# XLMMacroDeobfuscator

> Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. An internal XLM emulator interprets the macros without fully performing the code, and results can be exported as JSON.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/DissectMalware/XLMMacroDeobfuscator>
- Primary source: <https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/43114164d89b8b3b426144f1fdfeb2ca75d28b92/README.md>
- Catalog page: <https://awesomerea.org/resources/xlmmacrodeobfuscator/>
- Record JSON: <https://awesomerea.org/resources/xlmmacrodeobfuscator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/xlmmacrodeobfuscator/index.md)

## Requirements & limits

- Installed with pip. Loading xls files through Microsoft Excel requires Windows, pywin32 and the --with-ms-excel switch; otherwise the xlrd2 library reads them. The newest release is v0.2.7 from 2022-09-21.
- Apache-2.0 per LICENSE.

## Primary sources

1. <https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/43114164d89b8b3b426144f1fdfeb2ca75d28b92/README.md>

## More in Native binaries

- [PE Tree](https://awesomerea.org/resources/pe-tree/index.md) · Tool
- [RpcView](https://awesomerea.org/resources/rpcview/index.md) · Tool
- [amoco](https://awesomerea.org/resources/amoco/index.md) · Tool
- [Chisel](https://awesomerea.org/resources/chisel-lldb/index.md) · Tool
- [gdbgui](https://awesomerea.org/resources/gdbgui/index.md) · Tool
- [Porosity](https://awesomerea.org/resources/porosity/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.