There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents?

  • Are there sub-strings I can look for?
  • Any host-side tools I can use (without having to install a virus scanner)
  • Any tell-tale signs within the raw-file that would tip off something isn't quite right with the file?
  • What do you mean? What version of MS Office? For most, disable macros in Excel/word/etc. prior to opening said file, open said file (but do not "trust" it or enable macros), then ALT+F11 to see if there are any macros. If the code is protected, assume macros exist.
    – Othya
    Jan 14 '16 at 19:02
  • Do you mean something like OfficeMalScanner? Macros only work in Microsoft Office if enabled.
    – Daniel Ruf
    Jan 15 '16 at 18:41

Detecting malware in Office documents works like everywhere else too: You might use a pattern-based approach for known malware and you shall use heuristic to detect potentially malicious behavior.

There is no “common pattern“ for malware. Some might write text files, some might download binaries, some might delete registry settings, some might copy themselves onto network shares.

Detecting such malicious actions require you to understand what is legitimate within a macro. Everything else is potentially harmful. Keep in mind: Running macros from untrusted sources is like executing a binary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.