Cryptic error "...file format or file extension is not valid..." caused by Window Defender if "Block Win32 API calls from Office macros" rule is set.

Question

• Does ASAP Utilities use Windows API calls?
• Why does Windows Defender cause the cryptic Excel error message:
  "Excel cannot open the file '....xlam' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file."

Answer

Yes, ASAP Utilities uses Windows API calls.
(This was formerly called the Win32 API by Microsoft. The name Windows API more accurately reflects its roots in 16-bit Windows and its support on 64-bit Windows.)

Just Excel/VBA itself can be too limited for certain basic actions and ASAP Utilities wouldn't be able to do, or do as smooth, what it can without the few API calls.

ASAP Utilities uses a few Windows API calls for its core functionality, such as reading certain parts of the registry (for example to determine if you use the 32-bits or 64-bits edition of Excel), storing items in memory, reading the user's language settings for Windows and Excel, get the users application data folder to store settings, etc...

Windows API calls are also required for more basic functionality such as displaying messages with Unicode characters, such as for our clients with the Russian, Chinese or Japanese version of ASAP Utilities, having a decent progress window, determining which version of Excel is being used so we know what built-in functionality exists (For example Excel's VBA returns 16 for Excel 2016, Excel 2019, Excel 2021 and Excel 365 which isn't helpful), determine where the %APPDATA% folder is, etc, etc.

Tools such as the following also use Windows API calls to provide functionality otherwise not possible:

• ASAP Utilities » File & System » Close and delete current file
• ASAP Utilities » Export » Export selected chart or range as image (file)...
• ASAP Utilities » Export » Copy selection as values to clipboard
• ASAP Utilities » Columns & Rows » Drawing paper...
• ASAP Utilities » File & System » Resize the Excel window to standard screen resolutions...
• ASAP Utilities » File & System » Create a list of filenames and properties in a folder...
• ASAP Utilities » Sheets » Print multiple sheets at once...
• ASAP Utilities » Format » Copy a sheet's page and print settings...

Microsoft Defender might need an exception

Microsoft Defender for Endpoint and Microsoft 365 Defender can use attack surface reduction rules (ASR rules) to help prevent malware infection.
One of these rules is:

"Block Win32 API calls from Office macros"

In case your company has the rule "Block Win32 API calls from Office macros" defined, then ASAP Utilities can't function properly.
Some users may even get a cryptic error from Excel stating that the ASAP Utilities file format or file extention is not correct due to this rule. (Excel cannot open the file 'ASAP Utilities.xlam' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file.)

From Microsoft:

Office VBA enables Win32 API calls. Malware can abuse this capability, such as calling Win32 APIs to launch malicious shellcode without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways.

Intune name: Win32 imports from Office macro code
Configuration Manager name: Block Win32 API calls from Office macros
GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

Source:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide#block-win32-api-calls-from-office-macros

Defender: Warn mode for users

(NEW!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes.

Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks.

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide#warn-mode-for-users

Exception for ASAP Utilities

It goes without saying that there is no malware in our product. We developed ASAP Utilities completely by ourselves and nothing was outsourced.

All the files from ASAP Utilities are signed with a Code Signing certificate to make sure the files (exe and xlam) are from our company and have not been tampered with.
Our company name is A Must in Every Office BV, you can see that in the certificate.
As an extra protection layer In Excel you can choose to disable all macros except digitally signed macros or require application add-ins to be signed by a trusted publisher.

In case your organization has the "Block Win32 API calls from Office macros" rules applied in combination with "block mode", then you can still use ASAP Utilities by making and exception for our files as explained by Microsoft.

The ASAP Utilities xlam files

The "%ProgramFiles(x86)%\ASAP Utilities\" folder is the default installation folder. In case you installed ASAP Utilities in another location, then the ASAP Utilities.xlam is in that location.

• All languages:
  %ProgramFiles(x86)%\ASAP Utilities\ASAP Utilities.xlam
• English
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_en-us.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_en-us.xlam
• German
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_de-de.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_de-de.xlam
• Spanish
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_es-es.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_es-es.xlam
• French
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_fr-fr.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_fr-fr.xlam
• Italian
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_it-it.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_it-it.xlam
• Dutch
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_nl-nl.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_nl-nl.xlam
• Portuguese (Brazil)
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_pt-br.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_pt-br.xlam
• Russian
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ru-ru.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ru-ru.xlam
• Chinese (Simplified)
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_zh-hans.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_zh-hans.xlam
• Japanese
  %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ja-jp.xlam
%AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ja-jp.xlam

%LocalAppData%\...\Content.MSO\ and .tmp file

In case it still doesn't work with the above exceptions and you get a warning with a reference to a randomly named .tmp file in the %LocalAppData%\Microsoft\Windows\INetCache\Content.MSO\ folder, then you need to update Windows Defender because it's something that Microsoft has already solved.
We recommend to turn on "Cloud-delivered protection" in Windows Defender:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus

Resources

• Attack surface reduction frequently asked questions (FAQ)
  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-faq?view=o365-worldwide
  
• Cloud protection and Microsoft Defender Antivirus
  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus
• Exclude files and folders from ASR rules
  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#exclude-files-and-folders-from-asr-rules
• Enable or disable macros in Office files
  https://support.microsoft.com/en-us/office/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6
• Add, remove, or view a trusted publisher
  https://support.microsoft.com/en-us/office/add-remove-or-view-a-trusted-publisher-87b3d5a3-b68c-4023-87c4-7cc78a44d7ed
• Add our company as a trusted publisher during the installation
  https://www.asap-utilities.com/installation-step-by-step.php