analyzing-excel-4-macro-malware

Name: analyzing-excel-4-macro-malware
Author: meltedinhex

18stars5forks

How to install analyzing-excel-4-macro-malware?

meltedinhex/analyst-ai-pack/analyzing-excel-4-macro-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-excel-4-macro-malware

Installs into the current project.

Summary

Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Excel 4.0 Macro Malware
2
3	## When to Use
4
5	- You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a `.xls`/`.xlsm` dumped with
6	oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
7	- You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.
8
9	Do not use Excel to open the document to "see" the macro — opening triggers the auto-run
10	cells. Work from the extracted formula text statically.
11
12	## Prerequisites
13
14	- The extracted XLM formula text (cell address → formula). Optional: `oletools` to extract it.
15
16	## Safety & Handling
17
18	- Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.
19
20	## Workflow
21
22	### Step 1: Find auto-executing entry points
23
24	```bash
25	python scripts/analyst.py analyze macros.txt
26	```
27
28	Flags defined-name triggers (`Auto_Open`, `Auto_Close`) and the cells they point to, plus
29	`=HALT()`/`=RETURN()` flow markers.
30
31	### Step 2: Identify execution and download primitives
32
33	Detects `EXEC(`, `CALL(`, `REGISTER(` (Win32 imports), and URLDownload-style `CALL` patterns that
34	fetch and run a payload.
35
36	### Step 3: Unwind obfuscation
37
38	Surfaces `CHAR()`/`&` string-building, `FORMULA.FILL`/`FORMULA` self-writing, and base/`MID`
39	slicing used to hide strings; reconstructs concatenated literals where possible.
40
41	### Step 4: Extract IOCs
42
43	Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).
44
45	## Validation
46
47	- Auto-run entry cells are identified, not just the presence of macros.
48	- Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
49	- Reconstructed strings and URLs are defanged.
50
51	## Pitfalls
52
53	- Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
54	- Macro sheets hidden as `Very Hidden` that simple viewers miss.
55	- Confusing benign legacy spreadsheets that legitimately use XLM.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
60	- ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-excel-4-macro-malware

18stars5forks

View on GitHub

How to install analyzing-excel-4-macro-malware?

meltedinhex/analyst-ai-pack/analyzing-excel-4-macro-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-excel-4-macro-malware

Installs into the current project.

Summary

Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Excel 4.0 Macro Malware
2
3	## When to Use
4
5	- You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a `.xls`/`.xlsm` dumped with
6	oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
7	- You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.
8
9	Do not use Excel to open the document to "see" the macro — opening triggers the auto-run
10	cells. Work from the extracted formula text statically.
11
12	## Prerequisites
13
14	- The extracted XLM formula text (cell address → formula). Optional: `oletools` to extract it.
15
16	## Safety & Handling
17
18	- Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.
19
20	## Workflow
21
22	### Step 1: Find auto-executing entry points
23
24	```bash
25	python scripts/analyst.py analyze macros.txt
26	```
27
28	Flags defined-name triggers (`Auto_Open`, `Auto_Close`) and the cells they point to, plus
29	`=HALT()`/`=RETURN()` flow markers.
30
31	### Step 2: Identify execution and download primitives
32
33	Detects `EXEC(`, `CALL(`, `REGISTER(` (Win32 imports), and URLDownload-style `CALL` patterns that
34	fetch and run a payload.
35
36	### Step 3: Unwind obfuscation
37
38	Surfaces `CHAR()`/`&` string-building, `FORMULA.FILL`/`FORMULA` self-writing, and base/`MID`
39	slicing used to hide strings; reconstructs concatenated literals where possible.
40
41	### Step 4: Extract IOCs
42
43	Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).
44
45	## Validation
46
47	- Auto-run entry cells are identified, not just the presence of macros.
48	- Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
49	- Reconstructed strings and URLs are defanged.
50
51	## Pitfalls
52
53	- Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
54	- Macro sheets hidden as `Very Hidden` that simple viewers miss.
55	- Confusing benign legacy spreadsheets that legitimately use XLM.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
60	- ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type