2 comments on “Running Macros via ActiveX Controls

  1. I’ve seen this trick used in macro malware this year for the first time, although that was several months ago. It has the advantage that exactly one and the same code would run in Word, Excel and PowerPoint – while, for instance, you don’t have auto macros in PowerPoint and the names are different in Word and Excel (AutoOpen vs Auto_Open, Document_Open vs Workbook_Open, etc.).

    The closest thing to this trick that I’ve seen in the (distant) past was in the PowerPoint-infecting macro viruses a couple of decades ago. Since PowerPoint doesn’t have auto macros, they were achieving activation by inserting an invisible shape on the slide and activating when this shaped was clicked during presentation mode.

    https://www.f-secure.com/v-descs/tristate.shtml

  2. Yes that’s right Vesselin, I didn’t do a thorough test on PowerPoint but with this trick it does work now auto macros on PowerPoint with the few controls I tested with but only in OpenXML format.

Leave a Reply

Your email address will not be published. Required fields are marked *