XOR-encrypted macro source defeating static inspection

Office documents remain a favorite initial-access vector, and attackers increasingly encrypt or encode their macro source so that signature-based scanning sees only gibberish. In this scenario the VBA project inside a DOCM is protected with XOR obfuscation: the plaintext strings, API calls, and download logic only become visible after the macro decrypts itself at runtime, so static inspection of the file reveals nothing malicious (MITRE T1027.013). Deep CDR does not rely on seeing the payload - it removes the macro project entirely, extracts only the safe document content, and rebuilds a clean DOCM that opens without executing any code. The demo ships a benign obfuscated macro that merely launches calc.exe, making it safe to run in any environment.