MaldocTrace: Emulate VBA and Excel 4.0 macros in a simulated Windows environment
A new open-source tool called MaldocTrace has been released to analyze and recover the hidden commands inside malicious Microsoft Office documents without executing them.
MaldocTrace is a defensive analyzer for malicious Office documents, written in Go. It extracts VBA and Excel 4.0 (XLM) macros, rebuilds obfuscated strings, and emulates the macros in a fully simulated environment. The output reports what the document would do: the commands it would run, the payloads it would decode and the files it would drop. All of it is backed by evidence that points to the module, procedure and line (or sheet and cell) that produced it.
Documents with no macros at all are covered too. Remote template injection, DDE fields, linked and embedded OLE objects (including Equation Editor exploits in RTF), hyperlinked lure images and VBA stomping are reported as static findings.
Deep analysis of macro code
The tool can handle a wide variety of file formats, including OLE/CFB containers like .doc and .xls, OOXML files like .docx and .xlsx, RTF, and raw VBA text. It includes MS-OVBA decompression, UserForm control properties, and resource limits against zip bombs and malformed containers.
A key feature is its XLM interpreter, which starts at Auto_Open and follows commands like GOTO, RUN, and ON.TIME. It also simulates Windows APIs such as EXEC, CALL, and REGISTER, and applies plausible answers to anti-sandbox probes like GET.WORKSPACE.
The VBA interpreter covers a subset of the language that malware relies on, including procedures, loops, arrays, and string built-ins. It also performs static deobfuscation, such as constant folding of functions like Chr and StrReverse.
Recovering hidden payloads
MaldocTrace can recover payloads hidden in various places within a document. These include cell values, document properties, document variables, and UserForm controls. It also extracts the document body text, which is often used to store and read back dropped payloads.
The tool can decode PowerShell commands, handle UTF-7 shellcode buffers, and reproduce certutil -decode operations over a virtual file system. It also identifies PE/ZIP/OLE/PDF files from their headers.
A notable example is the recovery of a shellcode loader that uses MultiByteToWideChar to copy a UTF-7 encoded buffer into RWX memory. MaldocTrace resolves the memory pointer and decodes the buffer, revealing x64 shellcode.
Robust and transparent analysis
The tool is designed to be robust against hostile input. Each pipeline stage recovers from panics and records the failure as a diagnostic, ensuring a bad sample never kills a batch run. The VBA pipeline and container parsers are also fuzzed.
Every command, payload, and indicator carries an evidence ID, such as event-3 or command-1, along with its source location. This allows analysts to trace the origin of every action back to a specific line of code.
MaldocTrace is available as prebuilt binaries for Windows, Linux, and macOS (x64 and ARM64) on its GitHub Releases page. It requires Go 1.23+ and has only one dependency, golang.org/x/text.
Related
