Office macro and OLE extractor
Extract VBA macros from DOCM, XLSM, and legacy OLE documents, and deobfuscate the string-concatenation tricks they hide behind.
Open in ctfpalModern Office documents are ZIP archives; legacy ones are OLE compound files. Either way, the macro code is stored separately from the visible document, and extracting it is a container problem rather than a parsing problem.
This separation is helpful: you never have to open the document to read its code, and the code you extract is the original source rather than a decompilation, because VBA is stored as compressed source alongside its compiled form. What you get back is exactly what the author wrote, obfuscation and all.
What to expect in the macro
- `AutoOpen` / `Document_Open` / `Workbook_Open` - the entry points that run without user action. Start there.
- String concatenation obfuscation -
"po" & "wers" & "hell"defeats naive grep. Evaluate the concatenations rather than searching the source. - `Chr()` arithmetic - character codes built by expressions, sometimes with an XOR key nearby.
- A dropped second stage - the macro usually decodes a payload and hands it to something else. That payload is the actual answer.
Related tools
PDF object and stream analyzer
Walk PDF objects, decompress streams, extract embedded files and JavaScript, and find text hidden under redaction boxes.
ZIP archive inspector
Read a ZIP’s central directory and local headers, spot mismatches used to hide files, and check encryption and compression per entry.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.