2021-04-02 v0.56.1:
- olevba:
@@ -106,7 +130,7 @@
- olemap: to display a map of all the sectors in an OLE file.
-oletools are used by a number of projects and online malware analysis services, including ACE, Anlyz.io, AssemblyLine, CAPE, CinCan, Cuckoo Sandbox, DARKSURGEON, Deepviz, DIARIO, dridex.malwareconfig.com, EML Analyzer, FAME, FLARE-VM, Hybrid-analysis.com, IntelOwl, Joe Sandbox, Laika BOSS, MacroMilter, mailcow, malshare.io, malware-repo, Malware Repository Framework (MRF), MalwareBazaar, olefy, PeekabooAV, pcodedmp, PyCIRCLean, REMnux, Snake, SNDBOX, SpuriousEmu, Strelka, stoQ, TheHive/Cortex, TSUGURI Linux, Vba2Graph, Viper, ViperMonkey, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
+oletools are used by a number of projects and online malware analysis services, including ACE, Anlyz.io, AssemblyLine, CAPE, CinCan, Cuckoo Sandbox, DARKSURGEON, Deepviz, DIARIO, dridex.malwareconfig.com, EML Analyzer, FAME, FLARE-VM, Hybrid-analysis.com, IntelOwl, Joe Sandbox, Laika BOSS, MacroMilter, mailcow, malshare.io, malware-repo, Malware Repository Framework (MRF), MalwareBazaar, olefy, PeekabooAV, pcodedmp, PyCIRCLean, REMnux, Snake, SNDBOX, Splunk add-on for MS O365 Email, SpuriousEmu, Strelka, stoQ, TheHive/Cortex, TSUGURI Linux, Vba2Graph, Viper, ViperMonkey, YOMI, and probably VirusTotal. And quite a few other projects on GitHub. (Please contact me if you have or know a project using oletools)
Download and Install:
The recommended way to download and install/update the latest stable release of oletools is to use pip:
diff --git a/oletools/README.rst b/oletools/README.rst
index c9c83a76..0407ad0c 100644
--- a/oletools/README.rst
+++ b/oletools/README.rst
@@ -29,6 +29,31 @@ Software.
News
----
+- **2021-05-07 v0.56.2**:
+
+ - olevba:
+
+ - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674)
+
+ - olevba, mraptor:
+
+ - added detection of Workbook_BeforeClose (issue #518)
+
+ - rtfobj:
+
+ - fixed bug when OLE package class name ends with null characters
+ (issue #507, PR #648)
+
+ - oleid:
+
+ - fixed bug in check_excel (issue #584, PR #585)
+
+ - clsid:
+
+ - added several CLSIDs related to MS Office click-to-run issue
+ CVE-2021-27058
+ - added checks to ensure that all CLSIDs are uppercase (PR #678)
+
- **2021-04-02 v0.56.1**:
- olevba:
@@ -182,7 +207,8 @@ Repository Framework (MRF) `__,
`PyCIRCLean `__,
`REMnux `__,
`Snake `__,
-`SNDBOX `__,
+`SNDBOX `__, `Splunk add-on for MS O365
+Email `__,
`SpuriousEmu `__,
`Strelka `__,
`stoQ `__,
diff --git a/oletools/common/clsid.py b/oletools/common/clsid.py
index 9202515f..1712b472 100644
--- a/oletools/common/clsid.py
+++ b/oletools/common/clsid.py
@@ -43,7 +43,7 @@
# 2018-04-18 PL: - added known-bad CLSIDs from Cuckoo sandbox (issue #290)
# 2018-05-08 PL: - added more CLSIDs (issues #299, #304), merged and sorted
-__version__ = '0.56'
+__version__ = '0.56.2'
# REFERENCES:
diff --git a/oletools/mraptor.py b/oletools/mraptor.py
index f950a4be..80cfe351 100644
--- a/oletools/mraptor.py
+++ b/oletools/mraptor.py
@@ -63,7 +63,7 @@
# 2020-04-20 v0.56 PL: - added keywords RUN and CALL for XLM macros (issue #562)
# 2021-04-14 PL: - added Workbook_BeforeClose (issue #518)
-__version__ = '0.56.2.dev1'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
# TODO:
diff --git a/oletools/oleid.py b/oletools/oleid.py
index 64e0ee4f..b4426e4b 100644
--- a/oletools/oleid.py
+++ b/oletools/oleid.py
@@ -60,7 +60,7 @@
# improve encryption detection for ppt
# 2021-05-07 v0.56.2 MN: - fixed bug in check_excel (issue #584, PR #585)
-__version__ = '0.56.2.dev3'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
diff --git a/oletools/olevba.py b/oletools/olevba.py
index a32aa5f9..45850d9d 100644
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -235,7 +235,7 @@
# for issue #619)
# 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
-__version__ = '0.56.2.dev2'
+__version__ = '0.56.2'
#------------------------------------------------------------------------------
# TODO:
diff --git a/oletools/rtfobj.py b/oletools/rtfobj.py
index 4957a5f8..54be5963 100644
--- a/oletools/rtfobj.py
+++ b/oletools/rtfobj.py
@@ -95,7 +95,7 @@
# 2021-05-06 v0.56.2 DD: - fixed bug when OLE package class name ends with null
# characters (issue #507, PR #648)
-__version__ = '0.56.2.dev3'
+__version__ = '0.56.2'
# ------------------------------------------------------------------------------
# TODO:
diff --git a/setup.py b/setup.py
index 20c65888..bc8846c4 100644
--- a/setup.py
+++ b/setup.py
@@ -52,7 +52,7 @@
#--- METADATA -----------------------------------------------------------------
name = "oletools"
-version = '0.56.2.dev3'
+version = '0.56.2'
desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
long_desc = open('oletools/README.rst').read()
author = "Philippe Lagadec"