So then start with oleid first. 1
So the running of oletools is pretty much the same as we did with oledumb. 2
They all run with python command. So just pass Python 3
oleid.py. just given the location of your malicious documents file. 4
So once we press enter it gives us a lot of information about the document file. 5
So oleid is a simple parser of a document file and it looks for a bunch of traits inside the 6
document file. 7
For example it checks whether the file is in ole format or not, what's the application name on 8
which it was build, weather it is encrypted or not, whether it contains any VBA macros or not whether 9
there is an excel workbook. 10
So this will happen when we analyze Excel sheet. 11
Then there are options for PowerPoint as well. 12
It also checks whether there is an object pool or whether there are flash objects which are embedded 13
inside the document file or the ole file. 14
So this information can be very helpful in taking our next steps. 15
For example this says that the document file contains VBA macro so this can be of suspicion for us that 16
the macro might contain something which can lead to a malware download on the system. 17
So the next tool that we want to look at is olemeta. What it does is that it basically creates 18
it basically gives you the meta information on the particular document for it. 19
So what I mean by meta information is basically the data about your data. For example once you have 20
a Doc File, what kind of meta formation can you get. 21
You can get things like called Code page, title> is there any title that is associated with that document. 22
Who is the author of that document. 23
What template was used to create it. 24
Who was the last person who edited or saved the document. 25
How many times has it been revised. 26
How many times has it been edited. 27
When was it created. 28
How many page numbers are there in that document. 29
These are few informations which again require some special attention. 30
For example number of pages. 31
So it says that the document has only one page. 32
So this again points to a suspicious activity but because usually, I'm not saying that it will always 33
be the case but it usually malicious documents don't really contain too much off content. 34
All they care about is having the macro embedded inside. The document will contain either a simple image 35
or probably some in invoice kind of random information which should not go beyond like one or two pages. 36
So having a lower number of pages inside the document is an indication that the document might be suspicious. 37
In our case the number of words is zero which further increases our suspicion. 38
It means that there are no words. 39
There is simply no text inside the document. 40
Then what's really important about that document that it will send through email when there is nothing inside 41
it. 42
So that's another indicator which is clearly pointing us in the direction that this file might be suspicious 43
number characterises again zero. 44
Further down there are no lines there are no paragraphs and nothing. 45
So this is a very good way of kind of making a heuristic judgment inside your mind. 46
This file can be bad. 47
So this is how security analyst or security researchers operate. They look into these suspicious factors 48
and just by statically looking at the file, even without opening it you're able to make a judgment that 49
this file might contain something back. 50
The next tool we want to talk about is Oledir which basically gives you the directory representation 51
of the OLE file. 52
And if you remember when we were discussing about the file format of Ole compound files, we talked about 53
how OLE files are arranged in the form of a parent root storage that consists of streams and further storage 54
Those storages are further divided into either streams or more storage. 55
So this is what is represented here. 56
If you see there is a root entry that consists of a bunch of streams and bunch of storage. The storage 57
is for macros and those storage in-turn contain a bunch of extra streams. 58
Oledir basically gives us the directory presentation of the OLE file or the document 59
file that we passed to it. 60
Let's move on to another OLE tool called olemap. 61
Olemap basically gives you a representation of the entire header or the entire information about 62
the OLE file's internal structure. 63
What it does is that it reads the hexadecimal characters of the OLE file and it tries to map it against 64
its attributes. 65
For example we again have the hexadecimal string here which I asked you to look probably few 66
videos back. 67
So this is basically the OLE file signature in hex format and there are headers and minor versions. 68
Major versions, bytes etc.. 69
So if you have followed the previous videos these things will make a lot more sense to you. 70
You can really understand why these information are there and what exactly they mean and things like 71
that.