office-forensics

name	office-forensics
description	Analyze Office documents (DOC, XLS, PPT, DOCX, XLSX, PPTX) and OLE compound files for forensics and CTF challenges. Use this skill whenever the user needs to extract macros, inspect Office file structures, analyze OLE compound files, or investigate potential malware in Office documents. Also use for Revit RFA file analysis and OLE stream manipulation.

Office File Forensics

A skill for analyzing Microsoft Office documents and OLE compound files in forensic and CTF contexts.

When to use this skill

Use this skill when:

• The user needs to analyze Office documents (DOC, XLS, PPT, DOCX, XLSX, PPTX) for hidden content or macros
• The user is investigating potential malware or phishing in Office files
• The user needs to extract and analyze VBA macros from documents
• The user is working with OLE compound files (CFBF format)
• The user needs to analyze Revit RFA files or other OLE-based formats
• The user is doing CTF forensics challenges involving Office files

Quick Start

Install required tools

# Install oletools for macro extraction and analysis
sudo pip3 install -U oletools

# Install CompoundFileTool for OLE manipulation (if available)
# See: https://github.com/thezdi/CompoundFileTool

Basic macro extraction

# Extract and classify macros from any Office document
olevba -c /path/to/document.docx

# Full analysis with all options
olevba -v /path/to/document.docx

Office File Formats

OLE Formats (Legacy)

• DOC, XLS, PPT - Binary OLE Compound File format
• - Rich Text Format (can contain OLE objects)