Is there any way to programmatically determine if an .xls contains macros, without actually opening it in Excel?
Also are there any methods to examine which certificate (including timestamp cert) these macros are signed with? Again without using Excel.
I'm wondering in particular if there are any strings that always show up in the raw data of an Excel file when macros are present.
An xls file containing a macro should contain a string looking something like
Keyboard Shortcut:
Don't know if this is a surefire solution though
Yes, you can open the .xls file as a compound document file and check whether is contains a VBA folder and streams containing VBA code.
Sample code is available in this CodeProject article:
The certificate information is stored in the DocumentSummaryInformation stream. If you want to read out the information from there you should dig into the file format specifications available from Microsoft:
[MS-OSHARED]: Office Common Data Types and Objects Structure Specification
[MS-OFFCRYPTO]: Office Document Cryptography Structure Specification