reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-malicious-office-macros/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-malicious-office-macros	Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.	cybersecurity	malware-analysis	malware maldoc vba office olevba phishing	1.0.0	analyst-ai-pack	Apache-2.0	T1566.001 T1059.005 T1204.002	D3-FCR D3-DA	oletools (olevba) — https://github.com/decalage2/oletools MS-OVBA VBA file format — https://learn.microsoft.com/openspecs/office_file_formats/ms-ovba/

Analyzing Malicious Office Macros

When to Use

• A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
• You need to extract VBA, identify auto-exec triggers, and see what the macro does.
• You are determining the next-stage payload or URL a maldoc fetches.

Do not use the document's "Enable Content" path to analyze it — never open a maldoc in Office. Extract and read the macro statically; detonate only in the isolated lab if needed.

Prerequisites

• oletools (pip install oletools) for olevba/oleid, or the bundled OLE/OOXML extractor.
• The document in neutralized form inside the lab.

Safety & Handling

• Do not open the document in Microsoft Office. Macros may auto-run on open/close.
• Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.

Workflow

Step 1: Identify the container and locate macros

OOXML (.docm, .xlsm) is a ZIP; legacy (.doc, .xls) is OLE2. Macros live in a vbaProject.bin OLE stream. Extract it:

python scripts/analyst.py extract maldoc.docm

Step 2: Flag auto-exec triggers

Look for entry points that run without user action beyond enabling macros:

AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close

Step 3: Find suspicious calls

Identify execution and download primitives:

Shell, WScript.Shell, CreateObject, powershell, cmd /c
URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
Environ, GetObject("winmgmts:") (WMI)

Step 4: Deobfuscate

Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to recover the real command and any URL or dropped path.

Step 5: Extract IOCs and the next stage

Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs and pivot points.

Validation

• The recovered command line and URL make sense together (download → drop → execute).
• Auto-exec triggers explain how the macro starts.
• Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).

Pitfalls

• Opening the document in Office "just to see" — this executes the macro.
• Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
• Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze p-code if the source looks empty.

References

• See references/api-reference.md for the extractor and indicator scanner.
• oletools and MS-OVBA (linked in frontmatter).