killchain-compendium/Forensics/OLEtools.md

38 lines
576 B
Markdown

# oletools & Vmonkey
* Analyze ooxml and ole2 files
* [oletools repo](https://github.com/decalage2/oletools.git)
## Usage
### OLEtools
* Check content of a stream
```sh
oledump.py file.doc -Ss <No. of stream>
oledump.py file.doc -Ss <No. of stream> -v
```
```sh
oledump.py -i file.doc
```
```sh
olevba file.doc
```
### Vipermonkey
* For the lazy ones
```sh
vmonkey file.doc
```
## scdbg
* [scdbg repo](https://github.com/dzzie/SCDBG.git)
## Outlook
* Outlook files like `.msg` can be read and changed to by perl-email-outlook-message via
```sh
msgconvert *.msg
```