agentsclimarketplace

Analyzing excel 4 macro malware

Skill meltedinhex/analyst-ai-pack/skills/analyzing-excel-4-macro-malware

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-excel-4-macro-malware

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.9 KB, as published. Nobody here has run it

Analyzing Excel 4.0 Macro Malware

When to Use

  • You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a .xls/.xlsm dumped with oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
  • You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.

Do not use Excel to open the document to "see" the macro — opening triggers the auto-run cells. Work from the extracted formula text statically.

Prerequisites

  • The extracted XLM formula text (cell address → formula). Optional: oletools to extract it.

Safety & Handling

  • Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.

Workflow

Step 1: Find auto-executing entry points

python scripts/analyst.py analyze macros.txt

Flags defined-name triggers (Auto_Open, Auto_Close) and the cells they point to, plus =HALT()/=RETURN() flow markers.

Step 2: Identify execution and download primitives

Detects EXEC(, CALL(, REGISTER( (Win32 imports), and URLDownload-style CALL patterns that fetch and run a payload.

Step 3: Unwind obfuscation

Surfaces CHAR()/& string-building, FORMULA.FILL/FORMULA self-writing, and base/MID slicing used to hide strings; reconstructs concatenated literals where possible.

Step 4: Extract IOCs

Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).

Validation

  • Auto-run entry cells are identified, not just the presence of macros.
  • Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
  • Reconstructed strings and URLs are defanged.

Pitfalls

  • Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
  • Macro sheets hidden as Very Hidden that simple viewers miss.
  • Confusing benign legacy spreadsheets that legitimately use XLM.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.