Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 13dc65e865cbda60…

MALICIOUS

Office (OOXML)

934.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2020-12-28
MD5: 70cb74689f9b8108f30a9253aea6cf25 SHA-1: 9de01c258aecc4cb98298516ee5b2be87ea05228 SHA-256: 13dc65e865cbda60422df0dde2895d46d39bc192ea75b2e2ceee3e21ebd345c9
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file is identified as malicious due to the presence of critical heuristics indicating Excel 4.0 macros. These macros are disguised within an OOXML package and utilize WinAPI strings like 'DownloadToFileA' and 'CreateDirectoryA', suggesting an intent to download and save a second-stage payload. The 'Auto_Open' defined name further indicates automatic execution upon opening the document.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 macro sheet stored under disguised package path critical OOXML_XLM_DISGUISED_RELATIONSHIP
    OOXML package declares an xlMacrosheet relationship whose target is outside the canonical xl/macrosheets/ path. Excel follows the relationship type, while path-only scanners can miss the macro execution surface.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.

Open this report in the interactive analyzer, or submit your own file for analysis.