# Analysis # Oletools # 🕵️‍♂️ Guide: Analyzing `.docx` and `.xlsm` Files with `oletools` ## 🔧 0. Install `oletools` ```bash pip install oletools ``` --- ## 📄 Analyzing `.docx` Files (OpenXML Word Documents) ### 1. Run `olevba` on the `.docx` file ```bash olevba file.docx ``` > ⚠️ `.docx` files usually do **not** contain VBA macros. But it's always good to check. --- ### 2. Unzip the `.docx` to check for embedded objects ```bash unzip file.docx -d extracted/ ``` --- ### 3. Look for embedded OLE objects Check this directory: ``` extracted/word/embeddings/ ``` You may find: ``` oleObject1.bin oleObject2.bin ``` --- ### 4. Analyze embedded OLE objects ```bash olevba extracted/word/embeddings/oleObject1.bin ``` Repeat for any other `.bin` files. --- ### 5. Use `oleid` for file metadata overview ```bash oleid file.docx ``` This gives a quick summary of: - Macros present - External relationships - Encryption - Suspicious flags --- ## 📊 Analyzing `.xlsm` Files (Macro-Enabled Excel) ### 1. Run `olevba` on the file ```bash olevba file.xlsm ``` This will: - Extract all VBA macros - Show suspicious keywords - Show auto-executing macros - Print the actual macro code --- ### 2. Look for these red flags

Type	Keyword	Why it matters
`AutoExec`	`Workbook_Open`, `Auto_Open`	Executes macro automatically on open
`Suspicious`	`Shell`, `CreateObject`, `WScript.Shell`	Can run system commands
`IOC`	`http`, `.exe`, `powershell`, registry edits	Potential malware payloads
`Obfuscation`	`Chr`, `Base64`, `StrReverse`, `Split`	Used to hide real behavior

--- ### 3. Extract VBA code to a file (optional) ```bash olevba file.xlsm > macro_output.txt ``` --- ### 4. Use `oleid` for metadata ```bash oleid file.xlsm ``` --- ## ✅ Key Indicators to Watch

Category	Example	Why It’s Suspicious
AutoExec	`Auto_Open`, `Workbook_Open`	Runs automatically
Command Exec	`Shell`, `powershell`, `cmd`	System command execution
Obfuscation	`Chr(72) & Chr(84)`, `Base64`	Payload hiding
Downloader	`URLDownloadToFile`, `XMLHTTP`	Drops additional malware
Persistence	Registry writes, `Startup`	Foothold creation
Encoding	Long strings, encoded blobs	Shellcode or encoded scripts

--- ## 🧾 Quick Command List (Cheat Sheet) ```bash # General analysis olevba file.xlsm olevba file.docx # Extract and analyze embedded objects unzip file.docx -d extracted/ olevba extracted/word/embeddings/oleObject1.bin # Inspect file metadata oleid file.xlsm oleid file.docx # Save macro code to a text file olevba file.xlsm > macros.txt # Identify embedded objects ls extracted/word/embeddings/ file extracted/word/embeddings/oleObject1.bin ``` --- ## 🧠 Pro Tips - Use `olevba` with caution on unknown files — always analyze in a **VM/sandbox**. - Combine `olevba` with `strings`, `file`, or `hexdump` for deeper inspection. - Copy suspicious VBA code for manual review or deobfuscation if needed. - Use `oleid` first for a fast overview before diving into macro code.