oletools is a Python library for analyzing Microsoft OLE2 files and Office documents for malware analysis, forensics, and debugging.
The tool addresses the need to inspect potentially malicious Office documents and related file formats by parsing their internal structure. It works by reading OLE2 compound files, RTF files, and OpenXML-based formats to expose their contents and metadata. The library can detect, extract, and analyze VBA macros, OLE objects, Excel 4 macros, and DDE links—features commonly exploited in document-based attacks.
Analysts and security researchers investigating suspicious Office documents should choose this tool if they need to programmatically inspect file contents without opening them in Office applications. It suits forensic workflows, automated malware scanning pipelines, and debugging of document structure. The tool handles legacy Microsoft Office 97-2003 formats as well as modern Office 2007+ documents, MSI files, Outlook messages, XPS, and MSIX files, making it broadly applicable across Microsoft document ecosystems.
The project maintains steady activity with regular updates addressing new Office file formats and emerging threats. Issues and pull requests receive responses, indicating active engagement with users. The codebase remains focused on its core parsing and analysis mission without scope creep into unrelated functionality.
