CODEWITHSUNDEEP
vbasecurityms-word
Dustman
Dustman

Reputation: 5261

How can I find out what a macro does without exposing myself to it?

I have been given two different Microsoft Word document that my virus scanner has warned me contains macros. These should be simple text files, and the person who sent them doesn't even know what a macro is; they may be a mistake on his part, but they might be signs of a malicious infection. My installation of OpenOffice.org is set not to load macros at all, as I rarely use them, so I am not concerned about the security of my system. What I would like to be able to do is find out what those macros do without exposing my system to any malicious intent from those macros, in order to tell the person who sent me the documents whether or not he is spreading an infection.

Upvotes: 9

Views: 48748

Answers (9)

Andrea Minosu
Andrea Minosu

Reputation: 61

Upvotes: 1

Noelkd
Noelkd

Reputation: 7906

If you want to view word macros without opening the word document to view the macros you can use a script called oledump.py by Dider Stevens.

Once you have the script you can do this:

python oledump.py "your_word.doc" -s a -v

This should return a listing of all the macros in the word document.

Upvotes: 5

Emjay
Emjay

Reputation: 71

The .???x is just a zip-format.

unzip the file and you end up with something like this:

.
├── [Content_Types].xml
├── docProps
│   ├── app.xml
│   ├── core.xml
│   └── custom.xml
├── _rels
└── word
    ├── document.xml
    ├── fontTable.xml
    ├── _rels
    │   ├── document.xml.rels
    │   └── vbaProject.bin.rels
    ├── settings.xml
    ├── styles.xml
    ├── theme
    │   └── theme1.xml
    ├── vbaData.xml
    ├── vbaProject.bin
    └── webSettings.xml

now u can analyse the vbastuff with Texteditor or other VBA-Editor of your choice.

Upvotes: 6

Eric Ouellet
Eric Ouellet

Reputation: 11754

The most secure way to see macros content without running them is to open Visual Basic Editor from you office document which will contain the content of the macros.

To open Visual Basic Editor (Office 2010, probably 2013 and 2016):

  1. Open the document
  2. You can enable editing if asked, no macro will be executed
  3. Right click on the Ribbon (menu) - Choose: Customize the Ribbon
  4. In the right section, select "Developer", it will add a tab "Developer" on the Ribbon. Press OK.
  5. Go to the "Developer" tab and click the "Visual Basic Editor".

Now you can see all macros.

Hope it helped you, it worked for my version of excel 2010.

Upvotes: 0

Richard B
Richard B

Reputation: 1183

I just ran a test. I opened Word (2007) and:

  1. Created a simple macro and saved with the document as a "Word macro enabled document (.docm)"
  2. Went into the security settings (Office Button 'File'\Word Options\Trust Center\Trust Center Settings\Macros Settings) and clicked the "Disable all macros with notification" radio button which will prevent macros from running unless you click the button to allow them to run.
  3. Opened the *.docm document and the macro didn't run, but I was able to go to the "View" tab on the ribbon control and click the Macros button and view Macros and then edit the macro to open a VBA IDE to see the macro code.

This all assumes you are using Word 2007, although I'd expect the same capability in the last version or two of Word. I don't have Open Office on this box, but, I'd also expect it to have the same functionality.

Good Luck!

Upvotes: 4

PsychoData
PsychoData

Reputation: 1304

Just to expound on top of these previous posts -

Here is the process I followed -

  1. Open file
  2. Enable Editing to get out of protected view
  3. AltF11 to open the Visual Basic editor
    • Sometimes you can apparently view the macros here, in my Word 2013 I could not.
  4. Minimize or close the VB editor window. We'll reopen in a minute
  5. Hold Shift while you click Enable Content. This will keep it from running AutoOpen macros.
  6. AltF11 to open the Visual Basic editor.
  7. Now you may see the macros that you didn't see before.

Upvotes: 11

Martin Kealey
Martin Kealey

Reputation: 683

(I thought someone ought to answer the original question about using OpenOffice with macro execution globally disabled; saying "open the code editor" is correct but really needs a bit more hand-holding for newbies; it certainly took me ages to find it the first time.)

Anyway, according to http://www.tutorialsforopenoffice.org/tutorial/Macros.html, you can view (or edit) the macros by going Tools → Macros → Organize Macros → OpenOffice.org Basic, which will bring up the the OpenOffice.org Basic Macros window.

From there it's just a matter of clicking around the tree to find any macros included in the file, and going Edit to see what's in each one.

Upvotes: 1

paxdiablo
paxdiablo

Reputation: 881633

Two possibilities. Get yourself a free copy of VMWare player and install Windows and MS Office within it. Then load up the document and let the macros run.

The other possibility. I think you can load the doc into MS Word and automatically disable macros, but the macro is still there so you can view it with Word itself.

Upvotes: 2

Laurent
Laurent

Reputation: 6205

Just open the document without activating macros, then open the code editor to see what they do.

Upvotes: -2

Related Questions