PAGES
← all tools
◆ Malware Analysis

oletools

v0.60.1 open-source

oletools is a package of Python tools to analyze Microsoft OLE2 files, such as MS Office documents, mainly for malware analysis, forensics and debugging.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

oletools is an open-source Python package for analyzing Microsoft OLE2 and OOXMLOOXMLAn ISO-standardized file format family for Office documents (Word, Excel, PowerPoint), maintained by Microsoft, that stores content as XML inside a ZIP archive, giving cyber tools a parseable, scriptable structure for document analysis. files — Office documents, MSI files, Outlook messages, RTF and XPS — mainly for malware analysis and forensics, and it is free to use. It runs as a set of command-line tools, most notably olevba, which extracts and deobfuscates VBA and Excel 4 (XLM) macros, alongside utilities for OLE objects, DDE links and file-format identification. It is aimed at malware analysts and forensic investigators who need to triage suspicious documents without opening them in Office, and it fills a niche category peer tools don't cover as directly: static analysis of the compound-file formats malicious documents are built on. Started in 2012 and maintained by 67 contributors, the project has slowed markedly, with just 6 commits and one release in the past year, that release now 780 days old.

oletools is a package of Python tools to analyze Microsoft OLE2 files, such as MS Office documents, mainly for malware analysis, forensics and debugging.

How oletools helps

Does this Office document contain macros, and are they hiding anything malicious?

extracts VBA and Excel 4 (XLM) code from the file, deobfuscates strings and expressions, and flags suspicious keywords like auto-exec triggers, shell calls or file-drop behavior, without opening the document in Office

Is this attachment actually the file type it claims to be?

identifies the underlying compound-file or OOXML structure and container format, catching mismatches between an extension and what the bytes actually contain

Could opening this spreadsheet or document leak data or fetch something over the network without a macro?

looks for DDE links embedded in the file that would trigger an external command or connection when opened

Is this suspicious document password-protected in a way that's hiding its payload?

detects standard Office encryption, applies known default passwords where applicable, and reports the password it found so the underlying content can be examined

How risky is this batch of documents before an analyst opens any of them?

runs a combined risk assessment per file, scoring indicators like macro presence, obfuscation, and object embedding so triage can be prioritized across many samples at once

all 10 features, with the evidence for each →

Languages

Not documented

Features

10 capabilities · 2 backed by code, an API document or a real run

Built from oletools's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • oletools covers 1 of the 8 investigation and response capabilities we track.

What oletools offers you

  • Command-line interface2
  • Scripting language support1
Static malware analysis 6 features Investigation and response since 2012
Office document macro analysis verified Analyzes one or more Office document files for VBA and XLM macros, with options to disable pcode extraction or XLM macro extraction to control scope and speed. 25 releases · 9 other sources · first seen Aug 2014

Shared capability: Static malware analysis

release 25 total

  • olevba and mraptor now detect the Workbook_BeforeClose event, expanding macro analysis coverage to include workbook close triggers previously uncovered. v0.56.2 · May 2021 · source · release history
  • olevba gains detection capability for Workbook_BeforeClose macro events in Excel files. 0.56.2 · May 2021 · source · release history
  • Adds detection of template injection to olevba v0.56 · Oct 2020 · source · release history
  • Adds --no-xlm option to olevba to disable Excel 4/XLM macros parsing v0.56 · Oct 2020 · source · release history
  • Adds detection of Excel 4/XLM macros in XLSM files via olevba v0.56 · Oct 2020 · source · release history
  • olevba detects and extracts XLM/XLF (Excel 4) macros v0.54 · Apr 2019 · source · release history

docs

  • Python package of cyber tools to analyze Microsoft OLE2, RTF, and OpenXML files for malware analysis, forensics, and VBA macro extraction.

command line

  • --no-pcode — Disable extraction and analysis of pcode v0.56 · Sep 2020 · command-line history
  • filenames — Files to analyze v0.56 · Sep 2020 · command-line history
  • --no-xlm — Do not extract XLM Excel macros. This may speed up analysis of large files. v0.56 · Sep 2020 · command-line history
  • --relaxed — Do not raise errors if opening of substream fails v0.54 · Apr 2019 · command-line history

example

  • Detect and extract DDE links from a suspicious document. msodde -r malware.docx v0.52 · Feb 2018 · source
  • Scan an entire directory of zipped office documents for hidden data using wildcards. oledir -r 'documents/*.zip' v0.51 · Jun 2017 · source
  • Extract document variables from a Word file by running the new VBA script via MS Word. run DocVarDump.vba in MS Word to dump document variables v0.51 · Jun 2017 · source
  • Deobfuscate VBA macros in a malicious document to reveal hidden commands. olevba --deobf suspicious.doc v0.46 · May 2016 · source
OpenXML file analysis shipped Detects encrypted OpenXML files, parses Office 2007+ pure XML (Flat OPC) formats, and displays the storage/stream tree with CLSIDs. 10 releases · first seen Feb 2018

Shared capability: Static malware analysis

release 10 total

  • clsid plugin now identifies several CLSIDs related to the MS Office click-to-run vulnerability. 0.56.2 · May 2021 · source · release history
  • olevba and msodde automatically handle documents encrypted with common passwords (123, 4321, VelvetSweatShop). v0.54.2b · May 2019 · source · release history
  • msoffcrypto-tool is now a required dependency. v0.54.2b · May 2019 · source · release history
  • olevba and msodde now handle documents encrypted with common passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically. 0.54.2 · May 2019 · source · release history
  • olevba and msodde now support encrypted MS Office files v0.54 · Apr 2019 · source · release history
  • oleid now detects encrypted OpenXML files v0.53 · Jun 2018 · source · release history
P-code disassembly verified Extracts and displays disassembled VBA P-code from Office documents using pcodedmp. 3 releases · 5 other sources · first seen Dec 2019

Shared capability: Static malware analysis

release

  • The --pcode option is replaced by --show-pcode and --no-pcode in olevba v0.56 · Oct 2020 · source · release history
  • Adds --show-pcode and --no-pcode options to olevba for controlling P-code display v0.56 · Oct 2020 · source · release history
  • Adds --pcode option to olevba to extract and display P-code disassembly for Excel files v0.55 · Dec 2019 · source · release history

docs

  • Python package of cyber tools to analyze Microsoft OLE2, RTF, and OpenXML files for malware analysis, forensics, and VBA macro extraction.

command line

  • --no-pcode — Disable extraction and analysis of pcode v0.56 · Sep 2020 · command-line history
  • --show-pcode — Show disassembled P-code (using pcodedmp) v0.56 · Sep 2020 · command-line history

example

  • Display P-code for macros without disabling it, replacing the old --pcode flag olevba --show-pcode example.xlsm v0.56 · Oct 2020 · source
  • Extract and inspect the machine code of an Excel add-in that uses P-code instead of standard VBA macros. olevba --pcode malicious.xla v0.55 · Dec 2019 · source
OLE file identification shipped Identifies file types and macros in OLE files. 6 releases · first seen Oct 2012

Shared capability: Static malware analysis

Also counts toward: Command-line interface

release

  • Adds per-indicator risk level display in oleid output v0.60 · Jun 2021 · source · release history
  • Adds PDF and Microsoft Word Picture support to clsid command v0.56 · Oct 2020 · source · release history
  • oledir, olemeta, and oletimes add support for zip files and wildcards v0.51 · Jun 2017 · source · release history
  • New rtfobj parser detects executable files in OLE Package objects with improved display. v0.50 · Nov 2016 · source · release history
  • olevba can open password-protected zip archives 0.07 · Jan 2015 · source · release history
  • Adds the oleid subcommand to identify file types and macros in OLE files. 0.02 · Oct 2012 · source · release history
XLM macro extraction and deobfuscation shipped Enables the use of XLMMacroDeobfuscator to extract and deobfuscate XLM macros within olevba. 1 release · first seen Jun 2021

Shared capability: Static malware analysis

release

  • Enables use of XLMMacroDeobfuscator for extracting and deobfuscating XLM macros in olevba v0.60 · Jun 2021 · source · release history
VBA stomping detection shipped Detects VBA stomping attacks within Office documents. 1 release · first seen Dec 2019

Shared capability: Static malware analysis

release

Other / not yet classified 4 features Features we have not matched to a capability yet. A suggested match is marked.
File format identification shipped Identifies file formats and containers using the ftguess CLI command. 2 releases · first seen Jun 2021

Also counts toward: Command-line interface

release

Flash object extraction from RTF shipped suggested Extracts Flash objects from RTF files using pyxswf. 2 releases · first seen Nov 2012

Suggested capability: Static malware analysis. This is our guess, not confirmed.

release

RTF obfuscation analysis shipped suggested Emulates specific MS Word bugs to detect and analyze obfuscation tricks in RTF samples. 1 release · first seen Jun 2018

Suggested capability: Static malware analysis. This is our guess, not confirmed.

release

  • rtfobj emulates the MS Word bug for \\' obfuscation trick in RTF samples v0.53 · Jun 2018 · source · release history
Document variable extraction shipped Extracts document variables from Word files by executing a VBA script. 1 release · first seen Jun 2017

Also counts toward: Scripting language support

release

  • Adds DocVarDump.vba to dump document variables using Word v0.51 · Jun 2017 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for oletools, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail oletools puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

26 entries

  1. May 20221
  3. June 20211
  5. May 20211
  7. October 20201
  9. December 20191
  11. May 20192
  14. April 20191
  16. June 20181
  18. February 20181
  20. June 20171
  22. November 20161
  24. June 20161
  26. May 20161
  28. April 20161
  30. March 20161
  32. September 20152
  35. June 20151
  37. May 20151
  39. March 20151
  41. February 20151
  43. January 20151
  45. August 20141
  47. November 20121
  49. October 20121
    Show

    26 entries

    1. v0.60.1 May 9, 2022 · release notes

      ftguess adds PowerPoint, XPS and XLSB format support; oleid fixes init bug

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.60.1 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.60.1
    2. v0.60 Jun 21, 2021 · release notes

      Adds ftguess tool for file format identification, risk levels in oleid, and XLM macro analysis support.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.60 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.60
      • Adds ftguess CLI command to identify file formats and containers
      • Adds per-indicator risk level display in oleid output
      • Enables use of XLMMacroDeobfuscator for extracting and deobfuscating XLM macros in olevba

      3 details in Everything

    3. v0.56.2 May 7, 2021 · release notes

      oletools v0.56.2 adds Workbook_BeforeClose detection in olevba and mraptor

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.56.2 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.56.2
      • olevba and mraptor now detect the Workbook_BeforeClose event, expanding macro analysis coverage to include workbook close triggers previously uncovered.

      1 detail in Everything

    4. v0.56 Oct 4, 2020 · release notes

      oletools v0.56 adds XLM macro analysis, template injection detection and --show-pcode CLI option

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.56 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.56
      └──▷ USE IT
      Display P-code for macros without disabling it, replacing the old --pcode flag
      shell 
      olevba --show-pcode example.xlsm
      • Adds --show-pcode and --no-pcode options to olevba for controlling P-code display
      • Adds detection of Excel 4/XLM macros in XLSM files via olevba
      • Adds detection of template injection to olevba
      • Adds --no-xlm option to olevba to disable Excel 4/XLM macros parsing
      • Adds PDF and Microsoft Word Picture support to clsid command

      5 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The --pcode option is replaced by --show-pcode and --no-pcode in olevba
    5. v0.55 Dec 3, 2019 · release notes

      v0.55 adds P-code disassembly via --pcode in olevba and VBA stomping detection.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.55 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.55
      └──▷ TRY IT
      Extract and inspect the machine code of an Excel add-in that uses P-code instead of standard VBA macros.
      $ olevba --pcode malicious.xla
      • Adds --pcode option to olevba to extract and display P-code disassembly for Excel files
      • Adds VBA Stomping detection capability to olevba
      • Adds URL carver for CVE-2017-0199 to rtfobj

      3 details in Everything

    6. v0.54.2b May 23, 2019 · release notes

      oletools v0.54.2b adds support for decrypting files encrypted with common passwords.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.54.2b https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.54.2b
      • olevba and msodde automatically handle documents encrypted with common passwords (123, 4321, VelvetSweatShop).
      • msoffcrypto-tool is now a required dependency.

      2 details in Everything

    7. 0.54.2 May 22, 2019 · release notes

      oletools v0.54.2 now automatically handles documents encrypted with common passwords like 123 or VelvetSweatShop.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.54.2 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.54.2
    8. v0.54 Apr 8, 2019 · release notes

      oletools v0.54 adds encrypted file support, Excel 4 macro detection, and VBA suspicious keyword highlighting.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.54 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.54
      • olevba and msodde now support encrypted MS Office files
      • olevba detects and extracts XLM/XLF (Excel 4) macros
      • mraptor gains ability to detect VBA running Excel 4 macros

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The olevba3 and mraptor3 scripts have been removed; use olevba and mraptor instead.
    9. v0.53 Jun 13, 2018 · release notes

      oletools v0.53 adds Flat OPC parsing to olevba/mraptor, encrypted OpenXML detection to oleid, and enhanced OLE object identification in rtfobj/oledir.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.53 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.53
      • olevba and mraptor now parse Word/PowerPoint 2007+ pure XML files (Flat OPC format)
      • oledir displays the tree of storage/streams along with CLSIDs and their meaning
      • rtfobj emulates the MS Word bug for \\' obfuscation trick in RTF samples
      • common.clsid contains links to CVE vulnerabilities for known CLSIDs
      • oleid now detects encrypted OpenXML files

      5 details in Everything

    10. v0.52 Feb 18, 2018 · release notes

      Adds msodde tool to detect/extract DDE links from Office/RTF/CSV files.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.52 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.52
      └──▷ TRY IT
      Detect and extract DDE links from a suspicious document.
      $ msodde -r malware.docx
      • New VBA form parsing capability in the existing olevba command
      • New Office 2007+ support in the existing oleobj command

      2 details in Everything

    11. v0.51 Jun 29, 2017 · release notes

      oletools v0.51 adds oledir/olem/meta/oletimes wildcard support and DocVarDump.vba

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.51 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.51
      └──▷ USE IT
      Scan an entire directory of zipped office documents for hidden data using wildcards.
      shell 
      oledir -r 'documents/*.zip'
      Extract document variables from a Word file by running the new VBA script via MS Word.
      📍run DocVarDump.vba in MS Word to dump document variables
      • oledir, olemeta, and oletimes add support for zip files and wildcards
      • Adds DocVarDump.vba to dump document variables using Word

      2 details in Everything

    12. v0.50 Nov 1, 2016 · release notes

      oletools v0.50 adds mraptor_milter for Sendmail/Postfix, a new RTF parser in rtfobj, and universal Python 2/3 support

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.50 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.50
      • mraptor_milter for Sendmail/Postfix integration allows automated macro detection at the mail gateway.
      • New rtfobj parser detects executable files in OLE Package objects with improved display.

      2 details in Everything

    13. v0.47 Jun 10, 2016 · release notes

      oletools v0.47 adds PPT97 macro support, JSON exit codes, --relaxed flag, rtfobj -d option

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.47 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.47
      └──▷ TRY IT
      Parse PPT97 legacy documents that previous versions might miss.
      $ olevba --relaxed legacy_file.ppt
      • Adds PPT97 macros parsing in olevba
      • Makes olevba exit codes reflect analysis results for automation
      • Adds --relaxed CLI flag to olevba
      • Enables JSON output formatting in olevba
      • Adds -d option to rtfobj for setting output directory

      5 details in Everything

    14. v0.46 May 29, 2016 · release notes

      olevba adds --deobf flag to enable VBA expression deobfuscation

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.46 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout v0.46
      └──▷ USE IT
      Deobfuscate VBA macros in a malicious document to reveal hidden commands.
      shell 
      olevba --deobf suspicious.doc
    15. 0.45 Apr 12, 2016 · release notes

      oletools v0.45 adds anti-analysis handling to rtfobj and JSON export to olevba

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.45 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.45
      • olevba gains the ability to export analysis results in JSON format.
      • rtfobj improves handling of several anti-analysis tricks.

      2 details in Everything

    16. 0.43 Mar 4, 2016 · release notes

      oletools v0.43 introduces MacroRaptor (mraptor) for malicious macro detection

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.43 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.43
      • Adds new MacroRaptor tool available as the mraptor CLI command to detect malicious macros

      1 detail in Everything

    17. 0.41 Sep 22, 2015 · release notes

      olevba adds --reveal option to show deobfuscated macro code

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.41 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.41
    18. 0.40 Sep 17, 2015 · release notes

      oletools v0.40 improves macro deobfuscation in olevba to handle Hex and Base64 within VBA expressions.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.40 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.40
      • Improved olevba macro deobfuscation to decode Hex and Base64 within VBA expressions
      • Display printable deobfuscated strings by default in olevba
      • Improved the VBA_Parser API

      3 details in Everything

    19. 0.12 Jun 19, 2015 · release notes

      oletools v0.12 adds VBA deobfuscation and selective output options to olevba

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.12 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.12
      • olevba can now deobfuscate VBA expressions using a pyparsing-based parser supporting Chr, Asc, Val, StrReverse, Environ, +, and &.
      • Adds options to display only the analysis results or only the macros source code in olevba.
      • The VBA analysis is now performed on all modules simultaneously instead of individually.

      3 details in Everything

    20. 0.10 May 6, 2015 · release notes

      olevba adds support for Word MHTML (.mht) files with macros.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.10
      • olevba now parses Word MHTML (.mht) single-file web pages containing macros.

      1 detail in Everything

    21. 0.09 Mar 23, 2015 · release notes

      oletools v0.09 adds Word 2003 XML support to olevba and new anti-sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. detection

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.09 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.09
      • olevba now supports analyzing Word 2003 XML files
      • olevba added detection for anti-sandboxing/VM techniques

      2 details in Everything

    22. 0.08 Feb 8, 2015 · release notes

      olevba adds new triage mode and string decoding for Hex/StrReverse/Base64/Dridex in v0.08.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.08 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.08
      • Enables decoding of strings obfuscated with Hex, StrReverse, Base64, or Dridex in olevba

      1 detail in Everything

    23. 0.07 Jan 5, 2015 · release notes

      oletools 0.07 adds multi-file scan, password-protected ZIP support, and a Python API to olevba

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.07 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.07
      • olevba can now scan several files at once
      • olevba can open password-protected zip archives
      • Added a Python API for olevba

      3 details in Everything

    24. 0.06 Aug 28, 2014 · release notes

      Introduces olevba tool to extract VBA Macro source code from MS Office documents

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.06 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.06
    25. 0.03 Nov 9, 2012 · release notes

      oletools 0.03 adds pyxswf to extract Flash objects from RTF

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.03 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.03
    26. 0.02 Oct 29, 2012 · release notes

      Introduces the oleid command for analyzing Office documents.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.02 https://github.com/decalage2/oletools.git
# already have the repo? check out this version:
$ git checkout 0.02
      • Adds the oleid subcommand to identify file types and macros in OLE files.

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in decalage2/oletools, 2023-12 – 2026-11, as of 2026-11-03. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −3 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 33% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 468 of 664 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 468
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 3,425
    Issue themes, last 12 months
    • features 67%
    • other 33%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback