diff --git a/oletools/doc/olevba.html b/oletools/doc/olevba.html
index 121f9be5..010347b7 100644
--- a/oletools/doc/olevba.html
+++ b/oletools/doc/olevba.html
@@ -82,23 +82,24 @@
olevba
-olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect VBA Macros, extract their source code in clear text, and detect security-related patterns such as auto-executable macros, suspicious VBA keywords used by malware, anti-sandboxing and anti-virtualization techniques, and potential IOCs (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common obfuscation methods including Hex encoding, StrReverse, Base64, Dridex, VBA expressions, and extracts IOCs from decoded strings.
+olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect VBA Macros, extract their source code in clear text, and detect security-related patterns such as auto-executable macros, suspicious VBA keywords used by malware, anti-sandboxing and anti-virtualization techniques, and potential IOCs (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common obfuscation methods including Hex encoding, StrReverse, Base64, Dridex, VBA expressions, and extracts IOCs from decoded strings. XLM/Excel 4 Macros are also supported in Excel and SLK files.
It can be used either as a command-line tool, or as a python module from your own applications.
It is part of the python-oletools package.
olevba is based on source code from officeparser by John William Davison, with significant modifications.
-- Word 97-2003 (.doc, .dot)
-- Word 2007+ (.docm, .dotm)
+- Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)
+- Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb)
+- PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm)
+- Word/PowerPoint 2007+ XML (aka Flat OPC)
- Word 2003 XML (.xml)
-- Word/Excel MHTML, aka Single File Web Page (.mht)
-- Excel 97-2003 (.xls)
-- Excel 2007+ (.xlsm, .xlsb)
-- PowerPoint 2007+ (.pptm, .ppsm)
+- Word/Excel Single File Web Page / MHTML (.mht)
+- Publisher (.pub)
+- SYLK/SLK files (.slk)
- Text file containing VBA or VBScript source code
- Password-protected Zip archive containing any of the above
-Main Features
+S## Main Features
- Detect VBA macros in MS Office 97-2003 and 2007+ files, XML, MHT
- Extract VBA macro source code
diff --git a/oletools/doc/olevba.md b/oletools/doc/olevba.md
index 458020a3..8d18dcac 100644
--- a/oletools/doc/olevba.md
+++ b/oletools/doc/olevba.md
@@ -8,6 +8,7 @@ VBA keywords** used by malware, anti-sandboxing and anti-virtualization techniqu
and potential **IOCs** (IP addresses, URLs, executable filenames, etc).
It also detects and decodes several common **obfuscation methods including Hex encoding,
StrReverse, Base64, Dridex, VBA expressions**, and extracts IOCs from decoded strings.
+XLM/Excel 4 Macros are also supported in Excel and SLK files.
It can be used either as a command-line tool, or as a python module from your own applications.
@@ -18,17 +19,18 @@ by John William Davison, with significant modifications.
## Supported formats
-- Word 97-2003 (.doc, .dot)
-- Word 2007+ (.docm, .dotm)
+- Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)
+- Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb)
+- PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm)
+- Word/PowerPoint 2007+ XML (aka Flat OPC)
- Word 2003 XML (.xml)
-- Word/Excel MHTML, aka Single File Web Page (.mht)
-- Excel 97-2003 (.xls)
-- Excel 2007+ (.xlsm, .xlsb)
-- PowerPoint 2007+ (.pptm, .ppsm)
+- Word/Excel Single File Web Page / MHTML (.mht)
+- Publisher (.pub)
+- SYLK/SLK files (.slk)
- Text file containing VBA or VBScript source code
- Password-protected Zip archive containing any of the above
-## Main Features
+S## Main Features
- Detect VBA macros in MS Office 97-2003 and 2007+ files, XML, MHT
- Extract VBA macro source code
diff --git a/oletools/olevba.py b/oletools/olevba.py
index 6270c8e6..f7672086 100644
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -5,6 +5,7 @@
olevba is a script to parse OLE and OpenXML files such as MS Office documents
(e.g. Word, Excel), to extract VBA Macro code in clear text, deobfuscate
and analyze malicious macros.
+XLM/Excel 4 Macros are also supported in Excel and SLK files.
Supported formats:
- Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)
@@ -14,6 +15,9 @@
- Word 2003 XML (.xml)
- Word/Excel Single File Web Page / MHTML (.mht)
- Publisher (.pub)
+ - SYLK/SLK files (.slk)
+ - Text file containing VBA or VBScript source code
+ - Password-protected Zip archive containing any of the above
- raises an error if run with files encrypted using MS Crypto API RC4
Author: Philippe Lagadec - http://www.decalage.info