Skip to content
Get packs

Analyzing Office Macro Malware

Triage and deobfuscate malicious VBA macros and other active content in Office documents

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a structured workflow for examining suspicious Word, Excel, and PowerPoint files that may carry malicious macros. It guides triage with oletools tools (olevba, oleid, oledump), extracts VBA source, attempts to undo common obfuscation such as Chr() calls and string splitting, and checks for Excel 4.0 macros, DDE fields, and remote templates. The goal is to reconstruct the attack chain, such as the download URL and execution method, and map findings to MITRE ATT&CK techniques.

Great for

  • Security analysts triaging phishing attachments flagged by email security
  • Malware researchers who want a repeatable checklist for Office document analysis
  • Incident responders extracting payload URLs and execution triggers from macro-enabled files

Skip it if

  • Running the included scripts on a normal workstation with Office installed, since opening live malicious documents can execute them (use an isolated analysis VM)
  • Non-macro threats like DDE or remote template injection that need specialized tooling beyond what this skill covers, as the skill itself states
  • Non-security users who only want to edit or automate ordinary Office documents

Try asking

  • “Analyze suspect.docm for auto-execution triggers and download URLs”
  • “Extract and deobfuscate the VBA macros in this Excel file and summarize the attack chain”
  • “Check whether this document uses Excel 4.0 macros or DDE instead of VBA”
  • “Map the behaviors found in this phishing attachment to MITRE ATT&CK techniques”
Step-by-step guide: how to use Analyzing Office Macro MalwareInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-macro-malware-in-office-documents.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-macro-malware-in-office-documents.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-macro-malware-in-office-documents.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always run analysis in an isolated VM without Office installed, and keep the sample offline
  • Ask for the workflow step by step (triage, then extraction, then deobfuscation) so you can verify each output
  • Cross-check IOCs such as URLs and hashes against your own threat intelligence rather than trusting the agent's summary

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.