Skip to content

CybercentreCanada/assemblyline-service-XLMMacroDeobfuscator

Repository files navigation

assemblyline-service-XLMMacroDeobfuscator

Decode obfuscated XLM macros (also known as Excel 4.0 macros).

This service wrap the excellent tool XLMMacroDeobfuscator published by DissectMalware here which utilizes an internal XLM emulator to interpret the macros, without fully performing the code.

Original license for the library can be found here: https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/master/LICENSE

Thank you @DissectMalware for releasing this tool!