2

I have an XLSM file from an untrusted source. It is likely that the content is benign, but to be sure, I want to examine the VBA code inside first.

How do I examine the file's source code without risk? Is the default setting of Excel, which blocks macros from files stored in "untrusted locations", sufficient, or are there known ways to circumvent that?

I could set up a VM without LAN access and install Office there, but if there's an easier solution, I'm all ears...

1 Answer 1

2

You need to insure that it won't do anything autonomously. Macro can execute autonomously if they respond to certain events. Fortunate we can inhibit this kind of autonomous behavior.

Say, for example, that we wish to examine the VBA coding within DontCrossTheStreams.xlsm. Rather than opening the file by double-clicking, we use a short macro to open the file:

Sub OpenSafely()
    Application.EnableEvents = False
    Workbooks.Open Filename:="DontCrossTheStreams.xlsm"
End Sub

Macros are very easy to install and use:

  1. Alt+F11 brings up the VBE window
  2. Alt+I. Alt+M opens a fresh module
  3. paste the stuff in and close the VBE window

If you save the workbook, the macro will be saved with it.

If you are using a version of Excel later then 2003, you must save the file as .xlsm rather than .xlsx.

To remove the macro:

  1. bring up the VBE window as above
  2. clear the code out
  3. close the VBE window

To use the macro from the Excel window:

  1. Alt+F8
  2. Select the macro
  3. Touch RUN

To learn more about macros in general, see:

http://www.mvps.org/dmcritchie/excel/getstarted.htm

and

http://msdn.microsoft.com/en-us/library/ee814735(v=office.14).aspx

Macros must be enabled for this to work!

(but once the suspect workbook is opened, events will be disabled)

2
  • Gary's Student:  You possibly know more about Microsoft Office than 99% of the world’s population. Please add some explanation to the above, to make it accessible to (usable by) the rest of us. For example, “Open Excel. Open the VBA Editor as described in How do I add VBA in MS Office? Enter (type or copy & paste) the above code into your editor (replacing DontCrossTheStreams.xlsm with the name of your untrusted file) and then run the OpenSafely routine.” May 25, 2020 at 22:21
  • @Scott I will expand my answer......................check back tomorrow. May 25, 2020 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .