nerdexam
GIAC

GCIH · Question #638

Which file type can be used to execute code in Excel without issuing a warning about opening a macro-supporting file type?

The correct answer is A. XLTM. XLTM (Excel Macro-Enabled Template) files can execute embedded VBA macros while bypassing the standard Office macro security warning that XLSM files trigger.

Malware Analysis & Advanced Persistent Threats

Question

Which file type can be used to execute code in Excel without issuing a warning about opening a macro-supporting file type?

Options

  • AXLTM
  • BCSV
  • CXLSB
  • DPRN

How the community answered

(30 responses)
  • A
    73% (22)
  • B
    17% (5)
  • C
    7% (2)
  • D
    3% (1)

Why each option

XLTM (Excel Macro-Enabled Template) files can execute embedded VBA macros while bypassing the standard Office macro security warning that XLSM files trigger.

AXLTMCorrect

XLTM is the macro-enabled template format for Excel, and in certain Office configurations it avoids the Protected View or macro-enable warning that XLSM files generate because Excel treats template file types under different trust and opening logic. Attackers exploit this distinction to embed malicious VBA code in XLTM files and deliver them via phishing, where the code executes silently without the expected security dialog alerting the victim.

BCSV

CSV files are plain-text comma-separated value files with no support for macros, VBA, or any form of executable code.

CXLSB

XLSB (Excel Binary Workbook) can contain macros but still triggers Office security warnings when opened, so it does not bypass the macro warning the way XLTM can.

DPRN

PRN files are printer-formatted text output files and have no capability to store or execute macros or embedded code.

Concept tested: Excel macro file type used to bypass security warnings

Source: https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked

Topics

#Excel macro evasion#XLTM#Office file types#AV bypass

Community Discussion

No community discussion yet for this question.

Full GCIH Practice