Office (OOXML) / .XLSX malware analysis — malicious · 159c3b094890a45e

MALICIOUS

Office (OOXML) / .XLSX

482.7 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 815231002d949345f75bee5f3dd78c0f SHA-1: e1630eb3a84538020501ae13697335e19de58a37 SHA-256: 159c3b094890a45ec01fc9fd5568445118df6f67070c59a1995f03c830dcabaf

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file contains Excel 4.0 macros, which are known to be used for malicious purposes. These macros are designed to reassemble and execute a payload from embedded formulas, specifically targeting files named Dotr4.ocx, Dotr5.ocx, and Dotr6.ocx. The presence of these macros and the reassembled payload strongly indicates an attempt to download and execute a second-stage malicious file.

Heuristics 2

Excel 4.0 macro sheet (9 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOAD

An Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `46bcb280ed55604ef19f68f4b96bc4a54e2a7ece33bd9b6e2d06fc164cc75357`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	363 bytes
`xlm_sheet_01.bin` `de5936684fd9ac3e301578c57b1b3f17270ebacb8c4145f017e9b64a751df30d`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin	363 bytes
`xlm_sheet_02.bin` `2ac4b54d0557adaf15e9b82952342ea54e064686726fcf5504ee0141ea4624f0`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	3310 bytes
`xlm_sheet_03.bin` `0ede90e8e09c75ba7c5c10c94d0119a67484d32996241ba84157937fe52fd756`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin	363 bytes
`xlm_sheet_04.bin` `1ccca8c075f9372ed047b1d382caa1a5bd515d6b4ae5e1a436f64e77c1da5a34`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet4.bin	363 bytes
`xlm_sheet_05.bin` `2734e29afdfc2d5e9c85f13fa9c9ff8fd27746a86d4683522fb4a5f5b70263f3`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet5.bin	2019 bytes
`xlm_sheet_06.bin` `ca05b5daf63a7c158d91c7d2fa307043fceae471ca8ba3ce34e0f6167a5e0fd1`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet6.bin	2112 bytes
`xlm_sheet_07.bin` `d86870c429aa88d82a9558643492f451a3715574233c92043162de4ca30fb73f`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet7.bin	695 bytes
`xlm_sheet_08.bin` `3ca980932195569377bde28df89d88f612b6bcbf4724f1d032da22255ebb173f`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet8.bin	887 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.