VBA Decoder

The VBA Decoder analyzes Office macros to reveal obfuscated or encoded content. It accepts raw VBA source, base64-encoded payloads, or module exports and returns a readable, normalized source along with a structured risk assessment. The primary users are security analysts, incident responders, and IT auditors reviewing macro-enabled documents for malware indicators and governance. It does not execute code and provides reproducible results for investigations.
Conceptually, the tool normalizes input, applies deobfuscation heuristics to resolve string literals and concatenations, and flags suspicious API usage or AutoOpen patterns. Outputs include a decoded source, a set of detected patterns, and a risk score that helps triage investigations. The system offers export options for tooling pipelines and documentation.
Core features include decoding and normalization, optional password unlock, heuristic pattern detection, extraction of function identifiers, and export-ready results. Advanced users can request JSON AST exports or plain-text summaries. The tool handles UTF-8 inputs and produces deterministic results for identical inputs, enabling reproducible security reviews.
Unique differentiators are the combination of structured decoding, pattern-based risk scoring, and flexible export formats, all without executing the code. It is designed for enterprise analysts who need fast, explainable macro analysis and traceable artifacts.