# Signed VBA Macros

VBA macros can be signed within MS Office documents.

Document containing signed macro, will have additional `vbaProjectSignature.bin` file lying near `vbaProject.bin`.

## What these docs do?

All documents located here simply pop a calc with `WScript.Shell.Exec`.

Their VBA macro was signed with self-signed certificate.

## How to Sign

This directory contains a few examples of how signed VBA macro can look like.

To sign your VBA, you will need to:

1. Go to `msosip` directory
2. Then as a local-admin, run following commands:

```cmd
PS> regsvr32.exe msosip.dll 
PS> regsvr32.exe msosipx.dll 
```

3. Then, use [signtool.ps1](https://github.com/Joflixen/signtool) (located in `msosip` directory) to sign your VBA:

### Sign a file.

```
PS> Add-Signature -Filename "workbook.xlsm" -Certificate "certificate.pfx" -Passphrase "-Passphr4se"
```

### Check Signature.

```
PS> Get-Signature -Filename "document.docm"
```

### Generate a Self Signed Certficiate

```
PS> New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=SignTool Demo" -TextExtension @("2.5.29.19={text}false") -KeyUsage DigitalSignature -KeyLength 2048 -NotAfter (Get-Date).AddMonths(36)
```

## OPSEC Hint

Whenever generating your self-signed certificate, DO NOT use `Microsoft` keyword in **Common Name**, as MS Office will immediately block such signed documents, stating they're malicious.

You can use following self-signed certificate details:

```yaml
cn:       'MS Root Certificate Authority 2010'
org:      'Microsoft Corporation'
locality: 'Redmond'
state:    'Washington'
country:  'US'
serial:   'random'
```