killchain-compendium/Forensics/OLEtools.md

oletools & Vmonkey

• Analyze ooxml and ole2 files

• oletools repo

Usage

OLEtools

• Check content of a stream

oledump.py file.doc  -Ss <No. of stream>
oledump.py file.doc  -Ss <No. of stream> -v

oledump.py -i file.doc

olevba file.doc

Vipermonkey

• For the lazy ones

vmonkey file.doc

scdbg

• scdbg repo

Outlook

• Outlook files like .msg can be read and changed to by perl-email-outlook-message via

msgconvert *.msg