Word, Excel, PowerPoint and RTF files
livewells reads Office files for you. Attackers use these files to start a program, to load content from another place and to hide a link or a command inside a macro. livewells reads the file as data and shows what it holds.
Send an Office file
Send the file on the Upload a file tab, or through the API.
| Family | File types |
|---|---|
| Word | .docx, .docm, .dotx, .dotm, .doc |
| Excel | .xlsx, .xlsm, .xlsb, .xltx, .xltm, .xls |
| PowerPoint | .pptx, .pptm, .ppsx, .ppt |
| OpenDocument | .odt, .ods, .odp |
| Rich Text | .rtf |
livewells decides the type from the content of the file. A file that is two kinds of file at once gets a flag, and livewells reads it both ways.
livewells also reads Office files inside another item of the same case: an email attachment, a file in an archive and an object embedded in an Office file.
What you see
- The text of the file: paragraphs, hidden text, comments, headers and footers, slide text, sheet cells and text boxes.
- The properties of the file: author, last editor, company, dates and custom properties.
- Macros: the macro text of each module and the names that start a macro when the file opens. See Macro emulation.
- Links and references: hyperlinks, templates, linked objects, external workbooks, network share paths and fields that load a file or a picture.
- Fields that start a program, such as DDE fields in Word.
- Embedded objects: programs, scripts, packages, other Office files and equation objects. Each object is an item of the case with its SHA-256.
- Ribbon buttons, shape actions and click actions that run a macro or a program.
- Pictures in the file, up to 20. A QR code in a picture is read.
- Flags in plain words. The table at the end of this page lists them.
Every address, host name and mail address in the report is defanged. For example, an address appears as hxxps[://]login[.]example[.]com/verify. You choose when to open a web address.
Locked files
An Office file can be locked with a password. Attackers use a built-in password so that a mail filter cannot read the file.
livewells tries the built-in password of Office first. Then it tries the passwords that you send with the file, in the order that you send them. You can send up to three.
When no password opens the file, the case shows This file is locked. Send the right password on the case page, or through the API. livewells holds a password in memory for one check.
Limits
| Limit | Value |
|---|---|
| File size | 25 MiB |
| Time | 60 seconds for one file |
| Parts in an Office package | 2,000 |
| Unpacked size compared with packed size | 100 to 1 |
| Macro modules | 100 |
| Embedded objects | 100 in one file |
| Embedded Office files with macros | 3 levels deep and 16 in total |
| Page images | 20 for one file |
| Links and indicators | 500 each |
| Flags | 100 |
| Table rows | 200 in each of 10 tables |
| One XML part | 5 MiB, 64 levels deep, 100,000 nodes |
| Passwords | 3 for one case |
When a file is over a limit, the report says so. Content that livewells could not read raises a flag, because the content can hide a link or a command.
Flags
| Level | What livewells tells you |
|---|---|
| High | This file runs macro code as soon as it opens. |
| High | An object in this file runs a program or macro when clicked. |
| High | This file holds a field that can start a program. |
| High | This file holds an embedded program or script. |
| High | This file holds an old Equation Editor object, a known route for attacks. |
| High | This file holds macro code that its file type says is not there. |
| High | The macro code can fetch content from the internet. |
| High | The macro checker stopped early. Treat the file as hostile. |
| High | The macro code can start other programs. |
| High | The macro text is empty, but compiled macro code remains in the file. |
| High | This file loads an object from another place. |
| High | This document loads linked objects when it opens. |
| High | This document runs a script when an event happens. |
| High | This file loads a template from another place. |
| High | This file points at a file on a network share. |
| High | This workbook runs a macro sheet as soon as it opens. |
| High | A macro sheet in this workbook is hidden. |
| High | This workbook holds an old-style Excel 4 macro sheet. |
| Medium | This file holds ActiveX controls. |
| Medium | This file holds two parts with the same name. |
| Medium | This file holds embedded objects. |
| Medium | This file is locked with a password. We could not read it. |
| Medium | This file loads content from another place. |
| Medium | This file holds a field that loads a file or picture from another place. |
| Medium | This file is larger or deeper than we read. |
| Medium | This file points at a file on the local computer. |
| Medium | The macro code calls functions of the operating system. |
| Medium | The macro code can change macro code or send keystrokes. |
| Medium | A macro module has two different types. |
| Medium | The macro code is written to be hard to read. |
| Medium | Part of the macro code could not be read. |
| Medium | This file holds macro code. |
| Medium | The macro code can write files to the computer. |
| Medium | A name in this file uses reversed text to hide its real ending. |
| Medium | This file holds more embedded documents than we open. |
| Medium | This file adds a ribbon button that runs a macro. |
| Medium | This document holds embedded objects. |
| Medium | We could not read this file. Treat it as hostile. |
| Medium | A part of this file was not read because it is unsafe to read. |
| Low | This workbook has hidden sheets. |
| Low | A macro module has two different names. |
| Low | Some macro code could not be read. |
| Low | The macro project is locked with a password. |
| Low | A part of this file is damaged and was not read. |
| Info | Some rows are not shown. |