Analyzing Excel 4 Macro Malware

Analyzing Excel 4.0 Macro Malware

When to Use

• You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a .xls/.xlsm dumped with

oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.

• You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.

Do not use Excel to open the document to "see" the macro — opening triggers the auto-run cells. Work from the extracted formula text statically.

Prerequisites

• The extracted XLM formula text (cell address → formula). Optional: oletools to extract it.

Safety & Handling

• Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.

Workflow

Step 1: Find auto-executing entry points

python scripts/analyst.py analyze macros.txt

Flags defined-name triggers (Auto_Open, Auto_Close) and the cells they point to, plus =HALT()/=RETURN() flow markers.

Step 2: Identify execution and download primitives

Detects EXEC(, CALL(, REGISTER( (Win32 imports), and URLDownload-style CALL patterns that fetch and run a payload.

Step 3: Unwind obfuscation

Surfaces CHAR()/& string-building, FORMULA.FILL/FORMULA self-writing, and base/MID slicing used to hide strings; reconstructs concatenated literals where possible.

Step 4: Extract IOCs

Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).

Validation

• Auto-run entry cells are identified, not just the presence of macros.
• Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
• Reconstructed strings and URLs are defanged.

Pitfalls

• Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
• Macro sheets hidden as Very Hidden that simple viewers miss.
• Confusing benign legacy spreadsheets that legitimately use XLM.

References

• See [references/api-reference.md](references/api-reference.md) for the analyzer.
• ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: meltedinhex
• Source: meltedinhex/analyst-ai-pack
• License: Apache-2.0
• Homepage: https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.