Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Key Findings
- A content search can run document macros. UltraFinder 2024.0.0.14 extracts text from .doc and .xls files by driving Microsoft Word and Excel through COM automation. Howler Cell confirmed in the lab that AutoOpen and Document_Open VBA macros in a Word document run silently the moment a folder containing the document is searched. The .xls path uses the same helper and is expected to behave the same way.
- No prompt on this path, and Mark-of-the-Web is not expected to help. Macros run under the account that started the search. Microsoft's internet-macro block is designed around documents a person opens, so it is not expected to apply to documents opened programmatically.
- The attack precondition drops from user execution to file presence. Any channel that lands a .doc on disk, including USB media, network shares, cloud sync, archive extraction, and email auto-save, can lead to macro execution once a content search is run over that location.
- Forensic and eDiscovery workflows are the most plausible exposure. These users routinely run keyword searches across untrusted evidence, disk images, and seized collections, so a macro-bearing document is more likely to be present in that data than in everyday business folders.
- IDM Computer Solutions shipped hardening in UltraFinder 2026.0 (October 29, 2026). The release notes state Office now runs in a restricted mode with macros and auto-run features disabled. Upgrade, and treat content searches of untrusted data on earlier builds as a macro execution risk.
Overview
The Howler Cell Threat Research Team at Cyderes identified an unsafe-by-default use of the Microsoft Office automation interface in IDM Computer Solutions' UltraFinder, a commercial desktop search and indexing tool sold as part of the UltraEdit suite. UltraFinder's bundled helper, DocExtractor.exe, uses Word and Excel as text parsers. It instantiates a hidden, out-of-process Office application for every supported legacy document and opens the file without first restricting macro execution.
Article Link: UltraFinder Ran Document Macros During Content Search