Each stream and storage can have an indicator in oledump.py‘s output:
You’ll probably know M and m: they are indicators that appear often.
Here is an overview of all possible indicators:
- M: Macro (attributes and code)
- m: macro (attributes without code)
- E: Error (code that throws an error when decompressed)
- !: Unusual macro (code without attributes)
- O: object (embedded file)
- .: storage
- R: root entry
Didier Stevens 
Leave a Reply (comments are moderated)