Auto-exec VBA decodes an msiexec remote-install command and passes it to an execution sink.
An auto-running macro reconstructs an obfuscated command and passes it to Shell.
Auto-run macro erases workbook data and shuts down Windows
critical
OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN
An Excel auto-open routine clears cells, saves the workbook, and shuts down or forcibly closes Windows.
An auto-running WordBasic macro copies automatic macros in both directions while saving the document.
Receipt or account-action text impersonates a brand but targets an unrelated redirector or object store.
An Excel cell formula resolves to an advised external DDE item whose service launches an executable.
An OOXML ZIP appended to another document contains a decoded command relationship target.
Compiled VBA/cache bytes expose an automatic event, project-code editing, and a foreign Office target.
An auto-running macro exports a VBA component and imports it into another workbook.
Excel 4.0 macro sheet uses formula APIs that call directly into Win32.
A transparently decrypted Office package contains a VBA download, write, and execution chain.
Office document contains an embedded SWF (Flash) object.
A carved embedded OLE Office document matched exploit or payload heuristics.
An embedded OLE/OOXML object is itself an Office file that contains a VBA macro project or an Excel 4.0 (XLM) macro sheet.
MZ/PE header found inside the document.
VBA carries a base64-encoded EXE split across many string variables and rebuilds it at run time (ADODB.Stream drop-and-run).
Encrypted-package shape co-occurs with FAT-chain corruption — the canonical combined evasion form.
Equation Editor command stager — CVE-2017-11882 family
critical
CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED
Equation Native stream has invalid MTEF structure and embedded command-launch bytes.
Equation Editor exploit primitive or command-stager shape.
Equation Editor object carries Ole10Native downloader shellcode
critical
OLE_EQUATION_OLE10NATIVE_DOWNLOADER
Equation Editor OLE object contains Ole10Native shellcode with download and process APIs.
An oversized Equation Native stream begins with executable x86 control-transfer code.
An Equation 3.0 object carries executable code in a large Ole10Native stream.
Workbook has an Auto_Open defined name and stores XLM download/exec logic inside parts declared as normal worksheets.
Legacy Excel workbook contains Laroux/Larou-CV auto-open replication markers.
An auto-running macro saves a workbook into Excel's startup directory.
A Word field QUOTE expression contains a decimal-ASCII byte sequence. The decoded payload is emitted at field-update time and is typically used to assemble shell-command text that does not appear literally in the document bytes.
An auto-running macro copies code between a document and the Global/Normal template.
An auto-running macro hides macro controls and deletes the document body.
VBA macro references a Living-off-the-Land binary (certutil, bitsadmin, mshta).
Workbook contains self-identifying legacy Excel formula macro virus strings.
A macro opens autoexec.bat, config.sys, or winstart.bat for writing.
Word's binary SttbfAssoc table points the attached template at a remote URL or UNC path.
Workbook contains an XLM macro sheet plus legacy macro-virus family strings.
Auto-running VBA copies macros through Global/Normal, hooks FileSaveAs, and hides macro-management commands.
OOXML external relationship targets HTML/CAB/MHTML/HTA-style content.
Malformed OLE bytes contain AutoOpen, embedded ZIP/theme content, VBA project metadata, and URL/CMD/Shell staging tokens.
Raw streams retain auto-run, object creation, Shell, and network evidence after VBA parsing fails.
A DDE field instruction launches a dangerous system executable (cmd.exe, PowerShell, mshta, etc.).
PowerPoint OLE Pictures stream is malformed and carries a PE-like payload.
PowerPoint OLE numbered Table stream is malformed and carries a PE-like payload.
PowerPoint Pictures stream contains malformed shape-container material and shellcode.
Word OLE object pointers are malformed and unreferenced sectors contain decoded shellcode.
Word FIB points to a malformed DOP/string-table region with exploit payload evidence.
Word document contains a corrupted table border/colour formatting record — the CVE-2006-6456 memory-corruption shape.
Word OLE document has malformed-record exploit structure with payload in OLE slack.
An Office remote template hides an IPv4 address as a legacy numeric hostname.
OLE Equation Editor payload evidence: OLE MTEF Shellcode Download URL.
OLE VBA UserForm payload evidence: OLE UserForm Obfuscated Powershell.
OLE VBA macro behavior: OLE VBA Cell Dropper URL.
OLE VBA macro behavior: OLE VBA Getobject CLSID Powershell Runner.
OLE VBA macro behavior: OLE VBA Property Shellcode Loader.
OLE VBA macro behavior: OLE VBA Shape Alttext Payload Loader.
OLE VBA macro behavior: OLE VBA Shellcode Callback Loader.
Auto-exec macro launches MSHTA from a shortened URL.
Excel hidden-cell PowerShell downloader decoded from workbook data.
OOXML package anomaly: OOXML Encrypted Exploit Carrier Shape.
Auto-exec VBA loads image/shape AlternativeText into MSXML and executes an embedded XSLT script installer.
Spreadsheet declares an auto-loaded OLE object, but the referenced embedded OLE part is absent.
VBA macro builds a Shell command through decoder/string functions and includes a URL.
XLM macro sheet auto-executes an obfuscated formula/RUN chain.
Ole10Native package archive contains PowerShell downloader LNK
critical
OFFICE_PACKAGE_ARCHIVE_LNK_DOWNLOADER
OLE Package payload is an archive containing a Windows shortcut that launches PowerShell to download a remote payload.
OLE Package payload is an archive containing a shortcut, script, installer, or other executable-capable member.
OLE Package payload contains a script that hosts a shell, fetches a remote resource, and executes it.
VBA macro calls Shell() function.
PowerPoint binary-format RCE payload — CVE-2011-1269 / MS11-036 family
critical
PPT_BINARY_MEMORY_CORRUPTION_PAYLOAD
Macro-free binary PowerPoint carries a native code payload (embedded PE / process-injection shellcode).
VBA macro references PowerShell.
VBA reconstructs URLs from OOXML properties, writes downloaded scripts, and schedules them.
Raw OLE streams contain AutoOpen, DNS API use, temp/AppData staging, and hidden Shell execution.
Raw OLE macro text shows self-replication or security tampering
critical
OLE_RAW_MACRO_SELF_REPLICATION
Raw OLE streams contain macro text with auto-run, automation, CodeModule modification, and Outlook or macro-security behavior.
VBA invokes scrobj.dll DllInstall with a remote .sct URL.
A secured/protected-document call to action targets unrelated infrastructure.
An Excel externalLinks/ddeLink entry launches cmd, PowerShell, mshta, or another dangerous executable.
Payload URL was reconstructed from numeric cell values across the worksheet, not present as a literal string.
VBA macro references URLDownloadToFile API.
A package part not referenced by any relationship carries executable shellcode.
VBA ActiveX/UserForm event decodes worksheet-cell strings and executes them through ExecuteExcel4Macro.
Auto-exec VBA reconstructs a command from worksheet cells and invokes Shell.
VBA macro drives Outlook to mass-mail itself — creates mail items, harvests recipients, and auto-attaches the carrier.
VBA macro rewrites VBA project code (self-replication) and/or disables Office macro-virus protection.
VBA p-code self-replication and hosts-file tampering
critical
OLE_VBA_PCODE_SELF_REPLICATING_HOSTS_TAMPER
Compiled VBA/cache streams show auto-run, VBA project self-modification, and hosts-file or startup add-in persistence.
VBA reconstructs MSHTA network stager from UserForm data
critical
OLE_VBA_USERFORM_FRAGMENTED_MSHTA_STAGER
Auto-exec VBA combines Tag properties and hidden container strings into an MSHTA command.
VBA reconstructs embedded bytes and executes them from ProgramData
critical
OLE_VBA_DOMDOCUMENT_EMBEDDED_DROP_EXEC
VBA auto-exec macro rebuilds embedded bytes with MSXML2.DOMDocument, writes them with ADODB.Stream, and launches them from ProgramData.
Auto-exec VBA registers an executable action through the Task Scheduler COM service.
VBA writes a script-like file and launches it via Excel DDEInitiate with cmd.
VBA creates a hidden Excel 4 macro sheet, writes formulas, and runs it.
Auto-exec VBA reconstructs and runs a VBScript download/write/execute chain through ScriptControl.
VBA macro uses WScript.Shell object.
xl/connections.xml defines a data connection that executes a command (xp_cmdshell / OLEDB exec).
An Excel worksheet cell formula uses DDE syntax to launch a shell/LOLBIN command.
XLM Auto_Open macro runs host-environment checks before showing a fake error and closing.
WinAPI names, LOLBin commands, or a payload URL were reassembled from per-character CHAR()/string-fragment concatenation inside the macrosheet formulas.
Jet/Access database uses a document extension and contains macro/dropper strings.
Document contains ActiveX controls.
An Excel record-continuation (CONTINUE) block appears with no preceding record to continue — a position abused by several Excel parser CVEs.
Single non-CONTINUE record body > 8224 bytes (BIFF8 spec maximum).
Record's declared body size extends past the stream's last byte.
A BOF substream reaches the end of the Workbook stream without a matching EOF.
Workbook contains thousands of BIFF NAME records.
VBA macro uses CallByName for dynamic method invocation.
An Excel cell formula points at a remote .exe/.scr/.hta/.js or macro-enabled workbook.
RTF OLE object contains Composite Moniker CLSID without nearby scriptlet payload evidence.
VBA macro calls CreateObject.
A DDEAUTO field instruction was found — it attempts automatic execution or update when the document is opened.
An OOXML review, signing, or open-document CTA has an actionable external hyperlink.
EMF header's rclBounds rectangle has right < left or bottom < top.
EMR record's size field runs past available bytes, is < 8, or is not 4-byte aligned.
EncryptedPackage cipher body is not a multiple of 16 bytes, violating the AES block-alignment requirement in [MS-OFFCRYPTO] §2.3.4.4.
IOC-less Equation payload contains position-independent process-manipulation shellcode.
Equation exploit payload exposes a command or local executable target without a recoverable URL.
XLM macro sheet references two or more dangerous capability functions (CALL/EXEC/REGISTER/FWRITE/FOPEN).
OLE workbook contains an Excel 4.0 macro sheet, optionally with Auto_Open/Close.
Spreadsheet contains an xl/macrosheets/sheet*.xml part.
XLM macro sheet references a payload module (.dll/.exe/.ocx/.scr) by a relative (..\) or environment-variable (%ENV%\) path.
OOXML oleObject relationship targets an external HTTP(S) URL.
Document references an external target (URL) in its .rels file.
A Flat OPC/XML Office document automatically retrieves a remote template.
VBA macro calls GetObject.
Office document embeds a ShockwaveFlash object with an old SWF version.
Legacy WordBasic auto-execution markers co-occur with macro-virus family or macro-management strings.
FONT record's NUL-terminated typeface name is longer than the 32-byte spec maximum.
MATRIX record declares rows or columns > 64.
SIZE record declares an explicit point size or delta far beyond normal equation text.
DIFAT extension chain loops, points beyond file end, or its declared length disagrees with the first-sector field.
OLE compound document is named with an .rtf extension and contains ObjectPool storage.
OLE VBA macro behavior: OLE VBA ActiveX XLM Cell Stager.
OLE VBA macro behavior: OLE VBA Base64 Shell Command Stager.
OLE VBA macro behavior: OLE VBA Obfuscated URL.
OLE VBA macro behavior: OLE VBA URLDownload Reversed LOLBIN.
OLE VBA macro behavior: OLE VBA UserForm Hidden Command Stager.
OLE Excel 4.0 macro evidence: OLE XLM AutoOpen Payload Lure.
OLE Excel 4.0 macro evidence: OLE XLM Cell Array URL.
OLE Excel 4.0 macro evidence: OLE XLM Encrypted Macrosheet.
OLE Excel 4.0 macro evidence: OLE XLM Obfuscated Defined Name Chain.
OLE Excel 4.0 macro evidence: OLE XLM Obfuscated Setname Chain.
Large high-entropy bytes beyond declared streams contain shellcode or loader markers.
CFB directory red/black-tree walk visits the same DirID twice.
OLE/Word document bytes contain a hidden iframe that loads an external URL.
OLE workbook metadata lists many MacroN sheet titles with an Excel 4.0 macro-sheet marker.
Malformed OLE bytes contain PEB/API-resolver shellcode evidence.
A stream's sector chain revisits a sector or follows a pointer outside the FAT.
Two different streams' sector chains include the same sector.
OOXML package anomaly: OOXML Clickable Image Form Lure.
OOXML clickable image links to suspicious landing infrastructure.
OOXML package anomaly: OOXML Embedded Object URL.
OOXML package anomaly: OOXML External Rel userinfo Doc Lure.
OOXML package anomaly: OOXML Link Aggregator Doc Lure.
OOXML Excel 4.0 macro evidence: OOXML XLM Formula Concat URL.
OOXML Excel 4.0 macro evidence: OOXML XLM Payload URL.
Any XML part inside an OOXML package contains <!DOCTYPE.
An <!ENTITY ... SYSTEM ...> or PUBLIC declaration was found in an XML part.
External `<Relationship>` of a non-hyperlink type uses an MSDT, search-ms, MHTML, scriptlet, or javascript: scheme.
Internal-mode `<Relationship>` Target uses `..` segments that resolve above the package root.
Relationship typed as `oleObject` resolves to an HTML/CAB/MHT/scriptlet/HTA target.
The OPC relationship graph is supposed to be a DAG; a cycle is encoder-impossible.
OOXML document is encrypted with a common default password.
ObjectPool EPRINT stream contains EMF data.
OLE Package displayName is benign-looking while fullPath/defFile ends in an executable extension.
OLE Package displayName, fullPath, or defFile has an executable/script-capable extension.
OLE Package filename contains `..\` or `\\host\` traversal sequences.
VBA builds its stage-2 download URL char-by-char from string literals + Chr()/Asc()/StrReverse() (no numeric array); URLs recovered.
VBA builds its stage-2 download URL from a numeric array decoded with Chr() and a linear offset (XMLHTTP/ADODB.Stream dropper); URLs recovered.
VBA runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array (XOR/+/- decoded at runtime); URLs recovered.
VBA assembles a PowerShell command from Mid(StrReverse(...)) fragments and AES-decrypts a key-encrypted ConvertTo-SecureString stage-2 WebClient downloader; download URLs recovered.
VBA reassembles a download command via a cmd.exe character-index loop and a multi-host PowerShell downloader; payload URLs recovered.
Small embedded PowerPoint stream has sparse OffArray-style records and no normal text atoms.
PowerPoint Pictures stream and document shellcode match a CVE-2006-0022-adjacent shape.
Document loads its template from a remote URL (attachedTemplate / template / frame).
RTF OLE object contains URL Moniker evidence without a confirmed remote target.
VBA saves a copy of the workbook into Application.StartupPath (XLSTART) so it auto-loads on every Excel launch.
VBA reroutes Alt+F11 (Visual Basic editor) and/or Alt+F8 (macro list) through Application.OnKey to intercept attempts to view the macro code.
VBA infects other workbooks via an OnSheetActivate copy hook
high
OLE_VBA_WORKBOOK_INFECTION_SPREADER
VBA installs an Application.OnSheetActivate handler that copies a macro-bearing sheet into the active workbook, infecting every workbook the user opens.
Compiled VBA/cache stream pairs an auto-run token WITH a shell/download/object-execution token (the combination, not either alone).
_VBA_PROJECT stream is substantive but every module-like sibling source stream is empty or absent.
Legacy Word binary format carries executable payload markers.
Word SET/REF field variables assemble a hidden DDE command from fragments, so the literal command never appears in the document's raw bytes — a known field-chaining obfuscation.
XLM auto-exec macro uses formula APIs that can run code or write files.
Excel 4.0 macro sheet contains a URL-shortener target.
A <w:altChunk> wires an aFChunk relationship to an RTF/HTML part that is absent from the package.
VBA macro references cmd.exe.
An Excel sub-stream declares an unknown type (not workbook-globals, sheet, chart, macro, or VB-module), which older Excel may parse with the wrong record layout.
NAME record's character-count (cch) field exceeds the BIFF8 limit of 255.
Workbook contains an unusually large number of BIFF records.
An Excel sub-stream's begin (BOF) and end (EOF) markers are unbalanced — readers that ignore the mismatch can reach attacker-controlled parser state.
File has a valid OLE2/CFB header but olefile exposes zero directory streams.
First record isn't EMR_HEADER (type 1) with the documented dSignature value.
EMF header's nRecords field exceeds 100,000.
EMR record's type field is outside 1..123 standard or 0x4000+ vendor extension.
Document contains an embedded OLE object.
Workbook references another workbook via an externalLinkPath relationship (cell / dropdown / chart-source data link).
A legacy Word 6/95 WordBasic auto-execution marker such as AutoOpen was found.
MTEF version byte at the start of the Equation Native stream is not 2..6.
Inner payload of an OLE Package contains the OLE Package CLSID itself, or multiple Package CLSIDs in one container.
OLE Equation Editor payload evidence: OLE Equation OLE10Native Payload Anomaly.
OLE VBA macro behavior: OLE VBA Asc Chr Shift Shell.
OLE VBA macro behavior: OLE VBA Cell Constants WScript.Shell Exec.
OLE VBA macro behavior: OLE VBA Getobject CLSID Dangerous.
OLE VBA macro behavior: OLE VBA Getobject CLSID Evasion.
OLE VBA macro behavior: OLE VBA Reversed DocProp Config.
OLE VBA macro behavior: OLE VBA WMI Process Create.
OLE Excel 4.0 macro evidence: OLE XLM AutoOpen DefinedName.
OLE Excel 4.0 macro evidence: OLE XLM Environment Evasion Halt.
Stream below the MiniStream cutoff is allocated in the regular FAT, or vice versa.
Direntry size field claims more bytes than the FAT-walked sector chain can carry.
OOXML package anomaly: OOXML Bogus Custom Part.
OOXML package anomaly: OOXML External Rel Free Tld.
OOXML VBA project anomaly: OOXML VBA Project Renamed.
OOXML VBA project anomaly: OOXML VBA XLM Bridge Raw.
OOXML Excel 4.0 macro evidence: OOXML XLM AutoOpen DefinedName.
OOXML Excel 4.0 macro evidence: OOXML XLM Binary WinAPI Strings.
OOXML Excel 4.0 macro evidence: OOXML XLM Disguised Relationship.
OOXML package anomaly: OOXML XLSB Intl Macrosheet In XLSX.
Processing instruction with a target outside the Office allowlist (xml, mso-*).
A single CDATA section exceeds 1 MB.
Element nesting depth exceeds 256 levels.
Two different Content-Types declared for the same extension or PartName.
OOXML altChunk content injection: OOXML altChunk HTML.
OOXML altChunk content injection: OOXML altChunk Internal.
OOXML altChunk content injection: OOXML altChunk Opaque.
OOXML altChunk content injection: OOXML altChunk RTF.
OOXML altChunk content injection: OOXML altChunk RTF Autoupdate PE.
OOXML altChunk content injection: OOXML altChunk Remote.
Document contains a clickable hyperlink to a URL-shortener service.
Internal `<Relationship>` Target resolves to a ZIP entry that does not exist in the package.
>5% of parts are not reachable by walking from the root .rels through internal relationships.
Two `<Relationship>` entries inside the same `.rels` part share an Id.
OLE container holds an MS-OFFCRYPTO encrypted package (EncryptedPackage + EncryptionInfo streams).
A whole-document signature's CMS failed verification.
Inner `payloadSize` field declares more bytes than remain in the Ole10Native stream.
The leading 4-byte length field of an `\x01Ole10Native` stream does not equal the stream byte count.
Binary PowerPoint uses PPT97 CryptoAPI encryption, hiding slide and embedded-object records.
Document contains an external image relationship targeting an http(s):// URL.
An Excel externalLinks/ddeLink entry was found.
File is raw OOXML .rels relationship XML rather than a valid OOXML ZIP package.
VBA project has an untrusted, invalid, or suspicious signature state.
A VBA performance-cache (__SRP_*) stream exceeds 8 MB.
The VBA project's Authenticode signature failed verification.
Document contains VBA macro code.
Document contains vbaProject.bin — VBA macros are present.
Windows Write document evidence: WRI Embedded Exe.
Windows Write document evidence: WRI Embedded OLE.
Windows Write document evidence: WRI Equation Object.
Windows Write document evidence: WRI Header Invalid.
Windows Write document evidence: WRI OLE Package.
Windows Write document evidence: WRI OLE Wrapped.
xl/connections.xml defines a data connection whose source is a remote http(s) URL or UNC path.
Macro with AutoExec trigger found.
Macro with AutoNew trigger found.
Macro with AutoOpen trigger found.
Macro with Auto_Close trigger found.
Macro with Auto_Open trigger found.
Document drawing contains a call-to-action phrase in a shape or text box.
A DDE field instruction was found in the document XML. The command does not reference a known-dangerous executable.
Macro with Document_Close trigger found.
Macro with Document_New trigger found.
Macro with Document_Open event handler found.
VBA macro uses Environ() to access environment variables.
Equation Editor OLE CLSID found in the document.
Document contains one or more external hyperlinks.
Excel workbook contains hidden or veryHidden worksheets.
OOXML ZIP central directory is invalid, but local headers expose Office parts.
Multiple direntries share a non-null, unrecognised CLSID (>= 4 occurrences).
Package's tempPath references an `AppData\` or `Temp\` folder of the author's machine.
Macro with Workbook_Open event handler found.
A reachable VBA project contains repeated AVP replacement comments and no substantive behavior.
An Excel cell formula contains an embedded http(s)/ftp URL.
The macro carries risky capabilities but nothing indicates they are used maliciously; the verdict is capped below malicious.
OLE file bytes greatly exceed the sum of declared stream sizes.
The document/package carries a whole-document digital signature.
The document signing certificate is self-signed (issuer == subject).
Unreachable OLE sectors contain repeated AVP-disinfection remnants from a deleted macro project.
A workbook drawing object is bound to an Office Script sharing link.
An OOXML image contains a QR code resolving to an HTTP(S) URL.
olevba could not extract VBA macros from the document; VBA source extraction was skipped.
VBA project is signed by a trusted or valid certificate.
VBA macro edits its own VBA project code, with no external template or workbook target.
The VBA macro project carries an Authenticode digital signature.
The VBA project signing certificate is self-signed (issuer == subject).
Windows Write document evidence: WRI Legacy Format.