Zis[2SrSSKJr SrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK r \ RR\ RR\ RR\555r\ RR\ RR%\S55r\\R;a\RR)S\5 SSKJr SSKJrJrJrJrJrJr SSKJr SS K J!r! \RD"S 5r#"S S \$5r%\%RLS \%RNS\%RPS\%RRS\%RTS\%RVS\%RXS0r-Sr."SS\$5r/"SS\$5r0Sr1\2S:Xa\1"5 gg)aT oleid.py oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics that could potentially indicate that the file is suspicious or malicious, in terms of security (e.g. malware). For example it can detect VBA macros, embedded Flash objects, fragmentation. The results is displayed as ascii table (but could be returned or printed in other formats like CSV, XML or JSON in future). oleid project website: http://www.decalage.info/python/oleid oleid is part of the python-oletools package: http://www.decalage.info/python/oletools )print_functionz0.60.1Nz..) tablestream)cryptoftguessolevbamraptoroleobjooxml) log_helper)get_codepage_nameoleidc4\rSrSrSrSrSrSrSrSr Sr S r S r g ) RISKoz Constants for risk levels HIGHMediumlownoneinfoUnknownErrorN) __name__ __module__ __qualname____firstlineno____doc__rMEDIUMLOWNONEINFOUNKNOWNERROR__static_attributes__rh/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/oleid.pyrros, D F C D DG Er%rredyellowwhitegreencyanc/n[R"SU5HnUR5nUS-[U5:aM'XUS-n[R "SXS-US-5SnUS:aMX[R "SXS-US-5SnX6-[U5:dUS :aMXX6-nS nS U;aS nUSS n [ R"U 5 URX6U45 M U$![a Mf=f)a Detect Flash objects (SWF files) within a binary string of data return a list of (start_index, length, compressed) tuples, or [] if nothing found. Code inspired from xxxswf.py by Alexander Hanel (but significantly reworked) http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html sCWS|FWSz>A #^#e#e )$$&H  IIHMr%c[SSSS[RS9nURR U5 UR (dgUR R S5(aSUl[RUl U$)z Check whether this file contains an ObjectPool stream. Such a stream would be a strong indicator for embedded objects or files. :returns: :py:class:`Indicator` for ObjectPool stream or None if file was not opened ObjectPoolFzlContains an ObjectPool stream, very likely to contain embedded OLE objects or files. Use oleobj to check it.)rLrMrNNT) rFrr rgr:reexistsrJrrN)rPobjpools r&rOleID.check_object_poolsl %lQ  w'xx 88??< ( ( GM88GLr%c D[SS[SS[RSS9nURR U5 [SS[SS [RSS9nURR U5 UR R[RR:XaS Ul S Ul X4$S n[R"URURS 9nUR!5(aSUl[R$UlSUl UR)5n[*R,"U5nUR/5 UR0(a#SUl[R2UlSUl UbUR95 S nUR R;5(aUR<(am[R"URS9nUR?5(a#SUl[R$UlSUl UbUR95 X4$[R@UlSUlSUl X4$![4a:n[R6UlSUlS[U5-Ul S nAGNS nAff=f!UbUR95 S nf=f![4a9n[R6UlSUlS[U5-Ul S nANS nAff=f!UbUR95 ff=f)za Check whether this file contains macros (VBA and XLM/Excel 4). :returns: :py:class:`Indicator` vbaNoz VBA Macrosz&This file does not contain VBA macros.F)rQrJrRrLrMrNrOxlmz XLM Macrosz.This file does not contain Excel 4/XLM macros.z#RTF files cannot contain VBA macrosz#RTF files cannot contain XLM macrosN)rfr;YeszeThis file contains VBA macros. No suspicious keyword was found. Use olevba and mraptor for more info.zYes, suspiciouszdThis file contains VBA macros. Suspicious keywords were found. Use olevba and mraptor for more info.rz#Error while checking VBA macros: %s)rfz:This file contains XLM macros. Use olevba to analyse them.z#Error while checking XLM macros: %srzIFor now, XLM macros can only be detected for files on disk, not in memory)!rFrrr rgr:rwrxrryRTFrMr VBA_Parserrfr;detect_vba_macrosrJrrNget_vba_code_all_modulesr MacroRaptorscan suspiciousrr9r#ris_excelr\detect_xlm_macrosr")rP vba_indicator xlm_indicator vba_parservba_codemes r&rOleID.check_macross "e4s.V'+yyG  }-!e4s.^'+yyG  }- 88   1 1 1(MM %(MM % / /  **DMM RJ++--&+ #%)[[ "-T )%>>@''1<<*;M')-M&1WM- %  "J 88       +!'!2!2DMM!JJ!3355.3 +-1[[ *4p 1 "-"((* ++ &*\\ "&/ #,w )++? W!%M ")M (MPSTUPV(VM % % W %  "J!_)-M&*1M'0UX[\]X^0^M--_ "-"((*.sV?C I"AK" J&,/J!J)!J&&J))K L /L<L LL Lc [SS[SS[RS9nURR U5 UR (dgUR R5HUnUR RU5R5n[U5nU=R[U5- sl MW URS:a[RUlU$)z Check whether this file contains flash objects :returns: :py:class:`Indicator` for count of flash objects or None if file was not opened flashrz Flash objectszvNumber of embedded Flash objects (SWF files) detected in OLE streams. Not 100% accurate, there may be false positives.rN)rFrrr rgr:relistdir openstreamr^rDrJr4rrN)rPrstreamr;r<s r&rOleID.check_flashs Qc%  u%xxhh&&(F88&&v.335D &E KK3u: %K ) ;;?EJ r%)r;rar\rfrwrgrerh)NN)rrrrrrSrorrrrrrrr$rr%r&rWrWs8 !D.`)6882A,Fr%rWc b[S[-5 [S5 [S5 [S5 [R"[S9nUR S[ SSS S 9 UR5n[UR5S :XaUR5 g [R"5 URHn[S U5 [U5nUR5n[R "/SQ/SQ[R"S9nUHnUR$(aUR&(dM'[(R+UR,S 5nUR/UR0UR&UR,UR24XwUS 4S9 M UR55 M g )zFCalled when running this file as script. Shows all info on input file.z(oleid %s - http://decalage.info/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issuesrs)rMinput*FILEzName of files to process)rKnargsmetavarhelprNz Filename:)r0r0 )rFValueRisk Description) header_rowstyle)colors)print __version__argparseArgumentParserr add_argumentr parse_argsr4r print_helpr enable_loggingrWrr TableStreamTableStyleSlimSeprOrJ risk_colorgetrN write_rowrLrMr)parserargsrfr rgtablermcolors r&mainrs\ 4{ BC ?@  9: "I  $ $ 9F cf79    D 4::!JJ k8$h[[] ''(83`.9.K.KM$I++IOOO"y~~t<)..R[RgRg h(-eT'B D $  r%__main__)3r __future__rrrsysr1r7r5osr_rcpathnormpathabspathdirname__file___thismodule_dirr _parent_dirinsertoletools.thirdparty.tablestreamroletoolsrrrrr r oletools.common.log_helperr oletools.common.codepagesr get_or_create_silent_loggerrobjectrrrrr r!r"r#rrDrFrWrrrr%r&rsIV&$ */...''""277??277??83L#MNggrww||OTBC chhHHOOA{#7DD17,,W5 6  IIuKKHHgIIwIIvLL$JJ 0j++(kFk` 'R zFr%