Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 2292eb84b21e8d19…

MALICIOUS

Office (OOXML) / .XLSM

38.8 KB Created: 2020-05-21 18:07:39 UTC Authoring application: Microsoft Excel 16.0300
MD5: 7ec4a562cb8bd4c1e5b5e37ffb3ba4c1 SHA-1: 156a8a67d3795e28bdc35129caab91521d0d76e1 SHA-256: 2292eb84b21e8d19b48f423ea2aa1e0c8eaf4545c69e1ff69e1a4737ed1913fb
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Service Execution: Service Control T1204.002 Malicious File: User Execution

This XLSM file contains an Excel 4.0 macro sheet, which is a known vector for malware delivery. The presence of dangerous XLM functions like RUN, FORMULA, and CALL indicates the macro is capable of executing arbitrary code. The hidden worksheet further suggests an attempt to conceal malicious activity. The primary attack pattern involves leveraging these XLM functions to download and execute a secondary payload.

Heuristics 4

  • Dangerous XLM formula APIs: RUN, FORMULA, CALL, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Excel 4.0 macro sheet (1 sheet(s)) high OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 25 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
59ec5f7e44b2f2edeb42dd7cc313d29153bbab0197f1762590657f43b8bb0ef3		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 76201 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.