Test files › Office documents › macro-enabled.xlsm
Sample XLSM file (macro enabled)
Macro-enabled workbook structure with an inert VBA project placeholder (no executable code).
↓ Download macro-enabled.xlsm| Filename | macro-enabled.xlsm |
| Format | XLSM |
| Size | 1.8 KB (1,879 bytes) |
| MIME type | application/vnd.ms-excel.sheet.macroEnabled.12 |
| SHA-256 | f6ec219c93f337cc21e5cca02e3cd2a6928811c9a61e824b80c972306380c8b0 |
What this file catchesUpload policies that must treat .xlsm differently from .xlsx because it can carry macros. The vbaProject.bin here is a harmless text placeholder, but the container is a genuine macro-enabled package your scanner should flag.
Handle it in code
Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.
Python
Check for macros before accepting or opening an Office upload. Modern files are ZIPs: VBA lives in vbaProject.bin (Microsoft) or a Basic folder (OpenDocument). Legacy .xls/.doc files are OLE2 containers that need a dedicated parser, such as oletools, to see inside.
import zipfile
OLE2 = bytes.fromhex("d0cf11e0a1b11ae1")
with open("macro-enabled.xlsm", "rb") as f:
magic = f.read(8)
if magic == OLE2:
print("legacy OLE2 file (.xls, .doc, .ppt, .msg): may carry VBA; inspect it with an OLE parser")
elif not zipfile.is_zipfile("macro-enabled.xlsm"):
print("not an Office file")
else:
with zipfile.ZipFile("macro-enabled.xlsm") as z:
names = z.namelist()
types = z.read("[Content_Types].xml").decode() if "[Content_Types].xml" in names else ""
macros = [n for n in names if n.lower().endswith("vbaproject.bin") or n.startswith(("Basic/", "Scripts/"))]
if macros or "macroEnabled" in types:
print("contains macros:", ", ".join(macros) or "declared in [Content_Types].xml")
else:
print(f"no macro parts among {len(names)} entries")Run against this file, it prints: contains macros: xl/vbaProject.bin
Related guides and tools
Sample XLS and XLSX (Excel) filesFile signaturesMIME typesCheck a file's real typeVerify its SHA-256
Download & verify
curl -fsSL -o "macro-enabled.xlsm" "https://files.hexaqa.com/office/macro-enabled.xlsm"
curl -fsSL "https://files.hexaqa.com/office/macro-enabled.xlsm" | sha256sum
# expect: f6ec219c93f337cc21e5cca02e3cd2a6928811c9a61e824b80c972306380c8b0