mirror of
https://github.com/tldr-pages/tldr.git
synced 2025-04-29 23:24:55 +02:00
30 lines
815 B
Markdown
30 lines
815 B
Markdown
|
# olevba
|
||
|
|
|
||
|
|
> Parse OLE and OpenXML files (e.g., DOC, XLS, PPT, etc.) to extract VBA macros, deobfuscate, and analyze malicious code.
|
||
|
|
> Part of the `python-oletools` suite.
|
||
|
|
> For more information: <https://github.com/decalage2/oletools>.
|
||
|
|
|
||
|
|
- Analyze a file, showing both macro code and analysis results:
|
||
|
|
|
||
|
|
`olevba {{path/to/file}}`
|
||
|
|
|
||
|
|
- Recursively analyze all supported files in a directory:
|
||
|
|
|
||
|
|
`olevba -r {{path/to/directory}}`
|
||
|
|
|
||
|
|
- Provide a password for encrypted Microsoft Office files (may be repeated):
|
||
|
|
|
||
|
|
`olevba --password {{password}} {{path/to/encrypted_file}}`
|
||
|
|
|
||
|
|
- Display only analysis results, without showing macro source code:
|
||
|
|
|
||
|
|
`olevba -a {{path/to/file}}`
|
||
|
|
|
||
|
|
- Display only macro source code:
|
||
|
|
|
||
|
|
`olevba -c {{path/to/file}}`
|
||
|
|
|
||
|
|
- Show obfuscated strings and their decoded content:
|
||
|
|
|
||
|
|
`olevba --decode {{path/to/file}}`
|