tools

Overview

Oledump.py is a Python tool for analyzing OLE2 files and conducting static analysis on potentially malicious Office documents — particularly Excel files containing embedded VBA macros. OLE2 (Object Linking and Embedding) files use Compound File Binary Format to store multiple data types such as documents, spreadsheets, and presentations in a single file.

Target / Context

Suspicious Microsoft Office files (.xls, .doc, .ppt) that may contain embedded macros or malicious VBA code. Used during static malware analysis to inspect document internals without executing them.

Installation

ℹ︎Installation Commands: 
pip install oledump

Or download directly: https://blog.didierstevens.com/programs/oledump-py/

Basic Usage

ℹ︎Basic Usage: 
oledump.py <file>
oledump.py suspicious.xls

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-s <number>Select a specific data stream to inspectoledump.py file.xls -s 4
—vbadecompressDecompress VBA macros from selected stream (human-readable output instead of hex dump)oledump.py file.xls -s 4 —vbadecompress

Common Use Cases

List All Data Streams

Get an overview of all data streams in the file. Look for streams marked M indicating a macro.

ℹ︎Commands: 
oledump.py <file>

Inspect a Specific Data Stream

ℹ︎Commands: 
oledump.py <file> -s 4

Decompress and Read VBA Macro

ℹ︎Commands: 
oledump.py <file> -s 4 --vbadecompress

Interpreting Results

Oledump.py Output

IndicatorDescription
A: index with xl/vbaProject.binVBA script is embedded in the document
M next to a data streamThat stream contains a Macro
Data streams (A + numbers)Individual storage components within the OLE2 file

Tip: Start by listing all streams, identify any marked M, then use -s to select and --vbadecompress to read the macro code directly.

References / Images