[Name]
MaldocTrace

[Version]
0.2.1 (git tag v0.2.1)

[Homepage]
https://github.com/debugactiveprocess/MaldocTrace

[Download]
Release page (source and prebuilt binaries):
https://github.com/debugactiveprocess/MaldocTrace/releases/tag/v0.2.1
Source tarball:
https://github.com/debugactiveprocess/MaldocTrace/archive/refs/tags/v0.2.1.tar.gz

[Author]
Ialle Teixeira - https://github.com/debugactiveprocess
Neriberto Prado - https://github.com/neriberto

[Licence]
Apache License 2.0

[Description]
MaldocTrace is a defensive analyzer for malicious Office documents, written in
Go. It extracts VBA and Excel 4.0 (XLM) macros, deobfuscates them, and emulates
them in a fully simulated environment: no process is started, no network
request is made and no COM object is created. The report shows what the
document would do (command lines, decoded payloads, dropped files), with each
result traced back to the module, procedure and line, or sheet and cell, that
produced it.

Main features:

• Containers: OLE/CFB (.doc, .xls, .ppt), OOXML (.docx, .docm, .xlsx, .xlsm,
  .pptm), RTF and plain VBA text.
• VBA emulation with simulated WScript.Shell, WMI, FileSystemObject,
  ADODB.Stream, XMLHTTP, ScriptControl and the Word and Excel object models.
• Excel 4.0 macros: BIFF8 formulas decompiled and executed from Auto_Open
  (GOTO, RUN, WHILE/FOR, FORMULA self-decoding, EXEC/CALL/REGISTER simulated).
• Payload recovery: PowerShell -EncodedCommand, UTF-7 shellcode buffers,
  certutil -decode chains, JScript passed to ScriptControl.
• Static findings for documents with no macros: remote template injection,
  external OLE objects (MHTML, ms-msdt), DDE/DDEAUTO fields, and RTF
  Equation Editor exploits (CVE-2017-11882, CVE-2018-0802, CVE-2018-0798),
  including heavily obfuscated \objdata.
• VBA stomping detection (p-code literals missing from the source).
• Text, JSON and JSONL output; batch mode; --dump-payloads writes recovered
  files with neutral extensions and a manifest.

[Dependencies]
Build: Go >= 1.23 and golang.org/x/text (Debian: golang-golang-x-text-dev).
Runtime: none. The binary is static (CGO disabled) and does not need Python,
Office or Wine.

[Similar tools]

• oletools (olevba, rtfobj, oleobj, msodde): static extraction and keyword
  detection; olevba does not emulate macros.
• ViperMonkey: VBA emulator (Python 2); no XLM emulation, no RTF/DDE/template
  analysis.
• XLMMacroDeobfuscator: XLM only.
  MaldocTrace combines VBA and XLM emulation with static detection of
  macro-less attacks in a single dependency-free binary.

[Activity]
The project started in November 2026. Releases 0.1.0, 0.2.0 and 0.2.1 were
published that month, and development is active.

[How to install]
From the release tarball:
wget https://github.com/debugactiveprocess/MaldocTrace/archive/refs/tags/v0.2.1.tar.gz
tar xzf v0.2.1.tar.gz
cd MaldocTrace-0.2.1
go build -trimpath -ldflags "-X github.com/debugactiveprocess/MaldocTrace.Version=0.2.1" -o maldoctrace ./cmd/maldoctrace
go test ./... # optional, runs the test suite
Or with the Go toolchain:
go install github.com/debugactiveprocess/MaldocTrace/cmd/[email protected]

[How to use]
maldoctrace analyze suspicious.doc # text report
maldoctrace analyze suspicious.xls --format json # full JSON report
maldoctrace analyze sample.rtf --show-strings # include rebuilt strings
maldoctrace analyze sample.docm --dump-payloads ./out
maldoctrace analyze ./samples --recursive --format jsonl
maldoctrace extract suspicious.doc --out ./vba # extract VBA modules
maldoctrace inspect suspicious.doc # container overview

[Packaged]
Not packaged for Debian yet; the repository has no debian/ directory. The
module path matches the repository and the only dependency is already in
Debian, so it should package with dh-golang. I am happy to help with the
packaging.