Skip to content
ctfpal
All tools
ForensicsRuns locallyNo account

Office macro and OLE extractor

Extract VBA macros from DOCM, XLSM, and legacy OLE documents, and deobfuscate the string-concatenation tricks they hide behind.

Open in ctfpal

Modern Office documents are ZIP archives; legacy ones are OLE compound files. Either way, the macro code is stored separately from the visible document, and extracting it is a container problem rather than a parsing problem.

This separation is helpful: you never have to open the document to read its code, and the code you extract is the original source rather than a decompilation, because VBA is stored as compressed source alongside its compiled form. What you get back is exactly what the author wrote, obfuscation and all.

What to expect in the macro

  • AutoOpen / Document_Open / Workbook_Open - the entry points that run without user action. Start there.
  • String concatenation obfuscation - "po" & "wers" & "hell" defeats naive grep. Evaluate the concatenations rather than searching the source.
  • Chr() arithmetic - character codes built by expressions, sometimes with an XOR key nearby.
  • A dropped second stage - the macro usually decodes a payload and hands it to something else. That payload is the actual answer.