# oledump.py
> Analyze OLE2 files (Office documents), extract streams and VBA macros

**Category:** [[categories/analyze-documents-microsoft-office|Analyze Documents > Microsoft Office]] | **Tier:** Rich (FOR610) | **Author:** Didier Stevens
**Docs:** [https://docs.remnux.org/discover-the-tools/analyze+documents/microsoft+office](https://docs.remnux.org/discover-the-tools/analyze+documents/microsoft+office)

## Usage
```bash
oledump.py document.docm
oledump.py document.docm -s A3 -v
oledump.py document.docm -i
```

## Recipes
- [[recipes/extract-base64-ps-from-vba|Extract Base64 PowerShell from Office Macro]]
- [[recipes/vba-number-string-decode|Decode VBA Number Arrays to Strings]]
- [[recipes/office-full-decode-chain|Full Office Macro Decode Chain]]

## Workflows
- [[workflows/document-analysis-workflow|Malicious Document Analysis]] — Step 2: Structure Analysis
- [[workflows/shellcode-analysis-workflow|Shellcode Analysis]] — Step 2: Extraction

## Related Tools
- [[tools/evilclippy|evilclippy]] — Remove VBA project password protection and manipulate Office
- [[tools/libolecf|libolecf]] — Microsoft Office OLE2 compound documents.
- [[tools/msoffcrypto-crack|msoffcrypto-crack.py]] — Recover the password of an encrypted Microsoft Office docume
- [[tools/msoffcrypto-tool|msoffcrypto-tool]] — Decrypt password-protected Microsoft Office documents (OLE a
- [[tools/msoffice-crypt|msoffice-crypt]] — Encrypt and decrypt OOXML Microsoft Office documents.

## FOR610
**Labs:** 3.3, 3.4, 4.5
**Sections:** 3, 4

#office #vba #macro #ole #didier-stevens