# Oletools

# 🕵️‍♂️ Guide: Analyzing `.docx` and `.xlsm` Files with `oletools`

## 🔧 0. Install `oletools`

```bash
pip install oletools
```

---

## 📄 Analyzing `.docx` Files (OpenXML Word Documents)

### 1. Run `olevba` on the `.docx` file

```bash
olevba file.docx
```

> ⚠️ `.docx` files usually do **not** contain VBA macros. But it's always good to check.

---

### 2. Unzip the `.docx` to check for embedded objects

```bash
unzip file.docx -d extracted/
```

---

### 3. Look for embedded OLE objects

Check this directory:

```
extracted/word/embeddings/
```

You may find:

```
oleObject1.bin
oleObject2.bin
```

---

### 4. Analyze embedded OLE objects

```bash
olevba extracted/word/embeddings/oleObject1.bin
```

Repeat for any other `.bin` files.

---

### 5. Use `oleid` for file metadata overview

```bash
oleid file.docx
```

This gives a quick summary of:
- Macros present
- External relationships
- Encryption
- Suspicious flags

---

## 📊 Analyzing `.xlsm` Files (Macro-Enabled Excel)

### 1. Run `olevba` on the file

```bash
olevba file.xlsm
```

This will:
- Extract all VBA macros
- Show suspicious keywords
- Show auto-executing macros
- Print the actual macro code

---

### 2. Look for these red flags

| Type        | Keyword                        | Why it matters                            |
|-------------|--------------------------------|-------------------------------------------|
| `AutoExec`  | `Workbook_Open`, `Auto_Open`   | Executes macro automatically on open      |
| `Suspicious`| `Shell`, `CreateObject`, `WScript.Shell` | Can run system commands         |
| `IOC`       | `http`, `.exe`, `powershell`, registry edits | Potential malware payloads     |
| `Obfuscation` | `Chr`, `Base64`, `StrReverse`, `Split` | Used to hide real behavior    |

---

### 3. Extract VBA code to a file (optional)

```bash
olevba file.xlsm > macro_output.txt
```

---

### 4. Use `oleid` for metadata

```bash
oleid file.xlsm
```

---

## ✅ Key Indicators to Watch

| Category         | Example                        | Why It’s Suspicious                       |
|------------------|--------------------------------|-------------------------------------------|
| **AutoExec**     | `Auto_Open`, `Workbook_Open`   | Runs automatically                        |
| **Command Exec** | `Shell`, `powershell`, `cmd`   | System command execution                  |
| **Obfuscation**  | `Chr(72) & Chr(84)`, `Base64`  | Payload hiding                            |
| **Downloader**   | `URLDownloadToFile`, `XMLHTTP` | Drops additional malware                  |
| **Persistence**  | Registry writes, `Startup`     | Foothold creation                         |
| **Encoding**     | Long strings, encoded blobs    | Shellcode or encoded scripts              |

---

## 🧾 Quick Command List (Cheat Sheet)

```bash
# General analysis
olevba file.xlsm
olevba file.docx

# Extract and analyze embedded objects
unzip file.docx -d extracted/
olevba extracted/word/embeddings/oleObject1.bin

# Inspect file metadata
oleid file.xlsm
oleid file.docx

# Save macro code to a text file
olevba file.xlsm > macros.txt

# Identify embedded objects
ls extracted/word/embeddings/
file extracted/word/embeddings/oleObject1.bin
```

---

## 🧠 Pro Tips

- Use `olevba` with caution on unknown files — always analyze in a **VM/sandbox**.
- Combine `olevba` with `strings`, `file`, or `hexdump` for deeper inspection.
- Copy suspicious VBA code for manual review or deobfuscation if needed.
- Use `oleid` first for a fast overview before diving into macro code.