9

I have been given two different Microsoft Word document that my virus scanner has warned me contains macros. These should be simple text files, and the person who sent them doesn't even know what a macro is; they may be a mistake on his part, but they might be signs of a malicious infection. My installation of OpenOffice.org is set not to load macros at all, as I rarely use them, so I am not concerned about the security of my system. What I would like to be able to do is find out what those macros do without exposing my system to any malicious intent from those macros, in order to tell the person who sent me the documents whether or not he is spreading an infection.

9 Answers 9

10

Just to expound on top of these previous posts -

Here is the process I followed -

  1. Open file
  2. Enable Editing to get out of protected view
  3. AltF11 to open the Visual Basic editor
    • Sometimes you can apparently view the macros here, in my Word 2013 I could not.
  4. Minimize or close the VB editor window. We'll reopen in a minute
  5. Hold Shift while you click Enable Content. This will keep it from running AutoOpen macros.
  6. AltF11 to open the Visual Basic editor.
  7. Now you may see the macros that you didn't see before.
5

The .???x is just a zip-format.

unzip the file and you end up with something like this:

.
├── [Content_Types].xml
├── docProps
│   ├── app.xml
│   ├── core.xml
│   └── custom.xml
├── _rels
└── word
    ├── document.xml
    ├── fontTable.xml
    ├── _rels
    │   ├── document.xml.rels
    │   └── vbaProject.bin.rels
    ├── settings.xml
    ├── styles.xml
    ├── theme
    │   └── theme1.xml
    ├── vbaData.xml
    ├── vbaProject.bin
    └── webSettings.xml

now u can analyse the vbastuff with Texteditor or other VBA-Editor of your choice.

1
  • vbaProject.bin is an opaque binary vs. the other text-based files. I'm guessing the magic lives there. So this answer is missing the part where it's clear how to analyze that content.
    – Ethan T
    Feb 22, 2021 at 20:28
4

I just ran a test. I opened Word (2007) and:

  1. Created a simple macro and saved with the document as a "Word macro enabled document (.docm)"
  2. Went into the security settings (Office Button 'File'\Word Options\Trust Center\Trust Center Settings\Macros Settings) and clicked the "Disable all macros with notification" radio button which will prevent macros from running unless you click the button to allow them to run.
  3. Opened the *.docm document and the macro didn't run, but I was able to go to the "View" tab on the ribbon control and click the Macros button and view Macros and then edit the macro to open a VBA IDE to see the macro code.

This all assumes you are using Word 2007, although I'd expect the same capability in the last version or two of Word. I don't have Open Office on this box, but, I'd also expect it to have the same functionality.

Good Luck!

4

If you want to view word macros without opening the word document to view the macros you can use a script called oledump.py by Dider Stevens.

Once you have the script you can do this:

python oledump.py "your_word.doc" -s a -v

This should return a listing of all the macros in the word document.

2

Two possibilities. Get yourself a free copy of VMWare player and install Windows and MS Office within it. Then load up the document and let the macros run.

The other possibility. I think you can load the doc into MS Word and automatically disable macros, but the macro is still there so you can view it with Word itself.

3
  • Note: Not in office 97
    – david
    Feb 13, 2014 at 6:21
  • I received a very suspicious word.doc (not docx) today via e-mail and wanted to check what evil cargo it carries. I thought of a macro and wanted to read the script, therefore I read this thread here looking for a safe method to do this. I saved the attachment for opening it with a texteditor etc. On saving it, my anitvirus (Sophos) rang alarm for a Trojan (spyware). Dec 10, 2018 at 17:41
  • @ChristianGeiselmann lots of false positives... I have Sohpos too and it has wigged out on some of my own VBA code. This is the absolute safest method: stackoverflow.com/a/47908674/3451115 Jun 21, 2019 at 14:14
1

(I thought someone ought to answer the original question about using OpenOffice with macro execution globally disabled; saying "open the code editor" is correct but really needs a bit more hand-holding for newbies; it certainly took me ages to find it the first time.)

Anyway, according to http://www.tutorialsforopenoffice.org/tutorial/Macros.html, you can view (or edit) the macros by going ToolsMacrosOrganize MacrosOpenOffice.org Basic, which will bring up the the OpenOffice.org Basic Macros window.

From there it's just a matter of clicking around the tree to find any macros included in the file, and going Edit to see what's in each one.

1
0

The most secure way to see macros content without running them is to open Visual Basic Editor from you office document which will contain the content of the macros.

To open Visual Basic Editor (Office 2010, probably 2013 and 2016):

  1. Open the document
  2. You can enable editing if asked, no macro will be executed
  3. Right click on the Ribbon (menu) - Choose: Customize the Ribbon
  4. In the right section, select "Developer", it will add a tab "Developer" on the Ribbon. Press OK.
  5. Go to the "Developer" tab and click the "Visual Basic Editor".

Now you can see all macros.

Hope it helped you, it worked for my version of excel 2010.

-2

Just open the document without activating macros, then open the code editor to see what they do.

3
  • Three assurances from SO that doing this is safe. How much safer can you get?
    – Dustman
    Nov 6, 2008 at 4:48
  • 2
    a lot. If there was a buffer overrun in some other part of Word, you might still be compromised
    – PsychoData
    Sep 22, 2015 at 15:19
  • 2
    Calling this dangerous would be an understatement
    – jrtapsell
    Nov 6, 2017 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.