# decalage2/oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Repository: https://github.com/decalage2/oletools
Canonical: https://ross.abutalabs.com/products/oletools
Homepage: http://www.decalage.info/python/oletools
Language: Python
License: NOASSERTION
License Family: other
Topics: python, python-library, olefile, malware-analysis, ms-office-documents, compound, rtf, forensics, ole-files, security, parser, pyparsing, vba, macros
Last push: 2026-02-14T19:42:44+00:00

## Health v2 (maintenance only)
Score: 53/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 67, release rhythm 8, longevity 100
- inputs: {"age_days": 3756, "days_push": 200, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3404, forks 604 (observed 2026-08-28T04:08:02.914163+00:00)

## What it is
oletools is a Python package of tools for analyzing Microsoft OLE2 (Structured Storage/Compound File Binary Format) files and MS Office documents, including RTF and OpenXML formats. It can detect, extract, and analyze VBA macros, Excel 4/XLM macros, OLE objects, and DDE links, primarily for malware analysis, forensics, and debugging.

## Use cases
- extract vba macros from office documents
- analyze malicious office files for malware
- parse ole2 compound file binary format
- detect suspicious macros in docx and xls files
- forensic analysis of outlook messages and msi files
- incident response triage of office attachments
- extract embedded ole objects from rtf files

## When to choose
- you need to inspect or deobfuscate VBA or Excel 4/XLM macros in Office documents
- you are doing malware analysis, DFIR, or forensics on OLE/OOXML files
- you want a Python library plus CLI tools for parsing legacy Office formats

## When to avoid
- you need to create or edit Office documents rather than analyze them
- you only need modern OOXML parsing without security analysis
- you need a GUI-based analysis tool

## Facets
- artifact type: library
- maturity: active
- function: parser, security, developer-tools, cli
- domain: security, developer-tools, files, parsers
- platform: python, cli, cross-platform
- tags: malware-analysis, dfir, forensics, vba-macros, ole-files, ms-office, rtf, openxml

## Member repositories
- decalage2/oletools (main) score 53

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:02.914163+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:38:37.188550+00:00, confidence not recorded.
  - readme: https://github.com/decalage2/oletools (fetched 2026-08-28T04:08:02.914163+00:00, sha b634db7caffd)
  - homepage: http://www.decalage.info/python/oletools (fetched 2026-08-29T09:32:50.625723+00:00, sha 9180e9aa94f4)
  - registry_pypi: https://pypi.org/pypi/oletools/json (fetched 2026-08-29T09:32:50.635363+00:00, sha 7bfc9436c75d)
- Data as of 2026-08-30T08:39:29.467469+00:00.