{
  "added_at": "2026-11-06",
  "category": "native-analysis",
  "description_en": "Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. An internal XLM emulator interprets the macros without fully performing the code, and results can be exported as JSON.",
  "description_zh": "用于从 xls、xlsm 和 xlsb 文件中提取并解码混淆 Excel 4.0（XLM）宏的命令行工具和 Python 库。内置的 XLM 模拟器解释宏，但不完整执行其代码，结果可导出为 JSON。",
  "entry_url": "https://awesomerea.org/resources/xlmmacrodeobfuscator/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/xlmmacrodeobfuscator/",
  "evidence_url": "https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/43114164d89b8b3b426144f1fdfeb2ca75d28b92/README.md",
  "group": "tools",
  "id": "xlmmacrodeobfuscator",
  "json_url": "https://awesomerea.org/resources/xlmmacrodeobfuscator/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/xlmmacrodeobfuscator/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/xlmmacrodeobfuscator/index.md",
  "name": "XLMMacroDeobfuscator",
  "name_zh": "XLMMacroDeobfuscator Excel 4.0 宏解码工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Installed with pip. Loading xls files through Microsoft Excel requires Windows, pywin32 and the --with-ms-excel switch; otherwise the xlrd2 library reads them. The newest release is v0.2.7 from 2022-09-21.",
    "Apache-2.0 per LICENSE."
  ],
  "requirements_zh": [
    "通过 pip 安装。借助 Microsoft Excel 加载 xls 文件需要 Windows、pywin32 和 --with-ms-excel 开关，否则由 xlrd2 库读取。最新发布是 2022-09-21 的 v0.2.7。",
    "依 LICENSE 采用 Apache-2.0 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/DissectMalware/XLMMacroDeobfuscator",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}