
c:\Users\nospa\Broderie\oletools\tests\test-data\encrypted>py -2 \Users\nospa\Broderie\oletools\oletools\olevba.py autostart-encrypt-standardpassword.xlsb         
olevba 0.54dev12 on Python 2.7.16 - http://decalage.info/python/oletools
===============================================================================
FILE: autostart-encrypt-standardpassword.xlsb
Type: OLE
No VBA macros found.

===============================================================================
FILE: c:\users\nospa\appdata\local\temp\oletools-decrypt-vcbbvl.xlsb in autostart-encrypt-standardpassword.xlsb
Type: OpenXML
-------------------------------------------------------------------------------
VBA MACRO Modul1.bas 
in file: xl/vbaProject.bin - OLE stream: u'VBA/Modul1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Sub Auto_Open()
 MsgBox "Hello World"
End Sub
-------------------------------------------------------------------------------
VBA MACRO DieseArbeitsmappe.cls 
in file: xl/vbaProject.bin - OLE stream: u'VBA/DieseArbeitsmappe'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Tabelle1.cls 
in file: xl/vbaProject.bin - OLE stream: u'VBA/Tabelle1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
(empty macro)
+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |Auto_Open           |Runs when the Excel Workbook is opened       |
|Suspicious|'\x08'              |May use special characters such as backspace |
|          |                    |to obfuscate code when printed on the console|
|          |                    |(obfuscation: Hex)                           |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+

