decalage2/oletools

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

3404 stars · 604 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

oletools is a Python package of tools for analyzing Microsoft OLE2 (Structured Storage/Compound File Binary Format) files and MS Office documents, including RTF and OpenXML formats. It can detect, extract, and analyze VBA macros, Excel 4/XLM macros, OLE objects, and DDE links, primarily for malware analysis, forensics, and debugging.

Use cases

• extract vba macros from office documents
• analyze malicious office files for malware
• parse ole2 compound file binary format
• detect suspicious macros in docx and xls files
• forensic analysis of outlook messages and msi files
• incident response triage of office attachments
• extract embedded ole objects from rtf files

When to choose

• you need to inspect or deobfuscate VBA or Excel 4/XLM macros in Office documents
• you are doing malware analysis, DFIR, or forensics on OLE/OOXML files
• you want a Python library plus CLI tools for parsing legacy Office formats

When to avoid

• you need to create or edit Office documents rather than analyze them
• you only need modern OOXML parsing without security analysis
• you need a GUI-based analysis tool

Facets

library · maturity active

parser security developer-tools cli security developer-tools files parsers python cli cross-platform malware-analysis dfir forensics vba-macros ole-files ms-office rtf openxml

Member repositories

For agents

markdown · JSON · MCP: product_card(name="decalage2/oletools")