Read the macros without opening the file MACROLENS

The only safe place to read a macro is somewhere that cannot run it

The question people actually have about a macro-enabled document is not whether a scanner flags it. It is what the macro does. Scanners disagree, a clean result is not an assurance, and plenty of legitimate businesses still send spreadsheets with real VBA in them.

Answering that means reading the source, and the obvious ways to read it are the unsafe ones. Opening the file in Office puts the macro one mis-click from running. Handing it to a library built to work with VBA means handing an unknown macro to code that knows how to execute it. A browser tab with no eval in it has no mechanism for running VBA at all, which is why the extraction here is written by hand from the specification rather than borrowed.

How the source is actually found

The chain runs container, storage, stream, decompression, source.

• A modern .docm, .xlsm or .pptm is a zip, with vbaProject.bin inside it.
• An older .doc, .xls or .ppt is already an OLE compound file: a whole filesystem in a file.
• vbaProject.bin is itself an OLE compound file. Inside it, a storage called VBA holds one stream per module and a stream called dir.
• dir is compressed with the scheme in MS-OVBA 2.4.1. It lists the modules, their stream names, and for each one the byte offset in its stream where the compiled p-code stops and the compressed source begins.

All of which is implemented here, by hand. It matters because that offset is the whole trick: a module stream begins with compiled p-code, and the readable source is behind it. A tool that does not walk dir properly either misses the source or shows you the p-code.

What to look for once you can see it

Malicious VBA is rarely subtle once it is in front of you, because it has to do concrete things. Look for AutoOpen, Document_Open, Workbook_Open or Auto_Exec, which run without being asked. Look for Shell, WScript.Shell, CreateObject, powershell, and anything that writes to disk or fetches from a URL.

Then look for the opposite of clarity: long strings of hexadecimal or base64, string concatenation assembling a word one character at a time, Chr() arithmetic, enormous blocks of dead code, and comments written to be read by somebody who is not you. Obfuscation is not itself proof of anything, and an ordinary business macro almost never needs it.

Reading the source tells you what a file intends. If you have decided you do not want any of it, DISARM removes the macro project and everything else that runs, and writes the document back as the plain format. X-RAY reads what a file is when its extension is not telling the truth, and DECODE unwraps the encoded blobs a macro was going to unwrap for itself.