Test files › Office documents › macro-enabled.xlsm

Sample XLSM file (macro enabled)

Macro-enabled workbook structure with an inert VBA project placeholder (no executable code).

↓ Download macro-enabled.xlsm
Filenamemacro-enabled.xlsm
FormatXLSM
Size1.8 KB (1,879 bytes)
MIME typeapplication/vnd.ms-excel.sheet.macroEnabled.12
SHA-256f6ec219c93f337cc21e5cca02e3cd2a6928811c9a61e824b80c972306380c8b0
What this file catchesUpload policies that must treat .xlsm differently from .xlsx because it can carry macros. The vbaProject.bin here is a harmless text placeholder, but the container is a genuine macro-enabled package your scanner should flag.

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Check for macros before accepting or opening an Office upload. Modern files are ZIPs: VBA lives in vbaProject.bin (Microsoft) or a Basic folder (OpenDocument). Legacy .xls/.doc files are OLE2 containers that need a dedicated parser, such as oletools, to see inside.

import zipfile

OLE2 = bytes.fromhex("d0cf11e0a1b11ae1")

with open("macro-enabled.xlsm", "rb") as f:
    magic = f.read(8)
if magic == OLE2:
    print("legacy OLE2 file (.xls, .doc, .ppt, .msg): may carry VBA; inspect it with an OLE parser")
elif not zipfile.is_zipfile("macro-enabled.xlsm"):
    print("not an Office file")
else:
    with zipfile.ZipFile("macro-enabled.xlsm") as z:
        names = z.namelist()
        types = z.read("[Content_Types].xml").decode() if "[Content_Types].xml" in names else ""
    macros = [n for n in names if n.lower().endswith("vbaproject.bin") or n.startswith(("Basic/", "Scripts/"))]
    if macros or "macroEnabled" in types:
        print("contains macros:", ", ".join(macros) or "declared in [Content_Types].xml")
    else:
        print(f"no macro parts among {len(names)} entries")

Run against this file, it prints: contains macros: xl/vbaProject.bin

Related guides and tools

Sample XLS and XLSX (Excel) filesFile signaturesMIME typesCheck a file's real typeVerify its SHA-256

Download & verify

curl -fsSL -o "macro-enabled.xlsm" "https://files.hexaqa.com/office/macro-enabled.xlsm"
curl -fsSL "https://files.hexaqa.com/office/macro-enabled.xlsm" | sha256sum # expect: f6ec219c93f337cc21e5cca02e3cd2a6928811c9a61e824b80c972306380c8b0

More office documents test files

document.docxdocument.odtformula-injection.xlsxlegacy-workbook.xlspresentation.odppresentation.pptxspreadsheet.odsspreadsheet.xlsx

← All Office documents files