{"library":"oletools","title":"oletools: OLE Analysis Tools","description":"oletools is a Python package providing a collection of tools to analyze Microsoft Office and OLE (Object Linking and Embedding) files, also known as Structured Storage or Compound Document File Format. It's primarily used for malware analysis and incident response (DFIR). The current version is 0.60.2, with an active release cadence focused on bug fixes and new detection capabilities.","language":"python","status":"active","last_verified":"Thu May 14","install":{"commands":["pip install oletools"],"cli":{"name":"oleid","version":"usage: oleid [-h] [FILE ...]"}},"imports":["from oletools.olevba import VBA_Parser","from oletools.oleid import OleID","from oletools.oleobj import OleObject"],"auth":{"required":false,"env_vars":[]},"quickstart":{"code":"import os\nfrom oletools.olevba import VBA_Parser, get_filepath_or_data\n\n# Create a dummy OLE file for demonstration\ndummy_file_path = 'dummy_macro.doc'\nwith open(dummy_file_path, 'wb') as f:\n    # A very basic, non-functional OLE header structure\n    # In a real scenario, this would be a proper MS Office file\n    f.write(b'\\xD0\\xCF\\x11\\xE0\\xA1\\xB1\\x1A\\xE1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00')\n    f.write(b'\\x00' * 500) # Padding to make it somewhat resemble a file\n\ntry:\n    # Initialize VBA_Parser with the file path\n    # olevba handles file paths and file-like objects\n    vbaparser = VBA_Parser(dummy_file_path)\n\n    if vbaparser.detect_vba_macros():\n        print(f\"VBA Macros detected in {dummy_file_path}:\")\n        # Analyze and print macro details\n        results = vbaparser.analyze_macros()\n        for kw, description, typ, filename, original_code, code in results:\n            print(f\"  [{typ}] {kw}: {description}\")\n            if code:\n                print(f\"    Code:\\n{code[:200]}...\")\n    else:\n        print(f\"No VBA macros detected in {dummy_file_path}.\")\n\n    vbaparser.close()\n\nexcept Exception as e:\n    print(f\"An error occurred: {e}\")\nfinally:\n    # Clean up the dummy file\n    if os.path.exists(dummy_file_path):\n        os.remove(dummy_file_path)","lang":"python","description":"This example demonstrates how to use `olevba` to detect and analyze VBA macros in a (dummy) OLE file. In a real scenario, `dummy_file_path` would point to an actual Office document. The `VBA_Parser` provides methods for macro detection, analysis, and extraction of suspicious keywords and IOCs. Remember to close the parser with `vbaparser.close()` to release file handles.","tag":null,"tag_description":null,"last_tested":"2026-04-25","results":[{"runtime":"python:3.10-alpine","exit_code":1},{"runtime":"python:3.10-slim","exit_code":1},{"runtime":"python:3.11-alpine","exit_code":1},{"runtime":"python:3.11-slim","exit_code":1},{"runtime":"python:3.12-alpine","exit_code":1},{"runtime":"python:3.12-slim","exit_code":1},{"runtime":"python:3.13-alpine","exit_code":1},{"runtime":"python:3.13-slim","exit_code":1},{"runtime":"python:3.9-alpine","exit_code":1},{"runtime":"python:3.9-slim","exit_code":1}]},"compatibility":{"tag":null,"tag_description":null,"last_tested":"2026-05-14","installed_version":"0.60.2","pypi_latest":"0.60.2","is_stale":false,"summary":{"python_range":"3.10–3.9","success_rate":100,"avg_install_s":2.9,"avg_import_s":0.5,"wheel_type":"wheel"},"results":[{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":null,"import_time_s":0.42,"mem_mb":11.6,"disk_size":"39.8M"},{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.45,"mem_mb":11.6,"disk_size":"39.7M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":2.9,"import_time_s":0.33,"mem_mb":11.6,"disk_size":"40M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.38,"mem_mb":11.6,"disk_size":"40M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":null,"import_time_s":0.58,"mem_mb":13,"disk_size":"42.7M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.73,"mem_mb":13,"disk_size":"42.5M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":2.9,"import_time_s":0.55,"mem_mb":13,"disk_size":"43M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.53,"mem_mb":13,"disk_size":"43M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":null,"import_time_s":0.5,"mem_mb":12.6,"disk_size":"34.3M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.61,"mem_mb":12.6,"disk_size":"34.1M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":2.5,"import_time_s":0.52,"mem_mb":12.6,"disk_size":"35M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.66,"mem_mb":12.6,"disk_size":"35M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":null,"import_time_s":0.51,"mem_mb":12.9,"disk_size":"34.1M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.56,"mem_mb":12.9,"disk_size":"33.8M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":2.5,"import_time_s":0.48,"mem_mb":12.9,"disk_size":"34M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.62,"mem_mb":12.9,"disk_size":"34M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":null,"import_time_s":0.35,"mem_mb":11.8,"disk_size":"40.0M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.39,"mem_mb":11.8,"disk_size":"39.9M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":"wheel","failure_reason":null,"import_side_effects":"noisy","install_time_s":3.5,"import_time_s":0.31,"mem_mb":11.6,"disk_size":"40M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"oletools","exit_code":0,"wheel_type":null,"failure_reason":null,"import_side_effects":null,"install_time_s":null,"import_time_s":0.43,"mem_mb":11.6,"disk_size":"40M"}]}}