Office (OOXML) / .XLSX malware analysis — malicious · 291dff5db4c5614b

MALICIOUS

Office (OOXML) / .XLSX

96.2 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 5416504661da285f72305abc9f5b7d13 SHA-1: 73d6726dd54189d23d17e9b1cd739fb2a67c9b03 SHA-256: 291dff5db4c5614b9c0e778810c50a12e23259a8c1b0fad6d972cf0dfaa68b2f

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file contains multiple Excel 4.0 macro sheets, identified as critical heuristics. These macros appear to be designed to download and execute payloads from a list of URLs, such as 'http://Z/C:\ProgramData\Volet1.ocx', using 'regsvr32' to run the downloaded files. This indicates a downloader functionality.

Heuristics 3

Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX

OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
ClamAV: Xls.Downloader.Docusign112101-9908076-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Docusign112101-9908076-0

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `df103f6996091bf9081dd2132038b8868481aa010126d923f5a8ff091364cf44`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	363 bytes
`xlm_sheet_01.bin` `7955917fd621131a5ff0fffb6d9e40cabd68e8575f06e760aec721c0b9edd7ef`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	1615 bytes
`xlm_sheet_02.bin` `83c39c908241239708ace91ff7a234f390b78c9b9a6ca890149a0af74d5e6258`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin	2813 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.