Which Python Script Analyzes Suspicious MS Office Documents?

312-49v10 By islever Editorial Last updated

Malware Forensics

Short answer

A Run oleid.py to statically report the MS Office document's type, encryption status, Flash objects, and VBA macro indicators.

Question

Matthew has been assigned the task of analyzing a suspicious MS Office document via static analysis over an Ubuntu-based forensic machine. He wants to see what type of document it is, whether it is encrypted, or contains any flash objects/VBA macros. Which of the following python-based script should he run to get relevant information?
  1. oleid.py Correct Answer
  2. oleform.py
  3. oledir.py
  4. pdfid.py

Key Takeaways

The question tests recognition of oletools' indicator-scanning script, and the trap is picking a tool that only dumps OLE structures (oledir.py), extracts forms (oleform.py), or targets PDFs (pdfid.py) instead of one that summarizes all suspicious indicators at once.

Static triage of a suspicious MS Office document on an Ubuntu forensic workstation requires an OLE-aware indicator scanner that reports document type, encryption status, Flash content, and embedded VBA macros in one pass. The page establishes that oleid.py is that tool, distinguishing it from directory-dump, form-extraction, and PDF-only utilities.

Common mistake: Learners commonly choose pdfid.py because it is also a python-based static analyzer, but it only parses PDF files and cannot inspect OLE/MS Office documents for macros, encryption, or Flash objects.

Expert Analysis

Why the Answer Is Correct

oleid.py is the oletools indicator scanner designed exactly for the described triage: it reports the file type, whether the OLE document is encrypted, whether it contains Flash/SWF objects, and whether VBA macros or suspicious attributes are present. Running it as a first step over an MS Office document on an Ubuntu forensic machine gives Matthew a consolidated suspicious-indicator report before deeper extraction, which matches the request to "see what type of document it is, whether it is encrypted, or contains any flash objects/VBA macros." Elb's comment confirms this workflow, describing oleid as "a tool that is used to examine OLE files" used as the first analysis step.

Why the Other Options Are Wrong

oledir.py merely prints the raw OLE directory-entry table (entry names, sizes, colors), so it reveals structure but not encryption status, Flash objects, or macro presence in a summarized form. oleform.py extracts VBA user-form data for deeper inspection rather than providing the broad indicator overview the question asks for. pdfid.py is a python-based static analyzer but is purpose-built for PDF files, and a suspicious MS Office/OLE document is not a PDF, so it would yield no relevant information here.

Community Comment Notes

All 100 learner votes selected option A, and the comments reinforce it: Elb notes that "As the first step, you should analyze the suspect MS Office document with a python-based tool named oleid," and links the official oletools wiki page for oleid. Dumas's note describing option A as "Object Linking and embedding" reflects the OLE (Object Linking and Embedding) file format that oleid inspects, which supports rather than contradicts the choice.

Official Reference

https://github.com/decalage2/oletools/wiki/oleid

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question names a specific artifact type (MS Office/OLE vs. PDF), match the tool to that format first — oleid, oledir, and oleform all come from oletools but serve different stages. Choose the one whose documented purpose covers every indicator the prompt lists.

Frequently Asked Questions

Why is pdfid.py wrong for a suspicious MS Office document?

pdfid.py only parses PDF files and reports PDF-specific tokens, so it cannot inspect an OLE/MS Office document for encryption, Flash objects, or macros.

How do oledir.py and oleform.py differ from oleid.py?

oledir.py dumps the raw OLE directory entries and oleform.py extracts VBA user-form data; only oleid.py gives the broad indicator overview (type, encryption, Flash, macros) the task needs.

More 312-49v10 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Elb 👍 2 Answered A
    As the first step, you should analyze the suspect MS Office document with a python-based tool named oleid to review all components that can be labeled as suspicious/malicious. It is a tool that is used to examine OLE files.
  2. Elb 👍 2
    A < https://github.com/decalage2/oletools/wiki/oleid
  3. Dumas 👍 2
    A. Object Linking and embedding

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide