Tool
XLMMacroDeobfuscator
Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. An internal XLM emulator interprets the macros without fully performing the code, and results can be exported as JSON.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Installed with pip. Loading xls files through Microsoft Excel requires Windows, pywin32 and the --with-ms-excel switch; otherwise the xlrd2 library reads them. The newest release is v0.2.7 from 2022-09-21.
- Apache-2.0 per LICENSE.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · DissectMalware/XLMMacroDeobfuscator · Revision 4311416