# Analyzing Excel 4 Macro Malware

> Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-excel-4-macro-malware`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-excel-4-macro-malware
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-excel-4-macro-malware
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Excel 4.0 Macro Malware

## When to Use

- You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a `.xls`/`.xlsm` dumped with
  oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
- You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.

**Do not use** Excel to open the document to "see" the macro — opening triggers the auto-run
cells. Work from the extracted formula text statically.

## Prerequisites

- The extracted XLM formula text (cell address → formula). Optional: `oletools` to extract it.

## Safety & Handling

- Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.

## Workflow

### Step 1: Find auto-executing entry points

```bash
python scripts/analyst.py analyze macros.txt
```

Flags defined-name triggers (`Auto_Open`, `Auto_Close`) and the cells they point to, plus
`=HALT()`/`=RETURN()` flow markers.

### Step 2: Identify execution and download primitives

Detects `EXEC(`, `CALL(`, `REGISTER(` (Win32 imports), and URLDownload-style `CALL` patterns that
fetch and run a payload.

### Step 3: Unwind obfuscation

Surfaces `CHAR()`/`&` string-building, `FORMULA.FILL`/`FORMULA` self-writing, and base/`MID`
slicing used to hide strings; reconstructs concatenated literals where possible.

### Step 4: Extract IOCs

Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).

## Validation

- Auto-run entry cells are identified, not just the presence of macros.
- Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
- Reconstructed strings and URLs are defanged.

## Pitfalls

- Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
- Macro sheets hidden as `Very Hidden` that simple viewers miss.
- Confusing benign legacy spreadsheets that legitimately use XLM.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
- ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-excel-4-macro-malware
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.