vbaDNA — Malva.RE's VBA analysis engine
vbaDNA is Malva.RE's purpose-built VBA macro analysis engine. It reads both strands of a VBA macro — the stored source code and the compiled P-code — and compares them. That double reading is where the “DNA” name comes from: like two DNA strands, the truth appears when you put them face to face.
A VBA macro exists in two forms at once: the source (what an analyst sees), and the P-code — compiled bytecode that is what actually runs inside Office. Attackers weaponize the gap between them.
The problem it solves
- VBA Stomping — the source is blanked or replaced with a benign decoy, but the malicious P-code remains. A tool that only reads source sees nothing; the machine runs the P-code.
- VBA Purging — the opposite: the compiled P-code cache is stripped to break tooling, leaving only the source.
vbaDNA reads both strands, disassembles and decompiles the P-code, then diffs the reconstructed source against the stored source — the gap reveals stomping. Most tools don't do this.
What it produces per module
In the report, each VBA module is broken down into complementary views:
| View | Content | Role |
|---|---|---|
| Stored VBA | the decompressed source code | what the analyst sees; re-analysed as a script |
| P-code | the disassembled compiled bytecode | what actually runs, at the instruction level |
| Decompiled VBA | source reconstructed from the P-code | the behavioural truth, independent of the stored source |
| Diff | decompiled ↔ stored comparison | highlights VBA Stomping |
What it does
- Opens both modern (OOXML) and legacy (OLE) Office documents, including encrypted ones (e.g. the well-known default Excel password), and locates every VBA module.
- Recovers the stored source and, separately, disassembles the compiled P-code instruction by instruction.
- Decompiles the P-code back to source — reconstructing what the macro really does even when the stored source has been tampered with.
- Flags suspicious keywords (execution, persistence, evasion primitives) and obfuscation artefacts (junk identifiers).
Key detections
- VBA Stomping — revealed by comparing the P-code-reconstructed source against the stored source; a significant divergence flags the module (MITRE T1564.007, malicious verdict).
- VBA Purging — detected when the compiled P-code cache has been stripped to break tooling; also T1564.007.
- Suspicious keywords — execution / persistence / evasion primitives in the macro.
Supported formats
- OLE2 / Compound File — legacy Office (
.doc,.xls,.ppt), Outlook MSG. - OOXML / ZIP — modern macro documents (
.docm,.xlsm,.pptm). - Encrypted documents — transparently decrypted, including the well-known default Excel password.
Limits
- The P-code decompiler implements a large opcode set but not all: rare or deprecated opcodes raise a handled exception, and reconstruction can be partial on very unusual VBA.
- P-code is version-dependent on the VBA/Office that compiled it.
- vbaDNA analyzes VBA — not Excel 4.0 / XLM (formula) macros, handled elsewhere.