How can I safely view the code of a VBA macro?

Microsoft Office fileas are actually nothing but glorified zip files. If you change the extention to .zip you can extract the content. There you should find the file word\vbaProject.bin that contains the VBA macros. However, as the extention suggests, this file is binary and is not much help in letting you read the source code.

Fortunately Microsoft has published the specs for the format, and there are a number of programs that can help you. I have not tried any of them, but there is a nice list on Decalage. Check it out for more details! These are the programs listed there:

  • olevba
  • oledump.py
  • officeparser.py
  • OfficeMalScanner

A minor detail: A docx file should not contain a macro, as those are not allowed in docx files. According to Microsoft:

Word lets you save macros in two Word file types: a Word Macro-Enabled Document file (.docm) and a Word Macro-Enabled Template file (.dotm).


Upload it to VirusTotal. Not only will you find out how many antivirus programs detect it automatically and what their classification is, but on the "File Details" tab you can see the macro and VBA code embedded in the document.

Example (which I received several months ago in a message nearly identical to the one you describe): https://www.virustotal.com/en/file/099f9605c1960e20572109ec466e0c05cdea7a1c4a82fea4f44c3f6a4a94b2b3/analysis/1473176084/

Ok, this one was an old format Word Document (OLE Compound Document File), not the new ZIP+XML format. I'd be very surprised if the tools can't perform at least the same level of analysis on the DOCX.

Tags:

Virus

Phishing

Office

Related

Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end? Benefits of a wildcard vs per-subdomain certificates Are services who offer to pay you a rent for your unused hard disk space a scam, and how do they work? Does HTTP Strict Transport Security (HSTS) make any sense in server to server communication? Would limiting write access to a backup directory help protect it from ransomware? Making database code open source HTTPS web service switched to HTTP. What can go wrong? Are cloud storage services a good strategy to protect against ransomware attacks? What should you do if you catch encryption ransomware mid-operation? Why do hackers scan for open ports? Nmap through proxy How can mom monitor my internet history from a distance?

Recent Posts