oletools: Spotting Malicious Macros in Office Documents

<!– wp:paragraph –>
<p>oletools is a defensive toolkit for inspecting Office documents for embedded macros and other suspicious content. Here’s what it does, how it’s structured, and where it fits in a document-triage workflow.</p>
<!– /wp:paragraph –>

<!– wp:heading –>
<h2 class=”wp-block-heading”>What oletools is for</h2>
<!– /wp:heading –>

<!– wp:paragraph –>
<p><strong>oletools</strong> is a Python-based toolkit, packaged in Kali Linux since the 2026.2 release, built for analysts who need to look inside an Office document without opening it in Word or Excel. A malicious document’s danger usually lives in an embedded VBA macro, an OLE object, or a crafted structure designed to exploit the application that opens it – oletools is built to surface all of that safely, from the command line, without running any of it.</p>
<!– /wp:paragraph –>

<!– wp:paragraph –>
<p>It supports both the older OLE compound-file format (.doc, .xls, .ppt) and the newer OOXML zip-based format (.docx, .xlsx, .pptx), which between them cover essentially every Office document you’re likely to receive.</p>
<!– /wp:paragraph –>

<!– wp:heading –>
<h2 class=”wp-block-heading”>The tools inside the suite</h2>
<!– /wp:heading –>

<!– wp:paragraph –>
<p>oletools is really a collection of focused scripts rather than one monolithic tool:</p>
<!– /wp:paragraph –>

<!– wp:list –>
<ul class=”wp-block-list”><!– wp:list-item –>
<li><strong>olevba</strong> – extracts and decodes VBA macro source code from a document, including common obfuscation tricks, so you can read what a macro would actually do without running it.</li>
<!– /wp:list-item –><!– wp:list-item –>
<li><strong>oleid</strong> – a quick first-pass risk indicator: flags encryption, macros, embedded objects and other structural red flags in one summary.</li>
<!– /wp:list-item –><!– wp:list-item –>
<li><strong>olemeta</strong> – pulls document metadata (author, company, creation and last-saved timestamps, application used), which is often useful for attributing a document to a particular campaign or builder tool.</li>
<!– /wp:list-item –><!– wp:list-item –>
<li><strong>oletimes</strong> – extracts every timestamp stored in the file structure, useful for spotting inconsistencies that suggest a document was tampered with after creation.</li>
<!– /wp:list-item –><!– wp:list-item –>
<li><strong>rtfobj</strong> and <strong>msodde</strong> – handle embedded objects in RTF files and DDE-based execution tricks respectively, two formats that have historically been used to smuggle code past macro-focused scanners.</li>
<!– /wp:list-item –></ul>
<!– /wp:list –>

<!– wp:heading –>
<h2 class=”wp-block-heading”>Where it fits in a triage workflow</h2>
<!– /wp:heading –>

<!– wp:paragraph –>
<p>A typical first pass looks like: run <strong>oleid</strong> for a fast risk summary, then <strong>olevba</strong> if macros are present, then <strong>olemeta</strong>/<strong>oletimes</strong> if you need attribution or tamper evidence. None of this requires opening the file in a vulnerable application, and none of it executes the macro – it’s static analysis of the file structure and the macro source text.</p>
<!– /wp:paragraph –>

<!– wp:paragraph –>
<p>That makes it a reasonable fit for a mail-gateway sandbox pipeline, a SOC analyst’s first-response kit, or anyone building their own lightweight document-scanning step ahead of a full dynamic-analysis sandbox.</p>
<!– /wp:paragraph –>

<!– wp:heading –>
<h2 class=”wp-block-heading”>Installing it</h2>
<!– /wp:heading –>

<!– wp:paragraph –>
<p>On Kali, it’s in the standard repositories as of 2026.2 – a normal <code>apt install oletools</code> pulls in the whole suite. It’s also available via pip on any platform with Python 3, since none of the individual scripts depend on anything Kali-specific.</p>
<!– /wp:paragraph –>

<!– wp:heading –>
<h2 class=”wp-block-heading”>A sensible caution</h2>
<!– /wp:heading –>

<!– wp:paragraph –>
<p>Even though oletools only reads a document rather than executing it, treat any document you’re actively investigating as hostile: work from a snapshot or disposable VM, keep it off a network share, and don’t open the original file in Word or Excel until you know what’s in it.</p>
<!– /wp:paragraph –>