Example VBA Stomped Documents Repository

A repository of example VBA stomped documents. For more information about VBA Stomping, see vbastomp.com. These are non-malicious documents and the macro is a simple message box popup.

You must open the file that matches your office version to see the desired effect of VBA stomping.

Note: VBA stomping does not currently work for XLS files, never-the-less they have been included in this repo.

Stomped Files (Random vs Fake Code)

Files tagged with _random have had their VBA source code replaced with random bytes using the Adaptive Docoument Builder Python script.

Files tagged with _fakecode have had their VBA source code replaced with the source code found in fakecode_word_vba.txt or fakecode_excel_vba.txt using the Evil Clippy tool.

Filename Convention

The file name starts with the Office version and indicates if it is a 32-bit or 64-bit install.

The Office version is followed by either _word or _excel indicating whether it is an MS Word or MS Excel document.

The last part of the filename indicates whether the VBA source code was replaced with random bytes or with new source code as described in the section above.

The .doc and .xls extensions are files saved in the 97-2003 format, while the docm and xlsm file formats are saved in the 2007 and up format (a zip archive xml format).

Original Files

The original files can be found in the original_files_b4_stomping folder.