API Reference: Analyzing Excel 4.0 Macro Malware

Overview

scripts/analyst.py parses an extracted XLM macro-sheet formula dump and flags auto-run triggers, execution/download primitives, executors, and obfuscation, reconstructing CHAR() string chains and defanging URLs. It parses text only, never opens the workbook, and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO
oletools	optional	extract the formulas upstream (not required by this script)

Core functions

`analyze(path)`

Returns auto-run triggers, execution primitives, download indicators, executors, obfuscation techniques, defanged URLs, reconstructed CHAR() strings, and a maliciousness flag.

`_reconstruct_char(line)`

Rebuilds a string from a CHAR(n)&CHAR(n)… concatenation chain.

Indicators

Auto-run: Auto_Open, Auto_Close, Auto_Activate.
Execution: EXEC(, CALL(, REGISTER( (Win32 import declaration).
Download: URLDownloadToFile, MSXML2, WinHTTP.

Usage

python scripts/analyst.py analyze macros.txt

Sources

MITRE ATT&CK T1059.005 — https://attack.mitre.org/techniques/T1059/005/
Excel 4.0 macro function semantics (EXEC/CALL/REGISTER/FORMULA.FILL) from Microsoft Office docs
XLM obfuscation patterns from public maldoc analysis (XLMMacroDeobfuscator methodology)

1.4 KiB Raw Blame History