Extractcustomvars

[DissectMalware]

get_document_variables function extracts all stored document variables from a doc file.

Variables that are created by (ActiveDocument.Variables.Add)
https://support.microsoft.com/en-us/help/306281/how-to-store-and-retrieve-variables-in-word-documents

[coveralls]

Coverage decreased (-2.9%) to 59.698% when pulling caa829c on InQuest:extractcustomvars into e56b720 on decalage2:master.

[coveralls]

Coverage decreased (-2.9%) to 59.698% when pulling caa829c on InQuest:extractcustomvars into e56b720 on decalage2:master.

[coveralls]

Coverage decreased (-8.4%) to 54.28% when pulling 70f9887 on InQuest:extractcustomvars into abbce3c on decalage2:master.

[decalage2]

Hi, are user defined properties following the same format for all MS Office apps (Word, Excel, Powerpoint, etc)? If so, I'm ok to include it in olefile. Having test files would help a lot.
Otherwise, as document variables are specific to MS Word, I think it would fit better in oletools.

[DissectMalware]

I think properties are same for these formats but I will check and back to you soon

[DissectMalware]

I have tested doc,ppt,xls samples. The code can extract user defined properties from all of them