VBA macros and embedded files/objects are stored as OLE files inside OOXML files.
You can have .docm files with many OLE files, like this one, analyzed with zipdump.py:
If you analyze this with oledump.py, each OLE file inside the ZIP container will get its own letter prefix:
Use this letter prefix to select the correct stream, like this for the VBA code stream:
If it’s the first OLE file (prefix A) you want to analyze with oledump.py, it’s actually not necessary to include the letter:
But the letter is required for any other OLE file:
Although it is not case-sensitive:
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.