SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-malicious-office-macros
0
Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Malicious Office Macros
## When to Use
- A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
- You need to extract VBA, identify auto-exec triggers, and see what the macro does.
- You are determining the next-stage payload or URL a maldoc fetches.
**Do not use** the document's "Enable Content" path to analyze it — never open a maldoc in
Office. Extract and read the macro statically; detonate only in the isolated lab if needed.
## Prerequisites
- `oletools` (`pip install oletools`) for `olevba`/`oleid`, or the bundled OLE/OOXML extractor.
- The document in neutralized form inside the lab.
## Safety & Handling
- Do **not** open the document in Microsoft Office. Macros may auto-run on open/close.
- Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.
## Workflow
### Step 1: Identify the container and locate macros
OOXML (`.docm`, `.xlsm`) is a ZIP; legacy (`.doc`, `.xls`) is OLE2. Macros live in a
`vbaProject.bin` OLE stream. Extract it:
```bash
python scripts/analyst.py extract maldoc.docm
```
### Step 2: Flag auto-exec triggers
Look for entry points that run without user action beyond enabling macros:
```text
AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close
```
### Step 3: Find suspicious calls
Identify execution and download primitives:
```text
Shell, WScript.Shell, CreateObject, powershell, cmd /c
URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
Environ, GetObject("winmgmts:") (WMI)
```
### Step 4: Deobfuscate
Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to
recover the real command and any URL or dropped path.
### Step 5: Extract IOCs and the next stage
Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs
and pivot points.
## Validation
- The recovered command line and URL make sense together (download → drop → execute).
- Auto-exec triggers explain how the macro starts.
- Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).
## Pitfalls
- Opening the document in Office "just to see" — this executes the macro.
- Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
- Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze
p-code if the source looks empty.
## References
- See [`references/api-reference.md`](references/api-reference.md) for the extractor and
indicator scanner.
- oletools and MS-OVBA (linked in frontmatter).