← Reports Malicious Macros in Office Documents Claim_732989680_03292021.xlsm Author Moise Medici Updated 25 Oct 2025 · Completed Difficulty Easy Platform Windows Languages VBAExcel 4.0 Macro MITRE T1059 (Command and Scripting Interpreter) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1106 (Native API) T1204.002 (User Execution: Malicious File) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1218.011 (System Binary Proxy Execution: Rundll32) T1564 (Hide Artifacts) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer) Appendix 1 ↩ XLL Add-ins: FORMULA.FILL macro 2 ↩ XLL Add-ins: REGISTER macro 3 ↩ Microsoft: URLDownloadToFile function Section 6 of 6: Appendix ← MITRE ATT&CK