312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

While responding to a phishing incident at a banking call center in North Carolina, the team receives an Excel spreadsheet that opens without issue but is suspected of hiding macro logic. Before extracting any macro code, which command should investigators use to list the OLE streams and determine which stream(s) contain macros, indicated by an uppercase "M"?

A python oledump.py -s"
B olevba "
C oleid "
D python oledump.py

Explanation

Running python oledump.py against an OLE-based spreadsheet produces the stream listing and marks VBA-macro-containing streams with an uppercase M. The resulting stream index can subsequently be supplied to -s for targeted analysis or extraction.

Learn more

oledump.py — Didier Stevens

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ365

Community Discussion