agentsclimarketplace

Analyzing malicious office macros

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-office-macros

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-office-macros

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.3 KB, as published. Nobody here has run it

Analyzing Malicious Office Macros

When to Use

  • A Word/Excel/PowerPoint document is suspected of delivering malware via macros.
  • You need to extract VBA, identify auto-exec triggers, and see what the macro does.
  • You are determining the next-stage payload or URL a maldoc fetches.

Do not use the document's "Enable Content" path to analyze it — never open a maldoc in Office. Extract and read the macro statically; detonate only in the isolated lab if needed.

Prerequisites

  • oletools (pip install oletools) for olevba/oleid, or the bundled OLE/OOXML extractor.
  • The document in neutralized form inside the lab.

Safety & Handling

  • Do not open the document in Microsoft Office. Macros may auto-run on open/close.
  • Static extraction only; if dynamic analysis is required, detonate in the isolated victim VM.

Workflow

Step 1: Identify the container and locate macros

OOXML (.docm, .xlsm) is a ZIP; legacy (.doc, .xls) is OLE2. Macros live in a vbaProject.bin OLE stream. Extract it:

python scripts/analyst.py extract maldoc.docm

Step 2: Flag auto-exec triggers

Look for entry points that run without user action beyond enabling macros:

AutoOpen, Document_Open, AutoClose, Workbook_Open, Auto_Open, Document_Close

Step 3: Find suspicious calls

Identify execution and download primitives:

Shell, WScript.Shell, CreateObject, powershell, cmd /c
URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream (drop to disk)
Environ, GetObject("winmgmts:") (WMI)

Step 4: Deobfuscate

Maldocs commonly use Chr()/string concatenation, base64, and split-and-join. Resolve these to recover the real command and any URL or dropped path.

Step 5: Extract IOCs and the next stage

Pull URLs, dropped file paths, and the spawned command line. These become the report's IOCs and pivot points.

Validation

  • The recovered command line and URL make sense together (download → drop → execute).
  • Auto-exec triggers explain how the macro starts.
  • Deobfuscated strings match what dynamic detonation would reveal (if you confirm in the lab).

Pitfalls

  • Opening the document in Office "just to see" — this executes the macro.
  • Stopping at obfuscated source without resolving it; the IOCs are inside the obfuscation.
  • Missing stomped VBA (p-code present, source removed) — check for VBA stomping and analyze p-code if the source looks empty.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.