I have been given two different Microsoft Word document that my virus scanner has warned me contains macros. These should be simple text files, and the person who sent them doesn't even know what a macro is; they may be a mistake on his part, but they might be signs of a malicious infection. My installation of OpenOffice.org is set not to load macros at all, as I rarely use them, so I am not concerned about the security of my system. What I would like to be able to do is find out what those macros do without exposing my system to any malicious intent from those macros, in order to tell the person who sent me the documents whether or not he is spreading an infection.
9 Answers
Just to expound on top of these previous posts -
Here is the process I followed -
- Open file
- Enable Editing to get out of protected view
- AltF11 to open the Visual Basic editor
- Sometimes you can apparently view the macros here, in my Word 2013 I could not.
- Minimize or close the VB editor window. We'll reopen in a minute
- Hold Shift while you click
Enable Content
. This will keep it from running AutoOpen macros. - AltF11 to open the Visual Basic editor.
- Now you may see the macros that you didn't see before.
The .???x is just a zip-format.
unzip the file and you end up with something like this:
.
├── [Content_Types].xml
├── docProps
│ ├── app.xml
│ ├── core.xml
│ └── custom.xml
├── _rels
└── word
├── document.xml
├── fontTable.xml
├── _rels
│ ├── document.xml.rels
│ └── vbaProject.bin.rels
├── settings.xml
├── styles.xml
├── theme
│ └── theme1.xml
├── vbaData.xml
├── vbaProject.bin
└── webSettings.xml
now u can analyse the vbastuff with Texteditor or other VBA-Editor of your choice.
-
vbaProject.bin
is an opaque binary vs. the other text-based files. I'm guessing the magic lives there. So this answer is missing the part where it's clear how to analyze that content.– Ethan TFeb 22, 2021 at 20:28
I just ran a test. I opened Word (2007) and:
- Created a simple macro and saved with the document as a "Word macro enabled document (.docm)"
- Went into the security settings (Office Button 'File'\Word Options\Trust Center\Trust Center Settings\Macros Settings) and clicked the "Disable all macros with notification" radio button which will prevent macros from running unless you click the button to allow them to run.
- Opened the *.docm document and the macro didn't run, but I was able to go to the "View" tab on the ribbon control and click the Macros button and view Macros and then edit the macro to open a VBA IDE to see the macro code.
This all assumes you are using Word 2007, although I'd expect the same capability in the last version or two of Word. I don't have Open Office on this box, but, I'd also expect it to have the same functionality.
Good Luck!
If you want to view word macros without opening the word document to view the macros you can use a script called oledump.py by Dider Stevens.
Once you have the script you can do this:
python oledump.py "your_word.doc" -s a -v
This should return a listing of all the macros in the word document.
Two possibilities. Get yourself a free copy of VMWare player and install Windows and MS Office within it. Then load up the document and let the macros run.
The other possibility. I think you can load the doc into MS Word and automatically disable macros, but the macro is still there so you can view it with Word itself.
-
-
I received a very suspicious word.doc (not docx) today via e-mail and wanted to check what evil cargo it carries. I thought of a macro and wanted to read the script, therefore I read this thread here looking for a safe method to do this. I saved the attachment for opening it with a texteditor etc. On saving it, my anitvirus (Sophos) rang alarm for a Trojan (spyware). Dec 10, 2018 at 17:41
-
@ChristianGeiselmann lots of false positives... I have Sohpos too and it has wigged out on some of my own VBA code. This is the absolute safest method: stackoverflow.com/a/47908674/3451115 Jun 21, 2019 at 14:14
(I thought someone ought to answer the original question about using OpenOffice with macro execution globally disabled; saying "open the code editor" is correct but really needs a bit more hand-holding for newbies; it certainly took me ages to find it the first time.)
Anyway, according to http://www.tutorialsforopenoffice.org/tutorial/Macros.html, you can view (or edit) the macros by going Tools
→ Macros
→ Organize Macros
→ OpenOffice.org Basic
, which will bring up the the OpenOffice.org Basic Macros
window.
From there it's just a matter of clicking around the tree to find any macros included in the file, and going Edit
to see what's in each one.
- Regarding the check with VirusTotal, please be aware that only the first lines of each of the "Macros And VBA Code Streams" are displayed (details tab).
- Just for example (this .dotm is reported like a malware, but I'm investigating it to understand if it's not): https://www.virustotal.com/gui/file/46dd48caaaf2a36902739ed1cc11b9f073f1b76fc27af4cfb2f0264ae1838f71/details
- Regarding other answers here (I still don't have enough reputation to directly comment them), be aware that the Shift key does not prevent the execution of "ActiveX triggers" as explained here: http://www.decalage.info/vbashift so don't click "Enable Content" before you've investigated the macros.
- This other answer worked for me ("You can "enable editing" if asked, no macro will be executed") and doing this way I'm investigating a .dotm file: https://stackoverflow.com/a/35663074/6390099
The most secure way to see macros content without running them is to open Visual Basic Editor from you office document which will contain the content of the macros.
To open Visual Basic Editor (Office 2010, probably 2013 and 2016):
- Open the document
- You can enable editing if asked, no macro will be executed
- Right click on the Ribbon (menu) - Choose: Customize the Ribbon
- In the right section, select "Developer", it will add a tab "Developer" on the Ribbon. Press OK.
- Go to the "Developer" tab and click the "Visual Basic Editor".
Now you can see all macros.
Hope it helped you, it worked for my version of excel 2010.
Just open the document without activating macros, then open the code editor to see what they do.
-
Three assurances from SO that doing this is safe. How much safer can you get?– DustmanNov 6, 2008 at 4:48
-
2a lot. If there was a buffer overrun in some other part of Word, you might still be compromised Sep 22, 2015 at 15:19
-
2