A few days ago @kernelv0id asked about an undocumented Excel format that he observed being used by one of the payloads he was analysing. He saw a malicious .xlsb file dropping a file that was being saved with a file format equal to 3. For those who don’t know, the Excel API ‘SaveAs‘ takes a bunch of arguments, including a file name and a file format that we want the file to be saved as. According to this page, number ‘3’ is undocumented.
This triggered my interest so I quickly tested what that saved file may look like. To my surprise, it was just a TAB-separated text file!
This gave me an excuse to write a simple test macro to go and try running ‘SaveAs’ method with all the file formats from 0 to 62:
Sub x() On Error Resume Next For i = 0 To 62 If i < 10 Then f = "out\0" & i Else f = "out\" & i ActiveWorkbook.SaveAs Filename:=f, FileFormat:=i Next i End Sub
and cross-referencing the results with the documented file formats, leading me to this final table, sorted by a file format constant.
The TSV, PDF, XPS, are great to see…. Why Microsoft is not documenting these yet?
I believe the Office suite hides a lot of secrets from us. It’s time to start digging!