analyzing-malicious-office-macros

Name: analyzing-malicious-office-macros
Author: meltedinhex

18stars5forks

How to install analyzing-malicious-office-macros?

meltedinhex/analyst-ai-pack/analyzing-malicious-office-macros

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-office-macros

Installs into the current project.

Summary

Analyzes malicious Office documents by extracting and reviewing VBA macros and

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious Office Macros
2
3	## When to Use
4
5	- A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
6	- You need to extract VBA, identify auto-exec triggers, and see what the macro does.
7	- You are determining the next-stage payload or URL a maldoc fetches.
8
9	Do not use the document's "Enable Content" path to analyze it — never open a maldoc in
10	Office. Extract and read the macro statically; detonate only in the isolated lab if needed.
11
12	## Prerequisites
13
14	- `oletools` (`pip install oletools`) for `olevba`/`oleid`, or the bundled OLE/OOXML extractor.
15	- The document in neutralized form inside the lab.
16
17	## Safety & Handling
18
19	- Do not open the document in Microsoft Office. Macros may auto-run on open/close.
20	- Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.
21
22	## Workflow
23
24	### Step 1: Identify the container and locate macros
25
26	OOXML (`.docm`, `.xlsm`) is a ZIP; legacy (`.doc`, `.xls`) is OLE2. Macros live in a
27	`vbaProject.bin` OLE stream. Extract it:
28
29	```bash
30	python scripts/analyst.py extract maldoc.docm
31	```
32
33	### Step 2: Flag auto-exec triggers
34
35	Look for entry points that run without user action beyond enabling macros:
36
37	```text
38	AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close
39	```
40
41	### Step 3: Find suspicious calls
42
43	Identify execution and download primitives:
44
45	```text
46	Shell, WScript.Shell, CreateObject, powershell, cmd /c
47	URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
48	Environ, GetObject("winmgmts:") (WMI)
49	```
50
51	### Step 4: Deobfuscate
52
53	Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to
54	recover the real command and any URL or dropped path.
55
56	### Step 5: Extract IOCs and the next stage
57
58	Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs
59	and pivot points.
60
61	## Validation
62
63	- The recovered command line and URL make sense together (download → drop → execute).
64	- Auto-exec triggers explain how the macro starts.
65	- Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).
66
67	## Pitfalls
68
69	- Opening the document in Office "just to see" — this executes the macro.
70	- Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
71	- Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze
72	p-code if the source looks empty.
73
74	## References
75
76	- See [`references/api-reference.md`](references/api-reference.md) for the extractor and
77	indicator scanner.
78	- oletools and MS-OVBA (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-malicious-office-macros

18stars5forks

View on GitHub

How to install analyzing-malicious-office-macros?

meltedinhex/analyst-ai-pack/analyzing-malicious-office-macros

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-office-macros

Installs into the current project.

Summary

Analyzes malicious Office documents by extracting and reviewing VBA macros and

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious Office Macros
2
3	## When to Use
4
5	- A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
6	- You need to extract VBA, identify auto-exec triggers, and see what the macro does.
7	- You are determining the next-stage payload or URL a maldoc fetches.
8
9	Do not use the document's "Enable Content" path to analyze it — never open a maldoc in
10	Office. Extract and read the macro statically; detonate only in the isolated lab if needed.
11
12	## Prerequisites
13
14	- `oletools` (`pip install oletools`) for `olevba`/`oleid`, or the bundled OLE/OOXML extractor.
15	- The document in neutralized form inside the lab.
16
17	## Safety & Handling
18
19	- Do not open the document in Microsoft Office. Macros may auto-run on open/close.
20	- Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.
21
22	## Workflow
23
24	### Step 1: Identify the container and locate macros
25
26	OOXML (`.docm`, `.xlsm`) is a ZIP; legacy (`.doc`, `.xls`) is OLE2. Macros live in a
27	`vbaProject.bin` OLE stream. Extract it:
28
29	```bash
30	python scripts/analyst.py extract maldoc.docm
31	```
32
33	### Step 2: Flag auto-exec triggers
34
35	Look for entry points that run without user action beyond enabling macros:
36
37	```text
38	AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close
39	```
40
41	### Step 3: Find suspicious calls
42
43	Identify execution and download primitives:
44
45	```text
46	Shell, WScript.Shell, CreateObject, powershell, cmd /c
47	URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
48	Environ, GetObject("winmgmts:") (WMI)
49	```
50
51	### Step 4: Deobfuscate
52
53	Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to
54	recover the real command and any URL or dropped path.
55
56	### Step 5: Extract IOCs and the next stage
57
58	Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs
59	and pivot points.
60
61	## Validation
62
63	- The recovered command line and URL make sense together (download → drop → execute).
64	- Auto-exec triggers explain how the macro starts.
65	- Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).
66
67	## Pitfalls
68
69	- Opening the document in Office "just to see" — this executes the macro.
70	- Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
71	- Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze
72	p-code if the source looks empty.
73
74	## References
75
76	- See [`references/api-reference.md`](references/api-reference.md) for the extractor and
77	indicator scanner.
78	- oletools and MS-OVBA (linked in frontmatter).

People who liked this also viewed

6 picks

Type