Oletools

This is an automation to run oletools malware analysis for office files. Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging. This automation allows performing some basic oletools commands from Cortex XSOAR. Note that oletools is open source code and is subject to change.

python · Oletools

Details

IDOletools
Languagepython
From Version6.5.0
Docker Imagedemisto/parse-emails:1.0.0.3555598

README

This is an automation to run oletools malware analysis for office files. Oletools is a tool
for analyzing Microsoft OLE2 files,
such as Microsoft Office documents or Outlook messages, mainly for malware analysis,
forensics, and debugging.
Note that oletools is open source code and is subject to change.

Script Data

Name Description
Script Type python3
Cortex XSOAR Version 6.5.0

Inputs

Argument Name Description
ole_command The OLE command to activate.
- oleid - to analyze OLE files to detect specific characteristics usually found in malicious files.
- oleobj - to extract embedded objects from OLE files.
- olevba- to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).
entryID The file to activate the oletools analysis on.
decode Display all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA). Note that this works only with the olevba command
password If encrypted office files are encountered, try decryption with this password. May be repeated.

Outputs

Path Description Type
Oletools.Oleid.ole_command_result Indicator list from the oleid command. Unknown
Oletools.Oleid.file_name File name Unknown
Oletools.Oleid.sha256 SHA256 hash. Unknown
Oletools.Oleid.ole_command_result.File_format Indicator file format. Unknown
Oletools.Oleid.ole_command_result.File_format.Value Indicator file format value. Unknown
Oletools.Oleid.ole_command_result.File_format.Ole_Risk Indicator file format OLE risk. Unknown
Oletools.Oleid.ole_command_result.File_format.Description Indicator file format description. Unknown
Oletools.Oleid.ole_command_result.Container_format Indicator container format. Unknown
Oletools.Oleid.ole_command_result.Container_format.Value Indicator container format value Unknown
Oletools.Oleid.ole_command_result.Container_format.Ole_Risk Indicator container format OLE risk. Unknown
Oletools.Oleid.ole_command_result.Container_format.Description Indicator container format description. Unknown
Oletools.Oleid.ole_command_result.Encrypted Indicator encrypted. Unknown
Oletools.Oleid.ole_command_result.Encrypted.Value Indicator encrypted value. Unknown
Oletools.Oleid.ole_command_result.Encrypted.Ole_Risk Indicator encrypted OLE risk. Unknown
Oletools.Oleid.ole_command_result.Encrypted.Description Indicator encrypted description. Unknown
Oletools.Oleid.ole_command_result.VBA_Macros Indicator VBA macros. Unknown
Oletools.Oleid.ole_command_result.VBA_Macros.Value Indicator VBA macros value. Unknown
Oletools.Oleid.ole_command_result.VBA_Macros.Ole_Risk Indicator VBA macros OLE risk. Unknown
Oletools.Oleid.ole_command_result.VBA_Macros.Description Indicator VBA macros description. Unknown
Oletools.Oleid.ole_command_result.XLM_Macros Indicator XLM macros. Unknown
Oletools.Oleid.ole_command_result.XLM_Macros.Value Indicator XLM macros value. Unknown
Oletools.Oleid.ole_command_result.XLM_Macros.Ole_Risk Indicator XLM macros OLE risk. Unknown
Oletools.Oleid.ole_command_result.XLM_Macros.Description Indicator XLM macros description. Unknown
Oletools.Oleid.ole_command_result.External_Relationships Indicator external relationships. Unknown
Oletools.Oleid.ole_command_result.External_Relationships.Value Indicator XLM macros value. Unknown
Oletools.Oleid.ole_command_result.External_Relationships.Ole_Risk Indicator XLM macros OLE risk. Unknown
Oletools.Oleid.ole_command_result.External_Relationships.Description Indicator XLM macros description. Unknown
Oletools.Oleid.ole_command_result.ObjectPool Indicator object pool. Unknown
Oletools.Oleid.ole_command_result.ObjectPool.Value Indicator object pool value. Unknown
Oletools.Oleid.ole_command_result.ObjectPool.Ole_Risk Indicator object pool OLE risk. Unknown
Oletools.Oleid.ole_command_result.ObjectPool.Description Indicator object pool description. Unknown
Oletools.Oleid.ole_command_result.Flash_objects Indicator flash objects. Unknown
Oletools.Oleid.ole_command_result.Flash_objects.Value Indicator flash objects value. Unknown
Oletools.Oleid.ole_command_result.Flash_objects.Ole_Risk Indicator flash objects OLE risk. Unknown
Oletools.Oleid.ole_command_result.Flash_objects.Description Indicator flash objects description. Unknown
Oletools.Oleobj.ole_command_result.hyperlinks List of hyperlinks. Unknown
Oletools.Oleobj.file_name File name. Unknown
Oletools.Oleobj.sha256 SHA256 hash. Unknown
Oletools.Olevba.file_name File name. Unknown
Oletools.Olevba.sha256 SHA256 hash. Unknown
Oletools.Olevba.ole_command_result.macro_analyze Macro analyze. Unknown
Oletools.Olevba.ole_command_result.macro_src_code Macro source code. Unknown
Oletools.Olevba.ole_command_result.macro_list Macro list. Unknown

Source

OletoolsScript.py OletoolsScript_test.py OletoolsScript.yml
Download History Raw 
commonfields:
  id: Oletools
  version: -1
name: Oletools
script: ''
type: python
args:
- description: The ole command to activate. oleid - to analyze OLE files to detect specific characteristics usually found in malicious files. oleobj - to extract embedded objects from OLE files. olevba - to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).
  name: ole_command
  required: true
  auto: PREDEFINED
  predefined:
  - 'oleid'
  - 'oleobj'
  - 'olevba'
- description: The file to activate the oletools analysis on.
  name: entryID
  required: true
- description: Display all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA). Note that this works only with the olevba command.
  name: decode
  type: String
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
- description: If encrypted office files are encountered, try decryption with this password. (if specified dont specify the non_secret_password parameter).
  name: password
  secret: true
- description: If encrypted office files are encountered, try decryption with this password. This argument is non secret for playbook flows. (if specified dont specify the password parameter).
  name: non_secret_password
comment: This is an automation to run oletools malware analysis for office files. Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging. This automation allows performing some basic oletools commands from Cortex XSOAR. Note that oletools is open source code and is subject to change.
outputs:
- contextPath: Oletools.Oleid.ole_command_result
  description: Indicator list from the oleid command.
- contextPath: Oletools.Oleid.file_name
  description: File name.
- contextPath: Oletools.Oleid.sha256
  description: SHA256 hash.
- contextPath: Oletools.Oleid.ole_command_result.File_format
  description: Indicator file format.
- contextPath: Oletools.Oleid.ole_command_result.File_format.Value
  description: Indicator file format value.
- contextPath: Oletools.Oleid.ole_command_result.File_format.Ole_Risk
  description: Indicator file format OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.File_format.Description
  description: Indicator file format description.
- contextPath: Oletools.Oleid.ole_command_result.Container_format
  description: Indicator container format.
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Value
  description: Indicator container format value.
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Ole_Risk
  description: Indicator container format OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Description
  description: Indicator container format description.
- contextPath: Oletools.Oleid.ole_command_result.Encrypted
  description: Indicator encrypted.
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Value
  description: Indicator encrypted value.
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Ole_Risk
  description: Indicator encrypted OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Description
  description: Indicator encrypted description.
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros
  description: Indicator VBA macros.
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Value
  description: Indicator VBA macros value.
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Ole_Risk
  description: Indicator VBA macros OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Description
  description: Indicator VBA macros description.
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros
  description: Indicator XLM macros.
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Value
  description: Indicator XLM macros value.
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Ole_Risk
  description: Indicator XLM macros OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Description
  description: Indicator XLM macros description.
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships
  description: Indicator external relationships.
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Value
  description: Indicator XLM macros value.
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Ole_Risk
  description: Indicator XLM macros OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Description
  description: Indicator XLM macros description.
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool
  description: Indicator object pool.
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Value
  description: Indicator object pool value.
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Ole_Risk
  description: Indicator object pool OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Description
  description: Indicator object pool description.
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects
  description: Indicator flash objects.
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Value
  description: Indicator Flash objects value.
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Ole_Risk
  description: Indicator Flash objects OLE risk.
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Description
  description: Indicator Flash objects description.
- contextPath: Oletools.Oleobj.ole_command_result.hyperlinks
  description: List of hyperlinks.
- contextPath: Oletools.Oleobj.file_name
  description: File name.
- contextPath: Oletools.Oleobj.sha256
  description: SHA256 hash.
- contextPath: Oletools.Olevba.file_name
  description: File name.
- contextPath: Oletools.Olevba.sha256
  description: SHA256 hash.
- contextPath: Oletools.Olevba.ole_command_result.macro_analyze
  description: Macro analyze.
- contextPath: Oletools.Olevba.ole_command_result.macro_src_code
  description: Macro source code.
- contextPath: Oletools.Olevba.ole_command_result.macro_list
  description: Macro list.
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
- contextPath: DBotScore.Type
  description: The indicator type.
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
- contextPath: DBotScore.Score
  description: The actual score.
subtype: python3
dockerimage: demisto/parse-emails:1.0.0.3555598
tests:
- No tests (auto formatted)
fromversion: 6.5.0