CmdID

CmdID / Commands

olevba

Parse OLE and OpenXML files (e.g., DOC, XLS, PPT, etc.) to extract VBA macros, deobfuscate, and analyze malicious code. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Parse OLE and OpenXML files (e.g., DOC, XLS, PPT, etc.) to extract VBA macros, deobfuscate, and analyze malicious code. Part of the python-oletools suite.

Analyze a file, showing both macro code and analysis results

olevba path/to/fileIdentify

Recursively analyze all supported files in a directory

olevba -r path/to/directoryIdentify

Provide a password for encrypted Microsoft Office files (may be repeated)

olevba --password password path/to/encrypted_fileIdentify

Display only analysis results, without showing macro source code

olevba --analysis path/to/fileIdentify

Display only macro source code

olevba --code path/to/fileIdentify

Show obfuscated strings and their decoded content

olevba --decode path/to/fileIdentify