AwesomeREA.org

Tool

oletools

Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. Its command-line tools detect and extract VBA and Excel 4 (XLM) macros, embedded OLE and Flash objects and DDE links (olevba, MacroRaptor, oleobj, rtfobj, pyxswf, msodde), flag characteristics common in malicious files with oleid and ftguess, and show directory entries, metadata, timestamps and sector maps with oledir, olemeta, oletimes and olemap. It is built on the same author's olefile parser.

Requirements & limits

  • Latest release at review: v0.60.2, published 2024-07-02 on GitHub and PyPI. The reviewed master commit (2026-01-26) already sets version 0.60.3, and its README news lists 0.60.3 under 2025-05-22 with an olevba fix for a security issue with ANSI escape codes in CLI output, but no 0.60.3 tag or PyPI upload existed at review. SECURITY.md lists 0.60.x and later as supported.
  • Install with pip as oletools, or oletools[full] to add the optional XLMMacroDeobfuscator. Dependencies are pyparsing, olefile, easygui, colorclass and pcodedmp, plus msoffcrypto-tool for encrypted documents except on PyPy under Windows, macOS or Python 2. setup.py classifiers list Python 2.7 and 3.4 to 3.12; the GitHub workflow runs pylint -E and the unit tests on Linux, Windows and macOS with current CPython 3 and PyPy 3.9, while the older Travis configuration targets Python 2.7 to 3.8 and PyPy.
  • Inputs are user-supplied documents, which in malware analysis may be malicious; the unit tests use sample documents committed under tests/test-data. The README describes oleid as detecting characteristics usually found in malicious files and MacroRaptor as detecting malicious VBA macros, so results are indicators that need analyst review. No documents were analyzed.
  • LICENSE.md applies a two-clause BSD license (copyright 2012–2025 Philippe Lagadec) to the package; olevba contains MIT-licensed code from officeparser, and the thirdparty folder keeps its own terms, including GPL-3.0 for xxxswf and public-domain oledump plugin code. The README notes that python-oletools is unrelated to BeCubed Software's OLETools.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · decalage2/oletools · Revision ec10260
  2. setup.py GitHub · decalage2/oletools · Revision ec10260
  3. requirements.txt GitHub · decalage2/oletools · Revision ec10260
  4. SECURITY.md GitHub · decalage2/oletools · Revision ec10260
  5. .github/workflows/unittests.yml GitHub · decalage2/oletools · Revision ec10260
  6. .travis.yml GitHub · decalage2/oletools · Revision ec10260
  7. tests/test-data GitHub · decalage2/oletools · Revision ec10260
  8. LICENSE.md GitHub · decalage2/oletools · Revision ec10260
  9. oletools/thirdparty/xxxswf/LICENSE.txt GitHub · decalage2/oletools · Revision ec10260
  10. https://github.com/decalage2/oletools/releases/tag/v0.60.2
  11. https://pypi.org/project/oletools/0.60.2/

More in Native binaries

All 85 entries in Native binaries