Analyzing Malicious Office Macros

When to Use

• A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
• You need to extract VBA, identify auto-exec triggers, and see what the macro does.
• You are determining the next-stage payload or URL a maldoc fetches.

Do not use the document's "Enable Content" path to analyze it — never open a maldoc in Office. Extract and read the macro statically; detonate only in the isolated lab if needed.

Prerequisites

• oletools (pip install oletools) for olevba/oleid, or the bundled OLE/OOXML extractor.
• The document in neutralized form inside the lab.

Safety & Handling

• Do not open the document in Microsoft Office. Macros may auto-run on open/close.
• Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.

Workflow

Step 1: Identify the container and locate macros

OOXML (.docm, .xlsm) is a ZIP; legacy (.doc, .xls) is OLE2. Macros live in a vbaProject.bin OLE stream. Extract it:

python scripts/analyst.py extract maldoc.docm

Step 2: Flag auto-exec triggers

Look for entry points that run without user action beyond enabling macros:

AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close

Step 3: Find suspicious calls

Identify execution and download primitives:

Shell, WScript.Shell, CreateObject, powershell, cmd /c
URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
Environ, GetObject("winmgmts:") (WMI)

Step 4: Deobfuscate

Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to recover the real command and any URL or dropped path.

Step 5: Extract IOCs and the next stage

Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs and pivot points.

Validation

• The recovered command line and URL make sense together (download → drop → execute).
• Auto-exec triggers explain how the macro starts.
• Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).

Pitfalls

• Opening the document in Office "just to see" — this executes the macro.
• Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
• Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze p-code if the source looks empty.

References

• See references/api-reference.md for the extractor and indicator scanner.
• oletools and MS-OVBA (linked in frontmatter).