207   - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
208   - code span.kw { color: #007020; font-weight: bold; } /* Keyword */
209   - code span.op { color: #666666; } /* Operator */
210   - code span.ot { color: #007020; } /* Other */
211   - code span.pp { color: #bc7a00; } /* Preprocessor */
212   - code span.sc { color: #4070a0; } /* SpecialChar */
213   - code span.ss { color: #bb6688; } /* SpecialString */
214   - code span.st { color: #4070a0; } /* String */
215   - code span.va { color: #19177c; } /* Variable */
216   - code span.vs { color: #4070a0; } /* VerbatimString */
217   - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
218   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 82 </head>
221 83 <body>
222 84 <h1 id="olevba">olevba</h1>
223   -<p>olevba is a script to parse OLE and OpenXML files such as MS Office
224   -documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>,
225   -extract their <strong>source code</strong> in clear text, and detect
226   -security-related patterns such as <strong>auto-executable
227   -macros</strong>, <strong>suspicious VBA keywords</strong> used by
228   -malware, anti-sandboxing and anti-virtualization techniques, and
229   -potential <strong>IOCs</strong> (IP addresses, URLs, executable
230   -filenames, etc). It also detects and decodes several common
231   -<strong>obfuscation methods including Hex encoding, StrReverse, Base64,
232   -Dridex, VBA expressions</strong>, and extracts IOCs from decoded
233   -strings. XLM/Excel 4 Macros are also supported in Excel and SLK
234   -files.</p>
235   -<p>It can be used either as a command-line tool, or as a python module
236   -from your own applications.</p>
237   -<p>It is part of the <a
238   -href="http://www.decalage.info/python/oletools">python-oletools</a>
239   -package.</p>
240   -<p>olevba is based on source code from <a
241   -href="https://github.com/unixfreak0037/officeparser">officeparser</a> by
242   -John William Davison, with significant modifications.</p>
  85 +<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text, and detect security-related patterns such as <strong>auto-executable macros</strong>, <strong>suspicious VBA keywords</strong> used by malware, anti-sandboxing and anti-virtualization techniques, and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common <strong>obfuscation methods including Hex encoding, StrReverse, Base64, Dridex, VBA expressions</strong>, and extracts IOCs from decoded strings. XLM/Excel 4 Macros are also supported in Excel and SLK files.</p>
  86 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  87 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  88 +<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison, with significant modifications.</p>
243 89 <h2 id="supported-formats">Supported formats</h2>
244 90 <ul>
245 91 <li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li>
... ... @@ -255,50 +101,31 @@ John William Davison, with significant modifications.&lt;/p&gt;
255 101 </ul>
256 102 <p>S## Main Features</p>
257 103 <ul>
258   -<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML,
259   -MHT</li>
  104 +<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML, MHT</li>
260 105 <li>Extract VBA macro source code</li>
261 106 <li>Detect auto-executable macros</li>
262 107 <li>Detect suspicious VBA keywords often used by malware</li>
263 108 <li>Detect anti-sandboxing and anti-virtualization techniques</li>
264   -<li>Detect and decodes strings obfuscated with
265   -Hex/Base64/StrReverse/Dridex</li>
266   -<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val,
267   -StrReverse, Environ, +, &amp;, using a VBA parser built with <a
268   -href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom
269   -Hex and Base64 encodings</li>
270   -<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail
271   -addresses and executable file names</li>
272   -<li>Scan multiple files and sample collections (wildcards,
273   -recursive)</li>
  109 +<li>Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex</li>
  110 +<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val, StrReverse, Environ, +, &amp;, using a VBA parser built with <a href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom Hex and Base64 encodings</li>
  111 +<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</li>
  112 +<li>Scan multiple files and sample collections (wildcards, recursive)</li>
274 113 <li>Triage mode for a summary view of multiple files</li>
275 114 <li>Scan malware samples in password-protected Zip archives</li>
276 115 <li>Python API to use olevba from your applications</li>
277 116 </ul>
278   -<p>MS Office files encrypted with a password are also supported, because
279   -VBA macro code is never encrypted, only the content of the document.</p>
  117 +<p>MS Office files encrypted with a password are also supported, because VBA macro code is never encrypted, only the content of the document.</p>
280 118 <h2 id="about-vba-macros">About VBA Macros</h2>
281   -<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a>
282   -for more information and technical details about VBA Macros and how they
283   -are stored in MS Office documents.</p>
  119 +<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros and how they are stored in MS Office documents.</p>
284 120 <h2 id="how-it-works">How it works</h2>
285 121 <ol type="1">
286   -<li>olevba checks the file type: If it is an OLE file (i.e MS Office
287   -97-2003), it is parsed right away.</li>
288   -<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba
289   -looks for all OLE files stored in it (e.g. vbaProject.bin,
290   -editdata.mso), and opens them.</li>
291   -<li>olevba identifies all the VBA projects stored in the OLE
292   -structure.</li>
293   -<li>Each VBA project is parsed to find the corresponding OLE streams
294   -containing macro code.</li>
295   -<li>In each of these OLE streams, the VBA macro source code is extracted
296   -and decompressed (RLE compression).</li>
297   -<li>olevba looks for specific strings obfuscated with various algorithms
298   -(Hex, Base64, StrReverse, Dridex, VBA expressions).</li>
299   -<li>olevba scans the macro source code and the deobfuscated strings to
300   -find suspicious keywords, auto-executable macros and potential IOCs
301   -(URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>
  122 +<li>olevba checks the file type: If it is an OLE file (i.e MS Office 97-2003), it is parsed right away.</li>
  123 +<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba looks for all OLE files stored in it (e.g. vbaProject.bin, editdata.mso), and opens them.</li>
  124 +<li>olevba identifies all the VBA projects stored in the OLE structure.</li>
  125 +<li>Each VBA project is parsed to find the corresponding OLE streams containing macro code.</li>
  126 +<li>In each of these OLE streams, the VBA macro source code is extracted and decompressed (RLE compression).</li>
  127 +<li>olevba looks for specific strings obfuscated with various algorithms (Hex, Base64, StrReverse, Dridex, VBA expressions).</li>
  128 +<li>olevba scans the macro source code and the deobfuscated strings to find suspicious keywords, auto-executable macros and potential IOCs (URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>
302 129 </ol>
303 130 <h2 id="usage">Usage</h2>
304 131 <pre class="text"><code>Usage: olevba [options] &lt;filename&gt; [filename2 ...]
... ... @@ -337,37 +164,28 @@ Options:
337 164 -d, --detailed detailed mode, display full results (default for
338 165 single file)
339 166 -j, --json json mode, detailed in json format (never default)</code></pre>
340   -<p><strong>New in v0.54:</strong> the -p option can now be used to
341   -decrypt encrypted documents using the provided password(s).</p>
  167 +<p><strong>New in v0.54:</strong> the -p option can now be used to decrypt encrypted documents using the provided password(s).</p>
342 168 <h3 id="examples">Examples</h3>
343 169 <p>Scan a single file:</p>
344 170 <pre class="text"><code>olevba file.doc</code></pre>
345   -<p>Scan a single file, stored in a Zip archive with password
346   -“infected”:</p>
  171 +<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
347 172 <pre class="text"><code>olevba malicious_file.xls.zip -z infected</code></pre>
348 173 <p>Scan a single file, showing all obfuscated strings decoded:</p>
349 174 <pre class="text"><code>olevba file.doc --decode</code></pre>
350   -<p>Scan a single file, showing the macro source code with VBA strings
351   -deobfuscated:</p>
  175 +<p>Scan a single file, showing the macro source code with VBA strings deobfuscated:</p>
352 176 <pre class="text"><code>olevba file.doc --reveal</code></pre>
353 177 <p>Scan VBA source code extracted into a text file:</p>
354 178 <pre class="text"><code>olevba source_code.vba</code></pre>
355 179 <p>Scan a collection of files stored in a folder:</p>
356 180 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*&quot;</code></pre>
357   -<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add
358   -double quotes around wildcards. Otherwise, they will be expanded by the
359   -shell instead of olevba.</p>
  181 +<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add double quotes around wildcards. Otherwise, they will be expanded by the shell instead of olevba.</p>
360 182 <p>Scan all .doc and .xls files, recursively in all subfolders:</p>
361 183 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.doc&quot; &quot;MalwareZoo/VBA/*.xls&quot; -r</code></pre>
362   -<p>Scan all .doc files within all .zip files with password,
363   -recursively:</p>
  184 +<p>Scan all .doc files within all .zip files with password, recursively:</p>
364 185 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.zip&quot; -r -z infected -f &quot;*.doc&quot;</code></pre>
365   -<h3 id="detailed-analysis-mode-default-for-single-file">Detailed
366   -analysis mode (default for single file)</h3>
367   -<p>When a single file is scanned, or when using the option -d, all
368   -details of the analysis are displayed.</p>
369   -<p>For example, checking the malware sample <a
370   -href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  186 +<h3 id="detailed-analysis-mode-default-for-single-file">Detailed analysis mode (default for single file)</h3>
  187 +<p>When a single file is scanned, or when using the option -d, all details of the analysis are displayed.</p>
  188 +<p>For example, checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
371 189 <pre class="text"><code>&gt;olevba c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected
372 190 ===============================================================================
373 191 FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip
... ... @@ -419,32 +237,23 @@ ANALYSIS:
419 237 | IOC | test.exe | Executable file name |
420 238 | IOC | sfjozjero.exe | Executable file name |
421 239 +------------+----------------------+-----------------------------------------+</code></pre>
422   -<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for
423   -multiple files)</h3>
424   -<p>When several files are scanned, or when using the option -t, a
425   -summary of the analysis for each file is displayed. This is more
426   -convenient for quick triage of a collection of suspicious files.</p>
  240 +<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for multiple files)</h3>
  241 +<p>When several files are scanned, or when using the option -t, a summary of the analysis for each file is displayed. This is more convenient for quick triage of a collection of suspicious files.</p>
427 242 <p>The following flags show the results of the analysis:</p>
428 243 <ul>
429   -<li><strong>OLE</strong>: the file type is OLE, for example MS Office
430   -97-2003</li>
431   -<li><strong>OpX</strong>: the file type is OpenXML, for example MS
432   -Office 2007+</li>
  244 +<li><strong>OLE</strong>: the file type is OLE, for example MS Office 97-2003</li>
  245 +<li><strong>OpX</strong>: the file type is OpenXML, for example MS Office 2007+</li>
433 246 <li><strong>XML</strong>: the file type is Word 2003 XML</li>
434   -<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File
435   -Web Page (.mht)</li>
  247 +<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File Web Page (.mht)</li>
436 248 <li><strong>?</strong>: the file type is not supported</li>
437 249 <li><strong>M</strong>: contains VBA Macros</li>
438 250 <li><strong>A</strong>: auto-executable macros</li>
439 251 <li><strong>S</strong>: suspicious VBA keywords</li>
440 252 <li><strong>I</strong>: potential IOCs</li>
441 253 <li><strong>H</strong>: hex-encoded strings (potential obfuscation)</li>
442   -<li><strong>B</strong>: Base64-encoded strings (potential
443   -obfuscation)</li>
444   -<li><strong>D</strong>: Dridex-encoded strings (potential
445   -obfuscation)</li>
446   -<li><strong>V</strong>: VBA string expressions (potential
447   -obfuscation)</li>
  254 +<li><strong>B</strong>: Base64-encoded strings (potential obfuscation)</li>
  255 +<li><strong>D</strong>: Dridex-encoded strings (potential obfuscation)</li>
  256 +<li><strong>V</strong>: VBA string expressions (potential obfuscation)</li>
448 257 </ul>
449 258 <p>Here is an example:</p>
450 259 <pre class="text"><code>c:\&gt;olevba \MalwareZoo\VBA\samples\*
... ... @@ -467,253 +276,146 @@ OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware
467 276 OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware
468 277 OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre>
469 278 <h2 id="python-3-support---olevba3">Python 3 support - olevba3</h2>
470   -<p>Since v0.54, olevba is fully compatible with both Python 2 and 3.
471   -There is no need to use olevba3 anymore, however it is still present for
472   -backward compatibility.</p>
  279 +<p>Since v0.54, olevba is fully compatible with both Python 2 and 3. There is no need to use olevba3 anymore, however it is still present for backward compatibility.</p>
473 280 <hr />
474   -<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in
475   -Python applications</h2>
476   -<p>olevba may be used to open a MS Office file, detect if it contains
477   -VBA macros, extract and analyze the VBA source code from your own python
478   -applications.</p>
479   -<p>IMPORTANT: olevba is currently under active development, therefore
480   -this API is likely to change.</p>
  281 +<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2>
  282 +<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code from your own python applications.</p>
  283 +<p>IMPORTANT: olevba is currently under active development, therefore this API is likely to change.</p>
481 284 <h3 id="import-olevba">Import olevba</h3>
482   -<p>First, import the <strong>oletools.olevba</strong> package, using at
483   -least the VBA_Parser and VBA_Scanner classes:</p>
484   -<div class="sourceCode" id="cb12"><pre
485   -class="sourceCode python"><code class="sourceCode python"><span id="cb12-1"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</span></code></pre></div>
486   -<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file -
487   -VBA_Parser</h3>
488   -<p>To parse a file on disk, create an instance of the
489   -<strong>VBA_Parser</strong> class, providing the name of the file to
490   -open as parameter. For example:</p>
491   -<div class="sourceCode" id="cb13"><pre
492   -class="sourceCode python"><code class="sourceCode python"><span id="cb13-1"><a href="#cb13-1" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</span></code></pre></div>
493   -<p>The file may also be provided as a bytes string containing its data.
494   -In that case, the actual filename must be provided for reference, and
495   -the file content with the data parameter. For example:</p>
496   -<div class="sourceCode" id="cb14"><pre
497   -class="sourceCode python"><code class="sourceCode python"><span id="cb14-1"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a>myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></span>
498   -<span id="cb14-2"><a href="#cb14-2" aria-hidden="true" tabindex="-1"></a>filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</span>
499   -<span id="cb14-3"><a href="#cb14-3" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</span></code></pre></div>
500   -<p>VBA_Parser will raise an exception if the file is not a supported
501   -format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+),
502   -MHTML or Word 2003 XML.</p>
503   -<p>After parsing the file, the attribute
504   -<strong>VBA_Parser.type</strong> is a string indicating the file type.
505   -It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or
506   -TYPE_MHTML. (constants defined in the olevba module)</p>
  285 +<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser and VBA_Scanner classes:</p>
  286 +<div class="sourceCode" id="cb12"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb12-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</a></code></pre></div>
  287 +<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file - VBA_Parser</h3>
  288 +<p>To parse a file on disk, create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter. For example:</p>
  289 +<div class="sourceCode" id="cb13"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb13-1" data-line-number="1">vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</a></code></pre></div>
  290 +<p>The file may also be provided as a bytes string containing its data. In that case, the actual filename must be provided for reference, and the file content with the data parameter. For example:</p>
  291 +<div class="sourceCode" id="cb14"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb14-1" data-line-number="1">myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></a>
  292 +<a class="sourceLine" id="cb14-2" data-line-number="2">filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</a>
  293 +<a class="sourceLine" id="cb14-3" data-line-number="3">vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</a></code></pre></div>
  294 +<p>VBA_Parser will raise an exception if the file is not a supported format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+), MHTML or Word 2003 XML.</p>
  295 +<p>After parsing the file, the attribute <strong>VBA_Parser.type</strong> is a string indicating the file type. It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or TYPE_MHTML. (constants defined in the olevba module)</p>
507 296 <h3 id="detect-vba-macros">Detect VBA macros</h3>
508   -<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object
509   -returns True if VBA macros have been found in the file, False
510   -otherwise.</p>
511   -<div class="sourceCode" id="cb15"><pre
512   -class="sourceCode python"><code class="sourceCode python"><span id="cb15-1"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> vbaparser.detect_vba_macros():</span>
513   -<span id="cb15-2"><a href="#cb15-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></span>
514   -<span id="cb15-3"><a href="#cb15-3" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
515   -<span id="cb15-4"><a href="#cb15-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></span></code></pre></div>
516   -<p>Note: The detection algorithm looks for streams and storage with
517   -specific names in the OLE structure, which works fine for all the
518   -supported formats listed above. However, for some formats such as
519   -PowerPoint 97-2003, this method will always return False because VBA
520   -Macros are stored in a different way which is not yet supported by
521   -olevba.</p>
522   -<p>Moreover, if the file contains an embedded document (e.g. an Excel
523   -workbook inserted into a Word document), this method may return True if
524   -the embedded document contains VBA Macros, even if the main document
525   -does not.</p>
526   -<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source
527   -Code</h3>
528   -<p>The method <strong>extract_macros</strong> extracts and decompresses
529   -source code for each VBA macro found in the file (possibly including
530   -embedded files). It is a generator yielding a tuple (filename,
531   -stream_path, vba_filename, vba_code) for each VBA macro found.</p>
  297 +<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object returns True if VBA macros have been found in the file, False otherwise.</p>
  298 +<div class="sourceCode" id="cb15"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb15-1" data-line-number="1"><span class="cf">if</span> vbaparser.detect_vba_macros():</a>
  299 +<a class="sourceLine" id="cb15-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></a>
  300 +<a class="sourceLine" id="cb15-3" data-line-number="3"><span class="cf">else</span>:</a>
  301 +<a class="sourceLine" id="cb15-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></a></code></pre></div>
  302 +<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will always return False because VBA Macros are stored in a different way which is not yet supported by olevba.</p>
  303 +<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method may return True if the embedded document contains VBA Macros, even if the main document does not.</p>
  304 +<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3>
  305 +<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) for each VBA macro found.</p>
532 306 <ul>
533   -<li>filename: If the file is OLE (MS Office 97-2003), filename is the
534   -path of the file. If the file is OpenXML (MS Office 2007+), filename is
535   -the path of the OLE subfile containing VBA macros within the zip
536   -archive, e.g. word/vbaProject.bin.</li>
537   -<li>stream_path: path of the OLE stream containing the VBA macro source
538   -code</li>
  307 +<li>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin.</li>
  308 +<li>stream_path: path of the OLE stream containing the VBA macro source code</li>
539 309 <li>vba_filename: corresponding VBA filename</li>
540 310 <li>vba_code: string containing the VBA source code in clear text</li>
541 311 </ul>
542 312 <p>Example:</p>
543   -<div class="sourceCode" id="cb16"><pre
544   -class="sourceCode python"><code class="sourceCode python"><span id="cb16-1"><a href="#cb16-1" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</span>
545   -<span id="cb16-2"><a href="#cb16-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></span>
546   -<span id="cb16-3"><a href="#cb16-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</span>
547   -<span id="cb16-4"><a href="#cb16-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</span>
548   -<span id="cb16-5"><a href="#cb16-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</span>
549   -<span id="cb16-6"><a href="#cb16-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></span>
550   -<span id="cb16-7"><a href="#cb16-7" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> vba_code</span></code></pre></div>
551   -<p>Alternatively, the VBA_Parser method
552   -<strong>extract_all_macros</strong> returns the same results as a list
553   -of tuples.</p>
  313 +<div class="sourceCode" id="cb16"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb16-1" data-line-number="1"><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</a>
  314 +<a class="sourceLine" id="cb16-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></a>
  315 +<a class="sourceLine" id="cb16-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</a>
  316 +<a class="sourceLine" id="cb16-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</a>
  317 +<a class="sourceLine" id="cb16-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</a>
  318 +<a class="sourceLine" id="cb16-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></a>
  319 +<a class="sourceLine" id="cb16-7" data-line-number="7"> <span class="bu">print</span> vba_code</a></code></pre></div>
  320 +<p>Alternatively, the VBA_Parser method <strong>extract_all_macros</strong> returns the same results as a list of tuples.</p>
554 321 <h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3>
555   -<p>Since version 0.40, the VBA_Parser class provides simpler methods
556   -than VBA_Scanner to analyze all macros contained in a file:</p>
557   -<p>The method <strong>analyze_macros</strong> from the class
558   -<strong>VBA_Parser</strong> can be used to scan the source code of all
559   -VBA modules to find obfuscated strings, suspicious keywords, IOCs,
560   -auto-executable macros, etc.</p>
561   -<p>analyze_macros() takes an optional argument show_decoded_strings: if
562   -set to True, the results will contain all the encoded strings found in
563   -the code (Hex, Base64, Dridex) with their decoded value. By default, it
564   -will only include the strings which contain printable characters.</p>
565   -<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples
566   -(type, keyword, description), one for each item in the results.</p>
  322 +<p>Since version 0.40, the VBA_Parser class provides simpler methods than VBA_Scanner to analyze all macros contained in a file:</p>
  323 +<p>The method <strong>analyze_macros</strong> from the class <strong>VBA_Parser</strong> can be used to scan the source code of all VBA modules to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
  324 +<p>analyze_macros() takes an optional argument show_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value. By default, it will only include the strings which contain printable characters.</p>
  325 +<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
567 326 <ul>
568   -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,
569   -‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>
570   -<li>keyword is the string found for auto-executable macros, suspicious
571   -keywords or IOCs. For obfuscated strings, it is the decoded value of the
572   -string.</li>
573   -<li>description provides a description of the keyword. For obfuscated
574   -strings, it is the encoded value of the string.</li>
  327 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>
  328 +<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
  329 +<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
575 330 </ul>
576 331 <p>Example:</p>
577   -<div class="sourceCode" id="cb17"><pre
578   -class="sourceCode python"><code class="sourceCode python"><span id="cb17-1"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vbaparser.analyze_macros()</span>
579   -<span id="cb17-2"><a href="#cb17-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
580   -<span id="cb17-3"><a href="#cb17-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
581   -<p>After calling analyze_macros, the following VBA_Parser attributes
582   -also provide the number of items found for each category:</p>
583   -<div class="sourceCode" id="cb18"><pre
584   -class="sourceCode python"><code class="sourceCode python"><span id="cb18-1"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</span>
585   -<span id="cb18-2"><a href="#cb18-2" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</span>
586   -<span id="cb18-3"><a href="#cb18-3" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</span>
587   -<span id="cb18-4"><a href="#cb18-4" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</span>
588   -<span id="cb18-5"><a href="#cb18-5" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</span>
589   -<span id="cb18-6"><a href="#cb18-6" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</span>
590   -<span id="cb18-7"><a href="#cb18-7" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</span></code></pre></div>
591   -<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source
592   -Code</h3>
593   -<p>The method <strong>reveal</strong> attempts to deobfuscate the macro
594   -source code by replacing all the obfuscated strings by their decoded
595   -content. Returns a single string.</p>
  332 +<div class="sourceCode" id="cb17"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb17-1" data-line-number="1">results <span class="op">=</span> vbaparser.analyze_macros()</a>
  333 +<a class="sourceLine" id="cb17-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  334 +<a class="sourceLine" id="cb17-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  335 +<p>After calling analyze_macros, the following VBA_Parser attributes also provide the number of items found for each category:</p>
  336 +<div class="sourceCode" id="cb18"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb18-1" data-line-number="1"><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</a>
  337 +<a class="sourceLine" id="cb18-2" data-line-number="2"><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</a>
  338 +<a class="sourceLine" id="cb18-3" data-line-number="3"><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</a>
  339 +<a class="sourceLine" id="cb18-4" data-line-number="4"><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</a>
  340 +<a class="sourceLine" id="cb18-5" data-line-number="5"><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</a>
  341 +<a class="sourceLine" id="cb18-6" data-line-number="6"><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</a>
  342 +<a class="sourceLine" id="cb18-7" data-line-number="7"><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</a></code></pre></div>
  343 +<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source Code</h3>
  344 +<p>The method <strong>reveal</strong> attempts to deobfuscate the macro source code by replacing all the obfuscated strings by their decoded content. Returns a single string.</p>
596 345 <p>Example:</p>
597   -<div class="sourceCode" id="cb19"><pre
598   -class="sourceCode python"><code class="sourceCode python"><span id="cb19-1"><a href="#cb19-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> vbaparser.reveal()</span></code></pre></div>
  346 +<div class="sourceCode" id="cb19"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb19-1" data-line-number="1"><span class="bu">print</span> vbaparser.reveal()</a></code></pre></div>
599 347 <h3 id="close-the-vba_parser">Close the VBA_Parser</h3>
600   -<p>After usage, it is better to call the <strong>close</strong> method
601   -of the VBA_Parser object, to make sure the file is closed, especially if
602   -your application is parsing many files.</p>
603   -<div class="sourceCode" id="cb20"><pre
604   -class="sourceCode python"><code class="sourceCode python"><span id="cb20-1"><a href="#cb20-1" aria-hidden="true" tabindex="-1"></a>vbaparser.close()</span></code></pre></div>
  348 +<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed, especially if your application is parsing many files.</p>
  349 +<div class="sourceCode" id="cb20"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb20-1" data-line-number="1">vbaparser.close()</a></code></pre></div>
605 350 <hr />
606 351 <h2 id="deprecated-api">Deprecated API</h2>
607   -<p>The following methods and functions are still functional, but their
608   -usage is not recommended since they have been replaced by better
609   -solutions.</p>
  352 +<p>The following methods and functions are still functional, but their usage is not recommended since they have been replaced by better solutions.</p>
610 353 <h3 id="vba_scanner-deprecated">VBA_Scanner (deprecated)</h3>
611   -<p>The class <strong>VBA_Scanner</strong> can be used to scan the source
612   -code of a VBA module to find obfuscated strings, suspicious keywords,
613   -IOCs, auto-executable macros, etc.</p>
614   -<p>First, create a VBA_Scanner object with a string containing the VBA
615   -source code (for example returned by the extract_macros method). Then
616   -call the methods <strong>scan</strong> or <strong>scan_summary</strong>
617   -to get the results of the analysis.</p>
618   -<p>scan() takes an optional argument include_decoded_strings: if set to
619   -True, the results will contain all the encoded strings found in the code
620   -(Hex, Base64, Dridex) with their decoded value.</p>
621   -<p><strong>scan</strong> returns a list of tuples (type, keyword,
622   -description), one for each item in the results.</p>
  354 +<p>The class <strong>VBA_Scanner</strong> can be used to scan the source code of a VBA module to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
  355 +<p>First, create a VBA_Scanner object with a string containing the VBA source code (for example returned by the extract_macros method). Then call the methods <strong>scan</strong> or <strong>scan_summary</strong> to get the results of the analysis.</p>
  356 +<p>scan() takes an optional argument include_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value.</p>
  357 +<p><strong>scan</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
623 358 <ul>
624   -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,
625   -‘Base64 String’ or ‘Dridex String’.</li>
626   -<li>keyword is the string found for auto-executable macros, suspicious
627   -keywords or IOCs. For obfuscated strings, it is the decoded value of the
628   -string.</li>
629   -<li>description provides a description of the keyword. For obfuscated
630   -strings, it is the encoded value of the string.</li>
  359 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’ or ‘Dridex String’.</li>
  360 +<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
  361 +<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
631 362 </ul>
632 363 <p>Example:</p>
633   -<div class="sourceCode" id="cb21"><pre
634   -class="sourceCode python"><code class="sourceCode python"><span id="cb21-1"><a href="#cb21-1" aria-hidden="true" tabindex="-1"></a>vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</span>
635   -<span id="cb21-2"><a href="#cb21-2" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>
636   -<span id="cb21-3"><a href="#cb21-3" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
637   -<span id="cb21-4"><a href="#cb21-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
638   -<p>The function <strong>scan_vba</strong> is a shortcut for
639   -VBA_Scanner(vba_code).scan():</p>
640   -<div class="sourceCode" id="cb22"><pre
641   -class="sourceCode python"><code class="sourceCode python"><span id="cb22-1"><a href="#cb22-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>
642   -<span id="cb22-2"><a href="#cb22-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>
643   -<span id="cb22-3"><a href="#cb22-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>
644   -<p><strong>scan_summary</strong> returns a tuple with the number of
645   -items found for each category: (autoexec, suspicious, IOCs, hex, base64,
646   -dridex).</p>
647   -<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable
648   -macros (deprecated)</h3>
649   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
650   -or VBA_Scanner to get all results at once.</p>
651   -<p>The function <strong>detect_autoexec</strong> checks if VBA macro
652   -code contains specific macro names that will be triggered when the
653   -document/workbook is opened, closed, changed, etc.</p>
654   -<p>It returns a list of tuples containing two strings, the detected
655   -keyword, and the description of the trigger. (See the malware example
656   -above)</p>
  364 +<div class="sourceCode" id="cb21"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb21-1" data-line-number="1">vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</a>
  365 +<a class="sourceLine" id="cb21-2" data-line-number="2">results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
  366 +<a class="sourceLine" id="cb21-3" data-line-number="3"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  367 +<a class="sourceLine" id="cb21-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  368 +<p>The function <strong>scan_vba</strong> is a shortcut for VBA_Scanner(vba_code).scan():</p>
  369 +<div class="sourceCode" id="cb22"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb22-1" data-line-number="1">results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
  370 +<a class="sourceLine" id="cb22-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  371 +<a class="sourceLine" id="cb22-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  372 +<p><strong>scan_summary</strong> returns a tuple with the number of items found for each category: (autoexec, suspicious, IOCs, hex, base64, dridex).</p>
  373 +<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable macros (deprecated)</h3>
  374 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  375 +<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names that will be triggered when the document/workbook is opened, closed, changed, etc.</p>
  376 +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the trigger. (See the malware example above)</p>
657 377 <p>Sample usage:</p>
658   -<div class="sourceCode" id="cb23"><pre
659   -class="sourceCode python"><code class="sourceCode python"><span id="cb23-1"><a href="#cb23-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</span>
660   -<span id="cb23-2"><a href="#cb23-2" aria-hidden="true" tabindex="-1"></a>autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</span>
661   -<span id="cb23-3"><a href="#cb23-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> autoexec_keywords:</span>
662   -<span id="cb23-4"><a href="#cb23-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></span>
663   -<span id="cb23-5"><a href="#cb23-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</span>
664   -<span id="cb23-6"><a href="#cb23-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>
665   -<span id="cb23-7"><a href="#cb23-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
666   -<span id="cb23-8"><a href="#cb23-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></span></code></pre></div>
667   -<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA
668   -keywords (deprecated)</h3>
669   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
670   -or VBA_Scanner to get all results at once.</p>
671   -<p>The function <strong>detect_suspicious</strong> checks if VBA macro
672   -code contains specific keywords often used by malware to act on the
673   -system (create files, run commands or applications, write to the
674   -registry, etc).</p>
675   -<p>It returns a list of tuples containing two strings, the detected
676   -keyword, and the description of the corresponding malicious behaviour.
677   -(See the malware example above)</p>
  378 +<div class="sourceCode" id="cb23"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb23-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</a>
  379 +<a class="sourceLine" id="cb23-2" data-line-number="2">autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</a>
  380 +<a class="sourceLine" id="cb23-3" data-line-number="3"><span class="cf">if</span> autoexec_keywords:</a>
  381 +<a class="sourceLine" id="cb23-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></a>
  382 +<a class="sourceLine" id="cb23-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</a>
  383 +<a class="sourceLine" id="cb23-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
  384 +<a class="sourceLine" id="cb23-7" data-line-number="7"><span class="cf">else</span>:</a>
  385 +<a class="sourceLine" id="cb23-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></a></code></pre></div>
  386 +<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA keywords (deprecated)</h3>
  387 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  388 +<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific keywords often used by malware to act on the system (create files, run commands or applications, write to the registry, etc).</p>
  389 +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the corresponding malicious behaviour. (See the malware example above)</p>
678 390 <p>Sample usage:</p>
679   -<div class="sourceCode" id="cb24"><pre
680   -class="sourceCode python"><code class="sourceCode python"><span id="cb24-1"><a href="#cb24-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</span>
681   -<span id="cb24-2"><a href="#cb24-2" aria-hidden="true" tabindex="-1"></a>suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</span>
682   -<span id="cb24-3"><a href="#cb24-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> suspicious_keywords:</span>
683   -<span id="cb24-4"><a href="#cb24-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></span>
684   -<span id="cb24-5"><a href="#cb24-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</span>
685   -<span id="cb24-6"><a href="#cb24-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>
686   -<span id="cb24-7"><a href="#cb24-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
687   -<span id="cb24-8"><a href="#cb24-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></span></code></pre></div>
688   -<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs
689   -(deprecated)</h3>
690   -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba
691   -or VBA_Scanner to get all results at once.</p>
692   -<p>The function <strong>detect_patterns</strong> checks if VBA macro
693   -code contains specific patterns of interest, that may be useful for
694   -malware analysis and detection (potential Indicators of Compromise): IP
695   -addresses, e-mail addresses, URLs, executable file names.</p>
696   -<p>It returns a list of tuples containing two strings, the pattern type,
697   -and the extracted value. (See the malware example above)</p>
  391 +<div class="sourceCode" id="cb24"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb24-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</a>
  392 +<a class="sourceLine" id="cb24-2" data-line-number="2">suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</a>
  393 +<a class="sourceLine" id="cb24-3" data-line-number="3"><span class="cf">if</span> suspicious_keywords:</a>
  394 +<a class="sourceLine" id="cb24-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></a>
  395 +<a class="sourceLine" id="cb24-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</a>
  396 +<a class="sourceLine" id="cb24-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
  397 +<a class="sourceLine" id="cb24-7" data-line-number="7"><span class="cf">else</span>:</a>
  398 +<a class="sourceLine" id="cb24-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></a></code></pre></div>
  399 +<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs (deprecated)</h3>
  400 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  401 +<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific patterns of interest, that may be useful for malware analysis and detection (potential Indicators of Compromise): IP addresses, e-mail addresses, URLs, executable file names.</p>
  402 +<p>It returns a list of tuples containing two strings, the pattern type, and the extracted value. (See the malware example above)</p>
698 403 <p>Sample usage:</p>
699   -<div class="sourceCode" id="cb25"><pre
700   -class="sourceCode python"><code class="sourceCode python"><span id="cb25-1"><a href="#cb25-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</span>
701   -<span id="cb25-2"><a href="#cb25-2" aria-hidden="true" tabindex="-1"></a>patterns <span class="op">=</span> detect_patterns(vba_code)</span>
702   -<span id="cb25-3"><a href="#cb25-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> patterns:</span>
703   -<span id="cb25-4"><a href="#cb25-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></span>
704   -<span id="cb25-5"><a href="#cb25-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</span>
705   -<span id="cb25-6"><a href="#cb25-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</span>
706   -<span id="cb25-7"><a href="#cb25-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
707   -<span id="cb25-8"><a href="#cb25-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></span></code></pre></div>
  404 +<div class="sourceCode" id="cb25"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb25-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</a>
  405 +<a class="sourceLine" id="cb25-2" data-line-number="2">patterns <span class="op">=</span> detect_patterns(vba_code)</a>
  406 +<a class="sourceLine" id="cb25-3" data-line-number="3"><span class="cf">if</span> patterns:</a>
  407 +<a class="sourceLine" id="cb25-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></a>
  408 +<a class="sourceLine" id="cb25-5" data-line-number="5"> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</a>
  409 +<a class="sourceLine" id="cb25-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</a>
  410 +<a class="sourceLine" id="cb25-7" data-line-number="7"><span class="cf">else</span>:</a>
  411 +<a class="sourceLine" id="cb25-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></a></code></pre></div>
708 412 <hr />
709   -<h2 id="python-oletools-documentation">python-oletools
710   -documentation</h2>
  413 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
711 414 <ul>
712 415 <li><a href="Home.html">Home</a></li>
713 416 <li><a href="License.html">License</a></li>
714 417 <li><a href="Install.html">Install</a></li>
715   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
716   -Report Issues</li>
  418 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
717 419 <li>Tools:
718 420 <ul>
719 421 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/pyxswf.html
  View file @ab9a043
... ... @@ -4,177 +4,25 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 17 </head>
158 18 <body>
159 19 <h1 id="pyxswf">pyxswf</h1>
160   -<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF
161   -files) that may be embedded in files such as MS Office documents
162   -(e.g. Word, Excel), which is especially useful for malware analysis.</p>
163   -<p>It is part of the <a
164   -href="http://www.decalage.info/python/oletools">python-oletools</a>
165   -package.</p>
166   -<p>pyxswf is an extension to <a
167   -href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a>
168   -published by Alexander Hanel.</p>
169   -<p>Compared to xxxswf, it can extract streams from MS Office documents
170   -by parsing their OLE structure properly, which is necessary when streams
171   -are fragmented. Stream fragmentation is a known obfuscation technique,
172   -as explained on <a
173   -href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
174   -<p>It can also extract Flash objects from RTF documents, by parsing
175   -embedded objects encoded in hexadecimal format (-f option).</p>
176   -<p>For this, simply add the -o option to work on OLE streams rather than
177   -raw files, or the -f option to work on RTF files.</p>
  20 +<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may be embedded in files such as MS Office documents (e.g. Word, Excel), which is especially useful for malware analysis.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  22 +<p>pyxswf is an extension to <a href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a> published by Alexander Hanel.</p>
  23 +<p>Compared to xxxswf, it can extract streams from MS Office documents by parsing their OLE structure properly, which is necessary when streams are fragmented. Stream fragmentation is a known obfuscation technique, as explained on <a href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
  24 +<p>It can also extract Flash objects from RTF documents, by parsing embedded objects encoded in hexadecimal format (-f option).</p>
  25 +<p>For this, simply add the -o option to work on OLE streams rather than raw files, or the -f option to work on RTF files.</p>
178 26 <h2 id="usage">Usage</h2>
179 27 <pre class="text"><code>Usage: pyxswf [options] &lt;file.bad&gt;
180 28  
... ... @@ -197,10 +45,7 @@ Options:
197 45 Will recursively scan a directory for files that
198 46 contain SWFs. Must provide path in quotes
199 47 -c, --compress Compresses the SWF using Zlib</code></pre>
200   -<h3
201   -id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example
202   -1 - detecting and extracting a SWF file from a Word document on
203   -Windows:</h3>
  48 +<h3 id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example 1 - detecting and extracting a SWF file from a Word document on Windows:</h3>
204 49 <pre class="text"><code>C:\oletools&gt;pyxswf -o word_flash.doc
205 50 OLE stream: &#39;Contents&#39;
206 51 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
... ... @@ -211,28 +56,22 @@ OLE stream: &amp;#39;Contents&amp;#39;
211 56 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
212 57 [ADDR] SWF 1 at 0x8 - FWS Header
213 58 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
214   -<h3
215   -id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example
216   -2 - detecting and extracting a SWF file from a RTF document on
217   -Windows:</h3>
  59 +<h3 id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example 2 - detecting and extracting a SWF file from a RTF document on Windows:</h3>
218 60 <pre class="text"><code>C:\oletools&gt;pyxswf -xf &quot;rtf_flash.rtf&quot;
219 61 RTF embedded object size 1498557 at index 000036DD
220 62 [SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0
221 63 00036DD
222 64 [ADDR] SWF 1 at 0xc40 - FWS Header
223 65 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
224   -<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in
225   -Python applications</h2>
  66 +<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in Python applications</h2>
226 67 <p>TODO</p>
227 68 <hr />
228   -<h2 id="python-oletools-documentation">python-oletools
229   -documentation</h2>
  69 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
230 70 <ul>
231 71 <li><a href="Home.html">Home</a></li>
232 72 <li><a href="License.html">License</a></li>
233 73 <li><a href="Install.html">Install</a></li>
234   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
235   -Report Issues</li>
  74 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
236 75 <li>Tools:
237 76 <ul>
238 77 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/doc/rtfobj.html
  View file @ab9a043
... ... @@ -4,234 +4,88 @@
4 4 <meta charset="utf-8" />
5 5 <meta name="generator" content="pandoc" />
6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7   - <title>-</title>
8   - <style>
9   - html {
10   - line-height: 1.5;
11   - font-family: Georgia, serif;
12   - font-size: 20px;
13   - color: #1a1a1a;
14   - background-color: #fdfdfd;
15   - }
16   - body {
17   - margin: 0 auto;
18   - max-width: 36em;
19   - padding-left: 50px;
20   - padding-right: 50px;
21   - padding-top: 50px;
22   - padding-bottom: 50px;
23   - hyphens: auto;
24   - overflow-wrap: break-word;
25   - text-rendering: optimizeLegibility;
26   - font-kerning: normal;
27   - }
28   - @media (max-width: 600px) {
29   - body {
30   - font-size: 0.9em;
31   - padding: 1em;
32   - }
33   - h1 {
34   - font-size: 1.8em;
35   - }
36   - }
37   - @media print {
38   - body {
39   - background-color: transparent;
40   - color: black;
41   - font-size: 12pt;
42   - }
43   - p, h2, h3 {
44   - orphans: 3;
45   - widows: 3;
46   - }
47   - h2, h3, h4 {
48   - page-break-after: avoid;
49   - }
50   - }
51   - p {
52   - margin: 1em 0;
53   - }
54   - a {
55   - color: #1a1a1a;
56   - }
57   - a:visited {
58   - color: #1a1a1a;
59   - }
60   - img {
61   - max-width: 100%;
62   - }
63   - h1, h2, h3, h4, h5, h6 {
64   - margin-top: 1.4em;
65   - }
66   - h5, h6 {
67   - font-size: 1em;
68   - font-style: italic;
69   - }
70   - h6 {
71   - font-weight: normal;
72   - }
73   - ol, ul {
74   - padding-left: 1.7em;
75   - margin-top: 1em;
76   - }
77   - li > ol, li > ul {
78   - margin-top: 0;
79   - }
80   - blockquote {
81   - margin: 1em 0 1em 1.7em;
82   - padding-left: 1em;
83   - border-left: 2px solid #e6e6e6;
84   - color: #606060;
85   - }
86   - code {
87   - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
88   - font-size: 85%;
89   - margin: 0;
90   - }
91   - pre {
92   - margin: 1em 0;
93   - overflow: auto;
94   - }
95   - pre code {
96   - padding: 0;
97   - overflow: visible;
98   - overflow-wrap: normal;
99   - }
100   - .sourceCode {
101   - background-color: transparent;
102   - overflow: visible;
103   - }
104   - hr {
105   - background-color: #1a1a1a;
106   - border: none;
107   - height: 1px;
108   - margin: 1em 0;
109   - }
110   - table {
111   - margin: 1em 0;
112   - border-collapse: collapse;
113   - width: 100%;
114   - overflow-x: auto;
115   - display: block;
116   - font-variant-numeric: lining-nums tabular-nums;
117   - }
118   - table caption {
119   - margin-bottom: 0.75em;
120   - }
121   - tbody {
122   - margin-top: 0.5em;
123   - border-top: 1px solid #1a1a1a;
124   - border-bottom: 1px solid #1a1a1a;
125   - }
126   - th {
127   - border-top: 1px solid #1a1a1a;
128   - padding: 0.25em 0.5em 0.25em 0.5em;
129   - }
130   - td {
131   - padding: 0.125em 0.5em 0.25em 0.5em;
132   - }
133   - header {
134   - margin-bottom: 4em;
135   - text-align: center;
136   - }
137   - #TOC li {
138   - list-style: none;
139   - }
140   - #TOC ul {
141   - padding-left: 1.3em;
142   - }
143   - #TOC > ul {
144   - padding-left: 0;
145   - }
146   - #TOC a:not(:hover) {
147   - text-decoration: none;
148   - }
149   - code{white-space: pre-wrap;}
150   - span.smallcaps{font-variant: small-caps;}
151   - span.underline{text-decoration: underline;}
152   - div.column{display: inline-block; vertical-align: top; width: 50%;}
153   - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
154   - ul.task-list{list-style: none;}
155   - pre > code.sourceCode { white-space: pre; position: relative; }
156   - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
157   - pre > code.sourceCode > span:empty { height: 1.2em; }
158   - .sourceCode { overflow: visible; }
159   - code.sourceCode > span { color: inherit; text-decoration: inherit; }
160   - div.sourceCode { margin: 1em 0; }
161   - pre.sourceCode { margin: 0; }
162   - @media screen {
163   - div.sourceCode { overflow: auto; }
164   - }
165   - @media print {
166   - pre > code.sourceCode { white-space: pre-wrap; }
167   - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
168   - }
169   - pre.numberSource code
170   - { counter-reset: source-line 0; }
171   - pre.numberSource code > span
172   - { position: relative; left: -4em; counter-increment: source-line; }
173   - pre.numberSource code > span > a:first-child::before
174   - { content: counter(source-line);
175   - position: relative; left: -1em; text-align: right; vertical-align: baseline;
176   - border: none; display: inline-block;
177   - -webkit-touch-callout: none; -webkit-user-select: none;
178   - -khtml-user-select: none; -moz-user-select: none;
179   - -ms-user-select: none; user-select: none;
180   - padding: 0 4px; width: 4em;
181   - color: #aaaaaa;
182   - }
183   - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
184   - div.sourceCode
185   - { }
186   - @media screen {
187   - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
188   - }
189   - code span.al { color: #ff0000; font-weight: bold; } /* Alert */
190   - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
191   - code span.at { color: #7d9029; } /* Attribute */
192   - code span.bn { color: #40a070; } /* BaseN */
193   - code span.bu { color: #008000; } /* BuiltIn */
194   - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
195   - code span.ch { color: #4070a0; } /* Char */
196   - code span.cn { color: #880000; } /* Constant */
197   - code span.co { color: #60a0b0; font-style: italic; } /* Comment */
198   - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
199   - code span.do { color: #ba2121; font-style: italic; } /* Documentation */
200   - code span.dt { color: #902000; } /* DataType */
201   - code span.dv { color: #40a070; } /* DecVal */
202   - code span.er { color: #ff0000; font-weight: bold; } /* Error */
203   - code span.ex { } /* Extension */
204   - code span.fl { color: #40a070; } /* Float */
205   - code span.fu { color: #06287e; } /* Function */
206   - code span.im { color: #008000; font-weight: bold; } /* Import */
207   - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
208   - code span.kw { color: #007020; font-weight: bold; } /* Keyword */
209   - code span.op { color: #666666; } /* Operator */
210   - code span.ot { color: #007020; } /* Other */
211   - code span.pp { color: #bc7a00; } /* Preprocessor */
212   - code span.sc { color: #4070a0; } /* SpecialChar */
213   - code span.ss { color: #bb6688; } /* SpecialString */
214   - code span.st { color: #4070a0; } /* String */
215   - code span.va { color: #19177c; } /* Variable */
216   - code span.vs { color: #4070a0; } /* VerbatimString */
217   - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
218   - .display.math{display: block; text-align: center; margin: 0.5rem auto;}
  7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 82 </head>
221 83 <body>
222 84 <h1 id="rtfobj">rtfobj</h1>
223   -<p>rtfobj is a Python module to detect and extract embedded objects
224   -stored in RTF files, such as OLE objects. It can also detect OLE Package
225   -objects, and extract the embedded files.</p>
226   -<p>Since v0.50, rtfobj contains a custom RTF parser that has been
227   -designed to match MS Word’s behaviour, in order to handle obfuscated RTF
228   -files. See my article <a
229   -href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in
230   -Weaponized RTF”</a> for some concrete examples.</p>
  85 +<p>rtfobj is a Python module to detect and extract embedded objects stored in RTF files, such as OLE objects. It can also detect OLE Package objects, and extract the embedded files.</p>
  86 +<p>Since v0.50, rtfobj contains a custom RTF parser that has been designed to match MS Word’s behaviour, in order to handle obfuscated RTF files. See my article <a href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in Weaponized RTF”</a> for some concrete examples.</p>
231 87 <p>rtfobj can be used as a Python library or a command-line tool.</p>
232   -<p>It is part of the <a
233   -href="http://www.decalage.info/python/oletools">python-oletools</a>
234   -package.</p>
  88 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
235 89 <h2 id="usage">Usage</h2>
236 90 <pre class="text"><code>rtfobj [options] &lt;filename&gt; [filename2 ...]
237 91  
... ... @@ -253,41 +107,28 @@ Options:
253 107 to a file, for example &quot;-s 2&quot;. Use &quot;-s all&quot; to save
254 108 all objects at once.
255 109 -d OUTPUT_DIR use specified directory to save output files.</code></pre>
256   -<p>rtfobj displays a list of the OLE and Package objects that have been
257   -detected, with their attributes such as class and filename.</p>
258   -<p>When an OLE Package object contains an executable file or script, it
259   -is highlighted as such. For example:</p>
  110 +<p>rtfobj displays a list of the OLE and Package objects that have been detected, with their attributes such as class and filename.</p>
  111 +<p>When an OLE Package object contains an executable file or script, it is highlighted as such. For example:</p>
260 112 <p><img src="rtfobj1.png" /></p>
261   -<p>To extract an object or file, use the option -s followed by the
262   -object number as shown in the table.</p>
  113 +<p>To extract an object or file, use the option -s followed by the object number as shown in the table.</p>
263 114 <p>Example:</p>
264 115 <pre class="text"><code>rtfobj -s 0</code></pre>
265   -<p>It extracts and decodes the corresponding object, and saves it as a
266   -file named “object_xxxx.bin”, xxxx being the location of the object in
267   -the RTF file.</p>
268   -<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in
269   -Python applications</h2>
270   -<p>As of v0.50, the API has changed significantly and it is not final
271   -yet. For now, see the class RtfObjectParser in the code.</p>
272   -<h3 id="deprecated-api-still-functional">Deprecated API (still
273   -functional):</h3>
274   -<p>rtf_iter_objects(filename) is an iterator which yields a tuple
275   -(index, orig_len, object) providing the index of each hexadecimal stream
276   -in the RTF file, and the corresponding decoded object.</p>
  116 +<p>It extracts and decodes the corresponding object, and saves it as a file named “object_xxxx.bin”, xxxx being the location of the object in the RTF file.</p>
  117 +<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in Python applications</h2>
  118 +<p>As of v0.50, the API has changed significantly and it is not final yet. For now, see the class RtfObjectParser in the code.</p>
  119 +<h3 id="deprecated-api-still-functional">Deprecated API (still functional):</h3>
  120 +<p>rtf_iter_objects(filename) is an iterator which yields a tuple (index, orig_len, object) providing the index of each hexadecimal stream in the RTF file, and the corresponding decoded object.</p>
277 121 <p>Example:</p>
278   -<div class="sourceCode" id="cb3"><pre
279   -class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools <span class="im">import</span> rtfobj</span>
280   -<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</span>
281   -<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</span></code></pre></div>
  122 +<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">from</span> oletools <span class="im">import</span> rtfobj</a>
  123 +<a class="sourceLine" id="cb3-2" data-line-number="2"><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</a>
  124 +<a class="sourceLine" id="cb3-3" data-line-number="3"> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</a></code></pre></div>
282 125 <hr />
283   -<h2 id="python-oletools-documentation">python-oletools
284   -documentation</h2>
  126 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
285 127 <ul>
286 128 <li><a href="Home.html">Home</a></li>
287 129 <li><a href="License.html">License</a></li>
288 130 <li><a href="Install.html">Install</a></li>
289   -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
290   -Report Issues</li>
  131 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
291 132 <li>Tools:
292 133 <ul>
293 134 <li><a href="mraptor.html">mraptor</a></li>
... ...
oletools/olevba.py
  View file @ab9a043
... ... @@ -32,7 +32,7 @@ https://github.com/unixfreak0037/officeparser
32 32  
33 33 # === LICENSE ==================================================================
34 34  
35   -# olevba is copyright (c) 2014-2024 Philippe Lagadec (http://www.decalage.info)
  35 +# olevba is copyright (c) 2014-2025 Philippe Lagadec (http://www.decalage.info)
36 36 # All rights reserved.
37 37 #
38 38 # Redistribution and use in source and binary forms, with or without modification,
... ... @@ -236,7 +236,7 @@ from __future__ import print_function
236 236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
237 237 # 2021-11-09 KJ: - added PROJECTCOMPATVERSION Record on dir Stream
238 238  
239   -__version__ = '0.60.2'
  239 +__version__ = '0.60.3'
240 240  
241 241 #------------------------------------------------------------------------------
242 242 # TODO:
... ... @@ -4112,7 +4112,6 @@ class VBA_Parser_CLI(VBA_Parser):
4112 4112 for kw_type, keyword, description in results:
4113 4113 color_type = COLOR_TYPE.get(kw_type, None)
4114 4114 if color_type:
4115   -
4116 4115 # Prevent malicious actors from performing anti-analysis by replacing
4117 4116 # character 27 (ESC) with \e.
4118 4117 # See more: https://www.youtube.com/watch?v=3T2Al3jdY38
... ...
setup.py
  View file @ab9a043
... ... @@ -55,7 +55,7 @@ import os, fnmatch
55 55 #--- METADATA -----------------------------------------------------------------
56 56  
57 57 name = "oletools"
58   -version = '0.60.2'
  58 +version = '0.60.3'
59 59 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
60 60 long_desc = open('oletools/README.rst').read()
61 61 author = "Philippe Lagadec"
... ...