If you follow my video blog, you’ve seen my oledump videos and downloaded the preview version. Here is the “official” release.
oledump.py is a program to analyze OLE files (Compound File Binary Format). These files contain streams of data. oledump allows you to analyze these streams.
Many applications use this file format, the best known is MS Office. .doc, .xls, .ppt, … are OLE files (docx, xlsx, … is the new file format: XML insize ZIP).
Run oledump on an .xls file and it will show you the streams:
The letter M next to stream 7, 8, 9 and 10 indicate that the stream contains VBA macros.
You can select a stream to dump its content:
The source code of VBA macros is compressed when stored inside a stream. Use option -v to decompress the VBA macros:
You can write plugins (in Python) to analyze streams. I developed 3 plugins. Plugin plugin_http_heuristics.py uses a couple of tricks to extract URLs from malicious, obfuscated VBA macros, like this:
You might have noticed that the file analyzed in the above screenshot is a zip file. Like many of my analysis programs, oledump.py can analyze a file inside a (password protected) zip file. This allows you to store your malware samples in password protected zip files (password infected), and then analyze them without having to extract them.
If you install the YARA Python module, you can scan the streams with YARA rules:
And if you suspect that the content of a stream is encoded, for example with XOR, you can try to brute-force the XOR key with a simple decoder I provide (or you can develop your own decoder in Python):
This program requires Python module OleFileIO_PL: http://www.decalage.info/python/olefileio
oledump_V0_0_3.zip (https)
MD5: 9D5AA950C9BFDB16D63D394D622C6767
SHA256: 44D8C675881245D3336D6AB6F9D7DAF152B14D7313A77CB8F84A71B62E619A70
Didier Stevens 