VBA extraction from .doc · .xls · .docm · .xlsm · flag Shell · CreateObject · URLDownloadToFile
drop Office file
Drop .doc, .xls, .docm, .xlsm, .pptm
extracts VBA macro source and flags suspicious API calls — runs entirely locally
status
drop .doc · .xls · .docm · .xlsm · .pptm · .docx (with macros)