diff --git a/oletools/README.html b/oletools/README.html
index 1e4d8bf..cff9e81 100644
--- a/oletools/README.html
+++ b/oletools/README.html
@@ -23,6 +23,25 @@
Note: python-oletools is not related to OLETools published by BeCubed Software.
News
+- 2019-12-03 v0.55:
+
+- olevba:
+
+- added support for SLK files and XLM macro extraction from SLK
+- VBA Stomping detection
+- integrated pcodedmp to extract and disassemble P-code
+- detection of suspicious keywords and IOCs in P-code
+- new option --pcode to display P-code disassembly
+- improved detection of auto execution triggers
+
+- rtfobj: added URL carver for CVE-2017-0199
+- better handling of unicode for systems with locale that does not support UTF-8, e.g. LANG=C (PR #365)
+- tests:
+
+- test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215)
+- tests that trigger antivirus alerts have been temporarily disabled (issue #215)
+
+
- 2019-05-22 v0.54.2:
- bugfix release: fixed several issues related to encrypted documents and XLM/XLF Excel 4 macros
@@ -56,14 +75,6 @@
- oleid now detects encrypted OpenXML files
- fixed bugs in oleobj, rtfobj, oleid, olevba
-- 2018-02-18 v0.52:
-
-- New tool msodde to detect and extract DDE links from MS Office files, RTF and CSV;
-- Fixed bugs in olevba, rtfobj and olefile, to better handle malformed/obfuscated files;
-- Performance improvements in olevba and rtfobj;
-- VBA form parsing in olevba;
-- Office 2007+ support in oleobj.
-
See the full changelog for more information.
@@ -86,7 +97,7 @@
olemap: to display a map of all the sectors in an OLE file.
-oletools are used by a number of projects and online malware analysis services, including Viper, REMnux, FLARE-VM, FAME, Hybrid-analysis.com, Joe Sandbox, Deepviz, Laika BOSS, Cuckoo Sandbox, Anlyz.io, ViperMonkey, pcodedmp, dridex.malwareconfig.com, Snake, DARKSURGEON, CAPE, AssemblyLine, malshare.io, Malware Repository Framework (MRF), malware-repo, Vba2Graph, Strelka, stoQ, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
+oletools are used by a number of projects and online malware analysis services, including ACE, Anlyz.io, AssemblyLine, CAPE, Cuckoo Sandbox, DARKSURGEON, Deepviz, dridex.malwareconfig.com, FAME, FLARE-VM, Hybrid-analysis.com, Joe Sandbox, Laika BOSS, MacroMilter, mailcow, malshare.io, malware-repo, Malware Repository Framework (MRF), olefy, PeekabooAV, pcodedmp, PyCIRCLean, REMnux, Snake, SNDBOX, Strelka, stoQ, TheHive/Cortex, TSUGURI Linux, Vba2Graph, Viper, ViperMonkey, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
Download and Install:
The recommended way to download and install/update the latest stable release of oletools is to use pip:
diff --git a/oletools/README.rst b/oletools/README.rst
index a4dd722..f962ea6 100644
--- a/oletools/README.rst
+++ b/oletools/README.rst
@@ -29,6 +29,27 @@ Software.
News
----
+- **2019-12-03 v0.55**:
+
+ - olevba:
+
+ - added support for SLK files and XLM macro extraction from SLK
+ - VBA Stomping detection
+ - integrated pcodedmp to extract and disassemble P-code
+ - detection of suspicious keywords and IOCs in P-code
+ - new option --pcode to display P-code disassembly
+ - improved detection of auto execution triggers
+
+ - rtfobj: added URL carver for CVE-2017-0199
+ - better handling of unicode for systems with locale that does not
+ support UTF-8, e.g. LANG=C (PR #365)
+ - tests:
+
+ - test files can now be encrypted, to avoid antivirus alerts (PR
+ #217, issue #215)
+ - tests that trigger antivirus alerts have been temporarily
+ disabled (issue #215)
+
- **2019-05-22 v0.54.2**:
- bugfix release: fixed several issues related to encrypted
@@ -79,17 +100,6 @@ News
- oleid now detects encrypted OpenXML files
- fixed bugs in oleobj, rtfobj, oleid, olevba
-- 2018-02-18 v0.52:
-
- - New tool
- `msodde `__ to
- detect and extract DDE links from MS Office files, RTF and CSV;
- - Fixed bugs in olevba, rtfobj and olefile, to better handle
- malformed/obfuscated files;
- - Performance improvements in olevba and rtfobj;
- - VBA form parsing in olevba;
- - Office 2007+ support in oleobj.
-
See the `full
changelog `__ for
more information.
@@ -141,29 +151,38 @@ Projects using oletools:
------------------------
oletools are used by a number of projects and online malware analysis
-services, including `Viper `__,
-`REMnux `__,
-`FLARE-VM `__,
+services, including `ACE `__,
+`Anlyz.io `__,
+`AssemblyLine `__,
+`CAPE `__, `Cuckoo
+Sandbox `__,
+`DARKSURGEON `__,
+`Deepviz `__,
+`dridex.malwareconfig.com `__,
`FAME `__,
+`FLARE-VM `__,
`Hybrid-analysis.com `__, `Joe
-Sandbox `__,
-`Deepviz `__, `Laika
-BOSS `__, `Cuckoo
-Sandbox `__,
-`Anlyz.io `__,
-`ViperMonkey `__,
+Sandbox `__, `Laika
+BOSS `__,
+`MacroMilter `__,
+`mailcow `__,
+`malshare.io `__,
+`malware-repo `__, `Malware
+Repository Framework (MRF) `__,
+`olefy `__,
+`PeekabooAV `__,
`pcodedmp `__,
-`dridex.malwareconfig.com `__,
+`PyCIRCLean `__,
+`REMnux `__,
`Snake `__,
-`DARKSURGEON `__,
-`CAPE `__,
-`AssemblyLine `__,
-`malshare.io `__, `Malware Repository Framework
-(MRF) `__,
-`malware-repo `__,
-`Vba2Graph `__,
+`SNDBOX `__,
`Strelka `__,
`stoQ `__,
+`TheHive/Cortex `__,
+`TSUGURI Linux `__,
+`Vba2Graph `__,
+`Viper `__,
+`ViperMonkey `__,
`YOMI `__, and probably
`VirusTotal `__. And quite a few `other
projects on
diff --git a/oletools/doc/Home.html b/oletools/doc/Home.html
index ffb8a0e..74e2bdc 100644
--- a/oletools/doc/Home.html
+++ b/oletools/doc/Home.html
@@ -16,7 +16,7 @@
-
+
This is the home page of the documentation for python-oletools. The latest version can be found online, otherwise a copy is provided in the doc subfolder of the package.
python-oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the olefile parser. See http://www.decalage.info/python/oletools for more info.
Quick links: Home page - Download/Install - Documentation - Report Issues/Suggestions/Questions - Contact the Author - Repository - Updates on Twitter
diff --git a/oletools/doc/Home.md b/oletools/doc/Home.md
index 7b1a93f..185db4f 100644
--- a/oletools/doc/Home.md
+++ b/oletools/doc/Home.md
@@ -1,4 +1,4 @@
-python-oletools v0.54 documentation
+python-oletools v0.55 documentation
===================================
This is the home page of the documentation for python-oletools. The latest version can be found