Skip to content
Get packs

Guide · Agent skill

How to use the Analyzing Office Macro Malware agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the analyzing-macro-malware-in-office-documents agent skill, a set of instructions and scripts that tells an AI agent how to examine suspicious Word, Excel and PowerPoint files that may carry malicious macros. It is written for security analysts, malware researchers and incident responders, and assumes you have not used agent skills before. By the end you will know how to install the skill, ask for the analysis in plain language, and what safety precautions to take before opening a suspect document.

Analyzing Office Macro Malwaremukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip. Download the skill ZIP from this page and unzip it to get the skill folder containing SKILL.md, scripts/agent.py and references/api-reference.md.
  2. 2Place the skill folder. Copy the folder into ~/.claude/skills/ for personal use or into .claude/skills/ inside your project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Install dependencies. Install Python 3.8 or newer, then run pip install oletools and pip install xlmdeobfuscator. Get oledump.py from Didier Stevens.
  4. 4Prepare an isolated VM. Set up an analysis VM without Microsoft Office and keep it disconnected from production networks before opening any suspect file.
  5. 5Ask for the analysis. Describe the suspicious file and your goal in plain language, such as asking for the download URL and execution method.
  6. 6Review the report. Check the agent's findings, including the deobfuscated code, IOCs and MITRE ATT&CK mapping, and verify key items manually before acting on them.

What does this skill make the agent do?

When installed, the agent follows a structured workflow for examining suspicious Office documents that may contain malicious VBA macros. It guides triage with the oletools tools olevba and oleid and with oledump.py by Didier Stevens, extracts VBA source, and attempts to undo common obfuscation such as Chr() calls and string splitting.

The workflow also checks for Excel 4.0 macros, DDE fields and remote templates. The goal is to reconstruct the attack chain, such as the download URL and execution method, and map findings to MITRE ATT&CK techniques.

  • Triage: decide whether a .doc, .docm, .xls, .xlsm or .ppt file contains macros or other active content
  • Extract and read VBA source, including auto-execution triggers and suspicious functions
  • Deobfuscate Chr(), ChrW(), string concatenation, StrReverse and Replace() patterns
  • Analyze Excel 4.0 (XLM) macros that bypass VBA-only detection
  • Check for DDE fields, remote templates and embedded objects
  • Organize findings into an analysis report with IOCs

How do you install the skill?

Download the skill ZIP from this page and unzip it. Place the resulting skill folder in one of two locations. For a personal install available across your projects, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.

If you use the Claude apps instead of a local setup, you can upload the skill under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/
  • Project only: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload

Which tools and dependencies do you need?

The skill expects Python 3.8 or newer and the oletools package. Install oletools and XLMDeobfuscator with pip. You also need oledump.py by Didier Stevens, which is a separate download from his site. LibreOffice is optional and is used for safe rendering, since it does not execute VBA macros by default.

The skill's own prerequisites recommend an isolated analysis VM without Microsoft Office installed. This prevents an accidental double-click from running the macro.

  • Python 3.8+ with oletools
  • oledump.py by Didier Stevens
  • XLMDeobfuscator, needed for Excel 4.0 analysis
  • LibreOffice (optional, for safe rendering)
  • An isolated analysis VM without Microsoft Office (recommended)
pip install oletools pip install xlmdeobfuscator

How do you trigger the skill with a natural request?

You do not need special syntax. The skill activates for requests about Office macro analysis, VBA malware investigation, maldoc analysis or document-based threat examination. Describe what you have and what you need, and include the file name and its location so the agent can work on it.

Good requests state the goal. For example, ask for the download URL and execution method, or ask whether a document uses macros, DDE or a remote template.

  • Analyze suspect.docm and tell me the download URL and how the macro runs.
  • Check this Excel file for XLM macros and deobfuscate them.
  • Is this Word document using DDE or a remote template instead of macros?
  • Map the findings in this maldoc to MITRE ATT&CK techniques.

What are the core triage commands?

Start with a quick triage. olevba reports macros and suspicious items, oleid shows indicators such as VBA Macros, XLM Macros and External Relationships, and oledump.py lists OLE streams. Streams marked with M contain VBA macros, and streams marked with m contain macro attributes.

To pull out the VBA source with deobfuscation, use olevba with its decode and deobf options. The extracted code can be saved to a file for review.

  • olevba: quick macro report
  • oleid: indicator check, including XLM Macros, External Relationships, ObjectPool and Flash
  • oledump.py: stream listing and inspection
olevba --decode --deobf suspect.docm

How does the skill handle obfuscation and Excel 4.0 macros?

The skill's SKILL.md includes a Python example that resolves Chr() and ChrW() calls, removes simple string concatenation, reverses StrReverse strings and resolves Replace() calls. Mid, Left and Right obfuscation is marked for manual review because it is more complex. Treat the output as a starting point and check the reconstructed code yourself.

For Excel 4.0 macros, the skill uses olevba's XLM option and XLMDeobfuscator. It watches for functions such as EXEC(), CALL(), REGISTER(), URLDownloadToFileA and ALERT().

  • Auto-execution triggers to look for: AutoOpen, Document_Open, Workbook_Open, AutoExec
  • Suspicious functions to look for: Shell, CreateObject with WScript.Shell, URLDownloadToFile, MSXML2.XMLHTTP, ADODB.Stream
xlmdeobfuscator -f suspect.xlsm

What should you know before running the scripts?

The skill runs scripts, and it is designed for analysis rather than everyday use. Opening a live malicious document can execute it, so run the analysis inside an isolated VM without Microsoft Office. The skill does not use the network, according to its listing, but the malware you are analyzing may try to reach the internet when it runs, so keep the VM disconnected or sandboxed.

Do not use this skill for non-macro threats such as DDE or remote template injection that need specialized tooling. The skill covers detection of these, but its own guidance says deeper analysis may be needed. It is also not meant for ordinary editing or automation of Office files.

  • Run in an isolated analysis VM without Office installed
  • Keep the analysis machine away from production networks
  • Use it for triage and reporting, not for opening documents on a workstation

What people use it for

  • Triage a phishing attachment flagged by email security to see whether it contains auto-executing macros.
  • Extract the payload download URL and execution trigger from a macro-enabled Word or Excel file for an incident report.
  • Work through an Excel 4.0 (XLM) macro sample that a VBA-only check would miss.

Frequently asked questions

How do I install the analyzing-macro-malware-in-office-documents skill?

Download the skill ZIP from this page and unzip it. Put the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.

What do I need installed to use this skill?

You need Python 3.8 or newer, oletools (pip install oletools), oledump.py by Didier Stevens, and XLMDeobfuscator (pip install xlmdeobfuscator) for Excel 4.0 analysis. LibreOffice is optional for safe rendering, and an isolated analysis VM without Microsoft Office is recommended.

Is this skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. Check the license file in the skill folder for the full terms. The tools it relies on, such as oletools and XLMDeobfuscator, are installed separately with pip.

Can I run this on my normal work laptop?

It is not recommended. The skill runs scripts, and opening a live malicious document can execute it. Use an isolated analysis VM without Microsoft Office installed.

Does the skill analyze DDE and remote template attacks?

It checks for DDE fields, remote templates and embedded objects, but its own guidance says these non-macro threats may need specialized tooling beyond this skill. Use it for detection and triage, then bring in dedicated tools where needed.

How is this different from just running olevba myself?

The skill gives the agent a repeatable, structured workflow: triage, extraction, deobfuscation, Excel 4.0 checks, non-macro checks and a report template. You still run the same underlying tools, and you should review the agent's output yourself.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security analysts, malware researchers and incident responders who want a repeatable checklist for triaging macro-enabled Office files, provided they work in an isolated VM. It is not a fit for people who only want to edit or automate ordinary Office documents, or for specialized DDE and remote template investigations that need dedicated tooling.

Download the skill