reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-excel-4-macro-malware/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-excel-4-macro-malware	Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.	cybersecurity	malware-analysis	malware-analysis xlm excel4 macros document-malware	1.0.0	analyst-ai-pack	Apache-2.0	T1059.005 T1204.002 T1027	D3-FCR D3-DA	MITRE ATT&CK T1059.005 Visual Basic / macros — https://attack.mitre.org/techniques/T1059/005/ Microsoft Excel 4.0 macro functions reference — https://learn.microsoft.com/office/

Analyzing Excel 4.0 Macro Malware

When to Use

• You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a .xls/.xlsm dumped with oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
• You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.

Do not use Excel to open the document to "see" the macro — opening triggers the auto-run cells. Work from the extracted formula text statically.

Prerequisites

• The extracted XLM formula text (cell address → formula). Optional: oletools to extract it.

Safety & Handling

• Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.

Workflow

Step 1: Find auto-executing entry points

python scripts/analyst.py analyze macros.txt

Flags defined-name triggers (Auto_Open, Auto_Close) and the cells they point to, plus =HALT()/=RETURN() flow markers.

Step 2: Identify execution and download primitives

Detects EXEC(, CALL(, REGISTER( (Win32 imports), and URLDownload-style CALL patterns that fetch and run a payload.

Step 3: Unwind obfuscation

Surfaces CHAR()/& string-building, FORMULA.FILL/FORMULA self-writing, and base/MID slicing used to hide strings; reconstructs concatenated literals where possible.

Step 4: Extract IOCs

Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).

Validation

• Auto-run entry cells are identified, not just the presence of macros.
• Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
• Reconstructed strings and URLs are defanged.

Pitfalls

• Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
• Macro sheets hidden as Very Hidden that simple viewers miss.
• Confusing benign legacy spreadsheets that legitimately use XLM.

References

• See references/api-reference.md for the analyzer.
• ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).