Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 0104974a7bf43e2e…

MALICIOUS

Office (OOXML) / .XLSM

39.3 KB Created: 2020-12-07 14:38:21 UTC Authoring application: Microsoft Excel 16.0300
MD5: fa5350d4304c4c2ceafa435244b5a5fc SHA-1: fc8a20962b8cf86568b1e85be02ee9c7b62d94b2 SHA-256: 0104974a7bf43e2e31d25ae485f57c62efe89eaea2d3e520db8a76fa70dd956d
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 JScript/VBScript

This Excel macro-enabled document (XLSM) contains VBA and Excel 4.0 macros. The critical heuristics indicate that it uses an ActiveX event to run worksheet-decoded XLM formulas, including dangerous APIs like RETURN(). This mechanism is used to download and execute a second-stage payload. No specific family could be identified, but the technique suggests a downloader.

Heuristics 6

  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f6f320414c7a81b4a7eec59f091af3ca10a73035637ec557d6ab921152671286		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1827 bytes
vbaProject_00.bin
00470e795b2b820e706083ed7406e76288c3e834dbd0698a046ae7ca2d755d0f		 vba-project OOXML VBA project: xl/vbaProject.bin 18432 bytes
emf_00.emf
da935e8d60e93e41bcd7c3fbb1750ef3ac471c3af78afc8945dfbf31eb54a1e1		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1408 bytes
xlm_sheet_00.xml
2b22e750932dab4395a034bb21fc6fc762875f05072e9861cec551e66d6f3c07		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1026 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.