Hello everyone and welcome to another video of Expert Malware analysis and reverse engineering. 1
So moving ahead from our previous video where we analyzed a malicious office file using oledumb. 2
In this video, we are going to focus on another very critical tool called oletools. 3
It's a very good tool and it's open source and it's specifically designed for analyzing or OLE file 4
formats. 5
So here is the home page of 6
oletools. 7
It has been developed by a Decalage. 8
You can read a lot about the documentation, about the set up, how you can have it ready and working. 9
So there are multiple sub-tools within only tools as well. 10
And here is an exhaustive list of all the tools that are present. 11
We will be going through a few of them in our current video. 12
So how do we go ahead and installoletools. 13
Well the easiest way is if you are on a Linux machine you simply run the command sudo -H pip install -U oletools 14
all we need to. 15
That's it. 16
That should be the command to install it on Linux. If you are on Windows, 17
And if you have powershell up and running and if you have Flare as well, PIP will be working for you 18
on the Windows environment as well. 19
And you can run the same command to have oletools installed on your machine. 20
The other way is to go to the official github page for oletools. 21
So that's the link for the github page and you'll see the entire code base of oletools here. 22
If you go the folder oletools, you'll see that all the sub tools that we saw on the home page 23
are mentioned here as python files. 24
So what we need to do here is to just click on clone or download and just download the zip file. 25
Once you download and unzip it on your desktop it will create a folder called oletools-master. 26
So once that folders present, just go to that directory. let me just show you the folder once. 27
So this will be the content of the folder. 28
There will be a file called setup.py 29
So to have oletools installed 30
Just go to the particular directory where you have unzipped all the tools given the command button set 31
python setup.py install. 32
So once the installation goes through, oletools will be ready to use on your computer. 33
So once the entire set up is run you'll see that the oletools folder now exists in your directory. 34
You can either have this oletools folder moved inside Flare office so that it kind of makes it 35
easy for you to keep track of all the office file analysis tools and later on you can reference them 36
then if what you want. 37
That would be a very ideal step because that will keep your tools in a very logical and arranged manner 38
so that it's easy for you to look for them and use them whenever you need. 39
So let's come back to powershell and move to oletools directory 40
So some of the major tools that we want to cover here. 41
The first one would be oleid, then will cover olemeta, oledir, olemap and olevba. 42
There are a bunch of other tools as well. 43
And I encourage you to just go ahead and play with them as well.