Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Example VBA Stomped Documents Repository

A repository of example VBA stomped documents. For more information about VBA Stomping, see These are non-malicious documents and the macro is a simple message box popup.

You must open the file that matches your office version to see the desired effect of VBA stomping.

Note: VBA stomping does not currently work for XLS files, never-the-less they have been included in this repo.

Stomped Files (Random vs Fake Code)

Files tagged with _random have had their VBA source code replaced with random bytes using the Adaptive Docoument Builder Python script.

Files tagged with _fakecode have had their VBA source code replaced with the source code found in fakecode_word_vba.txt or fakecode_excel_vba.txt using the Evil Clippy tool.

Filename Convention

The file name starts with the Office version and indicates if it is a 32-bit or 64-bit install.

Prefix Description
2003x32 Office 2003, 32-bit
2019x64 Office 2019, 64-bit

The Office version is followed by either _word or _excel indicating whether it is an MS Word or MS Excel document.

The last part of the filename indicates whether the VBA source code was replaced with random bytes or with new source code as described in the section above.

The .doc and .xls extensions are files saved in the 97-2003 format, while the docm and xlsm file formats are saved in the 2007 and up format (a zip archive xml format).

Original Files

The original files can be found in the original_files_b4_stomping folder.


A repository of example VBA stomped documents






No releases published


No packages published