Is this XLSM file safe to open?
An XLSM file is not safe or unsafe because of the extension. It is a workbook that is allowed to contain a VBA project. Safety is a decision about the sender, the need for macros, and what the project contains. This site can inventory the project without enabling it. It cannot declare the file clean. No inventory here is a security guarantee, and the page is not antivirus.
What the extension actually allows
.xlsx workbooks are not supposed to contain macros. .xlsm and .xlsb can. If a file named .xlsx still contains xl/vbaProject.bin, treat it as macro-enabled regardless of the name. The inventory reports that part when it is present, plus whether the content types describe a macro-enabled workbook. Presence means the project is in the package. It does not mean the project has run. Opening the file in Excel with macros disabled keeps it that way.
What the inventory shows
Module names come from the PROJECT stream inside the compound file. You should see names you were told about, such as a module that builds a report. Auto-start names, including Auto_Open and Workbook_Open, mean the project contains text for a procedure that can run when the workbook opens. Worksheet_Change and similar names mean code can run when someone edits. Finding the name is not a verdict that the code is hostile, and missing the name is not a verdict that the code is harmless. Other procedures run from buttons, shapes, and the ribbon. The inventory does not print the source. If you need the source, read it in the editor with macros disabled, on a machine you can isolate, after you have decided the file is worth that attention.
A practical decision
If you did not expect macros, do not enable them. Ask for an .xlsx copy if the file is only data. If you did expect macros, compare the module list with what the author described. An extra module, or an auto-open procedure nobody mentioned, is a stop. Read it before you enable the project, or do not enable it. If you cannot read VBA, you do not have a basis to enable an unexpected project. Company mail scanning and Excel’s Trust Center are the controls that sit in front of this decision. This website is not a substitute for them.
Hidden sheets are part of the same review
Very hidden sheets are a common companion of macro workbooks, because code hides them. They are not proof of a macro, and a macro is not proof of a hidden sheet. Run the visibility check as well. A parameter sheet you were not told about belongs in the same conversation as an unexpected module. Neither finding requires you to enable content in order to see it. Both are visible in the package.
When you want the numbers from your own workbook, read the macro project locally.
What a “clean” result is not
No vbaProject.bin means this package has no Excel VBA project. It does not mean the file is free of every other risk. It can still contain external links, queries, or a damaged part. A project with no auto-start names can still contain a destructive procedure on a button. A project that is exactly the one your team maintains can still have a bug. Use the inventory to decide whether enabling macros is even the right question. Use your normal security tools to decide whether the file should be opened at all. The terms of this site say the same thing because people over-read a green score. The Audit score deducts points when a macro project is present. That deduction is hygiene, a reminder that code is in the file, not a malware detection.
If you are the author
Ship macros in .xlsm, not in a renamed .xlsx. Tell the recipient which modules should be there and whether anything runs on open. A recipient who runs this inventory should see the list you described. That is the smallest thing you can do to make an XLSM reviewable. Obfuscated projects and projects that hide sheets and refuse to say why will look like a risk, because the reviewer cannot tell them from one.
A recipient’s checklist
Confirm you expected a macro file. Confirm the module names match what the sender described. Confirm whether an auto-start name is present, and whether the sender told you the file runs code on open. Confirm you have a macro-free copy of the data if you need to inspect numbers without code. Open first with macros disabled. Read the project only if you are equipped to. Enable content only after those answers are acceptable, and only in the Trust Center setting your organization already uses. If any answer is “I cannot tell,” do not enable content to find out. Ask. The inventory is the list that makes the questions specific. “There is a module called ImportAndSend and a Workbook_Open” is a question a sender can answer. “Is this file safe?” is not.
An author’s matching habit
When you ship the file, send the same facts: modules, whether it runs on open, and what the macro refuses to do. Keep the project free of unused modules you would not want to explain. A reviewer who runs this site should see the list you already disclosed. Surprise is the actual defect in most untrusted macro files, more than any single procedure name. Removing surprise is the part of “safe” that an author controls. The rest belongs to mail filtering, locked-down Excel settings, and the recipient’s right to say no. If your note and the inventory disagree, the inventory is what the file contains. Update the note or update the project before you send it again. Recipients should not have to discover an extra module in order to decide whether to click Enable Content. That decision belongs in the email, made before the file is opened. If you cannot name the modules in that email, you are not ready to ask anyone to enable content. Run the inventory again and copy the names you are willing to defend. A module you cannot explain is a reason to keep the macro-free copy and wait for the author to account for it before you send the file.
Related reading
The closest repair notes are Very hidden sheets and VBA and Repair unreadable Excel content .
Walk the same checks in order with the Workbook audit checklist.
The terms behind this guide are vbaProject.bin and Very hidden sheet .
The paired check for that note is the Find very hidden sheets in Excel.
Questions people ask before trusting the result
Does a high Audit score mean the file is safe?
No. The score is size, speed, structure, and hygiene. A file with no macros scores higher on hygiene. That is not an antivirus result.
Should I enable macros to see the code?
No. The editor can show the project while macros stay disabled. If you are not set up to read it safely, do not enable content in order to explore.
Are .xlsb files included?
Yes for the presence of vbaProject.bin and for sheet visibility. Formula checks are still partial on .xlsb. The macro inventory does not depend on sheet XML.
Can this remove the VBA project?
No. In Excel you can save a macro-free copy as .xlsx, which drops the project, after you are sure you do not need the code. Do that from Excel so the package stays consistent.
What about macro-free files that still warn?
Excel warns for other reasons, including files from the internet and files that fail a protected-view check. Those warnings are Excel’s. This inventory is only the VBA project.