oletools
Python toolkit for analyzing Microsoft Office documents, VBA macros, and OOXML attachments.
Technical Architecture & Overview
oletools is a suite of Python tools for parsing OLE2 and OOXML files. The olevba module extracts and decodes VBA and Excel 4.0 macros, while rtfobj, msodde, and oleid cover embedded RTF objects, DDE links, and characteristics common in malicious OLE files. Several projects and online malware analysis services use the toolkit, and olevba runs either as a command-line tool or as a Python module.
Targeted Technical Use Cases
Screening email attachments for macro-based malware during phishing response.
Evaluation & Trade-offs
Core Strengths
- +Extracts VBA macros and XLM (Excel 4) macros, including from SLK files.
- +Command-line modules that pipeline well for bulk scanning.
- +Maintained by the original author, Philippe Lagadec; the latest release is v0.60.3 from May 2025.
Trade-Offs & Limitations
- -Scoped to document formats, not binaries or scripts.
- -Automatic decoding covers common obfuscation methods such as hex, Base64, StrReverse, and VBA expressions; other obfuscation requires manual work.
Defensive Security Application
Automated attachment analysis to confirm malicious macros and extract IOCs from phishing campaigns.
Frequently Asked Questions
What is oletools?→
oletools is a suite of Python tools for parsing OLE2 and OOXML files. The olevba module extracts and decodes VBA and Excel 4.0 macros, while rtfobj, msodde, and oleid cover embedded RTF objects, DDE links, and characteristics common in malicious OLE files. Several projects and online malware analysis services use the toolkit, and olevba runs either as a command-line tool or as a Python module.
What is oletools used for?→
Screening email attachments for macro-based malware during phishing response.
What are the strengths of oletools?→
- +Extracts VBA macros and XLM (Excel 4) macros, including from SLK files.
- +Command-line modules that pipeline well for bulk scanning.
- +Maintained by the original author, Philippe Lagadec; the latest release is v0.60.3 from May 2025.
What are the limitations of oletools?→
- +Scoped to document formats, not binaries or scripts.
- +Automatic decoding covers common obfuscation methods such as hex, Base64, StrReverse, and VBA expressions; other obfuscation requires manual work.
How is oletools used defensively?→
Automated attachment analysis to confirm malicious macros and extract IOCs from phishing campaigns.