John Lambert @JohnLaTwC	30. sij
	Malware that just quits? I think there's more to the formula in this maldoc. #oletools reveals all cc/ @decalage2 🔗virustotal.com/gui/file/f0bfb… pic.twitter.com/g9vITlJL5j
	Prikaz fotografije ·

	Matteo Lodi @matte_lodi	27. sij
	Thanks @decalage2! Now you can use #oletools to detect this new trick used by recent #ostap downloaders! @JAMESWT_MHT @reecdeep @Certego_IRT @CertPa @a_de_pasquale twitter.com/decalage2/stat…
	Prikaži podatke ·

	Decalage @decalage2	27. sij
	olevba and mraptor now detect the new "_OnConnecting" trigger used in some recent malware, thanks to @matte_lodi #oletools twitter.com/joe4security/s… pic.twitter.com/6GebSQZWkt
	Prikaz fotografije ·

	V @mynameisv_	20. pro
	#trolldi Seriously Google ? Seriously Microsoft ? #oletools a malware !!? The tests samples are... tests !!! pic.twitter.com/1u40G7oUEB
	Prikaz fotografije ·

	CinCan project @CinCanProject	19. pro
	♫ On the 19th day of Christmas Philippe Lagadec sent to me oletools, the many ways of peeking into malicious OLE file ♫ t♫ We’re very grateful about the tool! Read the blog: cincan.io/blog/2019_12_1… @decalage2 #dfir #digitalforensics #containers #oletools #malware
	Prikaži podatke ·

	Decalage @decalage2	5. pro
	Final slides of my presentation yesterday at Black Hat Europe 2019, about malicious VBA macros and recent advances in the attack & defence sides: decalage.info/bheu2019 Featuring #oletools/olevba, ViperMonkey, MacroRaptor, EvilClippy #BHEU #BHEU2019 pic.twitter.com/iT8iqvIM8E
	Prikaz fotografije ·

	Decalage @decalage2	4. pro
	#oletools 0.55 is finally out, just in time for #BHEU! Main changes: olevba += SLK file parser and XLM macro extraction, VBA stomping detection More info: github.com/decalage2/olet… How to install/update: pip install -U oletools pic.twitter.com/zGEJqoQRUy
	Prikaz fotografije ·

	Paul_sec @Paulsec4	27. ruj
	I’ve written a guide on how to deobfuscate malicious macros with open source tools. Check it out! #CyberSecurity #malware #oletools #emotet #cyberchef #staticanalysis newtonpaul.com/static-malware…
	Prikaz sažetka ·

	Decalage @decalage2	26. ruj
	In December I'll give a presentation at BlackHat Europe in London about malicious VBA Macros, advanced techniques and the recent/upcoming improvements in my tools to address them (#oletools olevba, mraptor, ViperMonkey) blackhat.com/eu-19/briefing… #BHEU @BlackHatEvents
	Prikaži podatke ·

	Decalage @decalage2	19. ruj
	7 years of #oletools development summarized in a strange 7 minutes video found on youtube by accident... Thanks to all the contributors who are helping me on this project! youtube.com/watch?v=561QFm…
	Prikaži podatke ·

	Decalage @decalage2	27. svi
	The new #oletools 0.55.dev1 integrates with pcodedmp to display VBA P-code when using the option --pcode. The next step will be to detect VBA stomping to counter EvilClippy and adb! cc @StanHacked @VessOnSecurity @haroldogden @OrOneEqualsOne Install: github.com/decalage2/olet… pic.twitter.com/xytDTKKWNM
	Prikaz fotografije ·

	Marcus LaFerrera @mlaferrera	20. pro 2018.
	Thanks to @decalage2 and #oletools, #stoQ v2 now has several plugins leveraging the package. github.com/PUNCH-Cyber/st…
	Prikaz sažetka ·

	Decalage @decalage2	9. lis 2018.
	#oletools 0.54dev2: olevba now detects and shows backspace characters that may be used to hide VBA code on the console, as demonstrated by @StanHacked and @ptrpieter at #DerbyCon. More info: github.com/decalage2/olet… - Install: github.com/decalage2/olet… #DFIR #malware pic.twitter.com/BbTnC8qHjN
	Prikaz fotografije ·

	Decalage @decalage2	14. ruj 2018.
	TIL that some people are brave enough to run ViperMonkey in production, to automate the extraction of obfuscated payloads and URLs from VBA macros. This would not be possible without all the contributions from @bigmacjpg. github.com/decalage2/Vipe… #DFIR #Malware #oletools
	Prikaz sažetka ·

	Paul Cimino @paulecimino	23. srp 2018.
	My first blog post is up. Extracting macros in Word documents using oletools. paulcimino.com/index.php/2018… #dfir #maliciousdocuments #malware #oletools
	Prikaz sažetka ·

	Malwrologist @DissectMalware	18. svi 2018.
	New release of #oletools inspired me to investigate #dde capability in #excel. Awesome updt. But is it only about cmd? No. You can run any cmd with #dde. In this example, I show how to use #mshta to run notepad via #dde. limitation: len(cmd name) <= 8 chars @decalage2 @Oddvarmoe pic.twitter.com/7JWKCAXAra
	Prikaz fotografije ·

	Decalage @decalage2	26. srp 2017.
	FLARE VM: turn a Windows VM into a malware analysis platform with lots of tools - including #oletools fireeye.com/blog/threat-re… pic.twitter.com/z3lLoRucMt
	Prikaz fotografije ·

	Decalage @decalage2	10. svi 2017.
	Odgovor korisniku/ci @decalage2 The #oletools cheat sheet is available on the github repository in DOCX and PDF formats: github.com/decalage2/olet…
	Prikaz razgovora ·

	Decalage @decalage2	11. tra 2017.
	rtfobj (dev version): added detection of the MS Word "OLE2Link" vulnerability github.com/decalage2/olet… #oletools cc @edeca pic.twitter.com/JLFe7tgmKV
	Prikaz fotografije ·

	John Lambert @JohnLaTwC	8. tra 2017.
	Hey @decalage2 is there a way to dump document variables (not properties) with #oletools? They are stored in the 1Table stream. pic.twitter.com/JwCbqe8EqL
	Prikaz fotografije ·