How to check xlsx files for malicious macros or virus

[kalos]

Hello!

I got today a response from a job ad I applied and they sent me an xlsx file to test my Excel skills.

This sounds a bit dodgy to be honest and I am reluctant to open it. However, I scanned it with VirusTotal.com and no virus was found from all engines.

However, are these virus engines able to detect malicious stuff in a xlsx file, such as macros etc?

They also told me not to distribute the file because it's a 'test' so I cannot really upload it here.

Any advice?

[mouser]

There are a couple of approaches to handling such files that you don't trust:

1. User a virtual machine to open and test it and work on it
2. Use a 3d party tool to open it instead of using microsoft office (like an online service or a 3rd party office compatible tool)
3. Turn off macros/scripts in excel until you are sure you trust it.

[Target]

as long as it is actually an xlsx you wont have a problem - XLSX files can't hold macro's (they need to be in XLSM format)

as to how you confirm that I couldn't say, though excel is pretty good about highlighting files it thinks aren't in the expected format

[ConstanceJill]

Hi ^^

Just like other Office 2007 files, .xlsx files are just .zip files, so you can explore the contents with 7-zip or another archiver, and have a look at the .xml files inside with Notepad++ or other text editor of your choice.

As Target mentionned, they shouldn't contain any macro though.

[Stoic Joker]

Can't find it at the moment, but one of the hacking news sites had an article on hostel code that could be embedded in xlsx files, and a bunch of other types of MS Office document.

Bottom line, low-tech is best tech ...(because AV scanners miss stuff all the time)... Just contact them and ask if the file was sent intentionally.

This policy is mandatory at our office with any unsolicited attachments.

[app103]

Use a disposable Google account and upload it there, to open in Google Sheets. You can view it there, without any sort of Excel specific macros causing potential problems to your system.  And even if it does cause a problem, it would likely be limited to that specific Google account (not your machine), which would be a throw away account, just for that very reason.

[mwb1100]

Apparently even CSV files (!) can be vectors for an exploit: http://georgemauer.net/2017/10/07/csv-injection.html

I find that having a Linux VM to open files I don't trust (Office docs, PDFs, etc) keeps my mind at ease.  VirtualBox is free and will work great for this.  It's not necessarily completely fool proof (I imagine that even OpenOffice could be have some vulnerability), but I figure it would sandbox things well enough.