Excel 4.0 (XLM) macro sheet loads a relative-path module

OLE_XLM_RELATIVE_MODULE_LOAD

← All detection heuristics · Office

high OLE_XLM_RELATIVE_MODULE_LOAD

What it means

XLM macro sheet references a payload module (.dll/.exe/.ocx/.scr) by a relative (..\) or environment-variable (%ENV%\) path.

Why it fires

Legitimate Excel 4.0 macros call REGISTER()/CALL() against bare system DLL names (Kernel32, shell32.dll) resolved from the system search path. A relative or %ENV%-path reference to a NON-system module is the drop-to-current-directory then load-and-execute pattern used by XLM DLL-loader droppers (the iroto.dll / hdrh.dll family). The module literal is recovered directly from the BIFF8 workbook stream, so it fires even when olevba cannot decompile the (often deliberately damaged) macro sheet and the workbook would otherwise be scored only at 'macro sheet present'.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS