reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-excel-4-macro-malware/references/api-reference.md

@@ -0,0 +1,41 @@
+# API Reference: Analyzing Excel 4.0 Macro Malware
+
+## Overview
+
+`scripts/analyst.py` parses an extracted XLM macro-sheet formula dump and flags auto-run triggers,
+execution/download primitives, executors, and obfuscation, reconstructing `CHAR()` string chains
+and defanging URLs. It parses text only, never opens the workbook, and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+| oletools | optional | extract the formulas upstream (not required by this script) |
+
+## Core functions
+
+### `analyze(path)`
+Returns auto-run triggers, execution primitives, download indicators, executors, obfuscation
+techniques, defanged URLs, reconstructed `CHAR()` strings, and a maliciousness flag.
+
+### `_reconstruct_char(line)`
+Rebuilds a string from a `CHAR(n)&CHAR(n)…` concatenation chain.
+
+## Indicators
+
+- Auto-run: `Auto_Open`, `Auto_Close`, `Auto_Activate`.
+- Execution: `EXEC(`, `CALL(`, `REGISTER(` (Win32 import declaration).
+- Download: `URLDownloadToFile`, `MSXML2`, `WinHTTP`.
+
+## Usage
+
+```bash
+python scripts/analyst.py analyze macros.txt
+```
+
+## Sources
+
+- MITRE ATT&CK T1059.005 — https://attack.mitre.org/techniques/T1059/005/
+- Excel 4.0 macro function semantics (EXEC/CALL/REGISTER/FORMULA.FILL) from Microsoft Office docs
+- XLM obfuscation patterns from public maldoc analysis (XLMMacroDeobfuscator methodology)