Анализ вредоносных макросов в Office-документах

★ 8.4 · security

analyzing-macro-malware-in-office-documents is a Claude Code skill that analyzes malicious VBA macros embedded in Microsoft Office documents — Word, Excel, and PowerPoint — to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. It uses olevba, oledump, and programmatic VBA deobfuscation to resolve Chr(), StrReverse(), Replace(), and string concatenation, reconstructing the full attack chain from a suspect file. The skill also covers Excel 4.0 (XLM) macro analysis via xlmdeobfuscator and detects DDE, embedded objects, and remote template injection as alternative attack vectors. It requires Python 3.8+ with oletools installed and an isolated analysis VM, making it the right fit for incident responders and threat intelligence analysts investigating maldoc-based phishing campaigns.