When and why does a *.xlsx File contain a *.bin file?

Question

I am currently working on a project to evaluate whether an uploaded *.xlsx file really is a *.xlsx file only and not a *.xlsm with changed extension.

Since a *.xlsx file is more or less a *.zip file, I extracted the contents and noticed that some files contain a *.bin file, while others don't. Although the excel file might be a legit one without any attempt to inject another extension by tricking the user into renaming it.

Therefore my question: When does a xlsx file contain a *.bin file? And is this method suitable to detect whether a xlsx file contains macros?

I am also checking the content of the [content_types].xml file to contain either one of the strings: application/vnd.ms-office.vbaproject and application/vnd.ms-excel.sheet.macroenabled.

Answer 1

When does a xlsx file contain a *.bin file?

Well, bin files are created not only workbooks which have macros but for workbooks which have OLE objects embedded in them.

Try this. Create a new workbook and click on Developer Tab | Insert ActiveX control - Say Commandbutton. Save and close the file as .xlsx. Rename to .Zip and check the zip file

Edit:

And yes sometimes to store the printer settings as well. Did a quick search and came across THIS link

Extract from the above link in case the link dies.

In addition to VBA projects and embedded OLE objects, we find BIN parts in Excel 2007 .XLSB files for the following reasons :

1. Workbook part workbook.bin (MIME type: application/vnd.ms-excel.workbook)
2. Styles dictionary part styles.bin (MIME type: application/vnd.ms-excel.styles)

3. For each worksheet,

   a. an index part worksheets/binaryIndexxx.bin (MIME type: application/vnd.ms-excel.binIndexWs)

   b. a worksheet part worksheets/sheetxxx.bin (MIME type: application/vnd.ms-excel.worksheet)

   c. an optional printer settings part printerSettings/printerSettingsxxx.bin (MIME type: application/vnd.openxmlformats-officedocument.spreadsheetml.printerSettings)

4. Optional calculation chain part calcChain.bin (MIME type: application/vnd.ms-excel.calcChain)

5. Optional comments parts commentsxxx.bin (MIME type: application/vnd.ms-office.legacyDrawing)
6. Optional tables parts tables/tablexxx.bin (MIME type: application/vnd.ms-excel.table)
7. Optional connections parts connections.bin (MIME type: application/vnd.ms-excel.connections)
8. Optional Chartsheet, Dialogsheet, Macrosheet parts (chartsheets/sheetxxx.bin, dialogsheets/sheetxxx.bin, macrosheets/sheetxxx.bin) (MIME type: application/vnd.ms-excel.chartsheet, application/vnd.ms-excel.dialogsheet, application/vnd.ms-excel.macrosheet)
9. Optional Pivot Table parts (pivotTables/pivotTablexxx.bin) (MIME type: application/vnd.ms-excel.pivotTable)
10. Optional Pivot Table Cache definition and records parts (pivotCache/pivotCacheDefinitionxxx.bin, pivotCache/pivotCacheRecordsxxx.bin) (MIME type: application/vnd.ms-excel.pivotCacheDefinition, application/vnd.ms-excel.pivotCacheRecords)
11. Optional Query tables (queryTables/queryTablexxx.bin) (MIME type: application/vnd.ms-excel.queryTable)