MALICIOUS
68
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The sample is an Excel file containing Excel 4.0 macros, indicated by the 'OOXML_XLM_MACROSHEET' heuristic. The extracted macro content, though partially obfuscated, suggests an attempt to execute commands, potentially by writing to or referencing the file path 'C:\ProgramData\excel.rtf'. This indicates a macro-based attack pattern aimed at executing arbitrary code.
Heuristics 2
-
Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEETMalformed OOXML local headers contain an Excel 4.0 (XLM) macro sheet. XLM was a major Office malware vector during 2020-2022 and is rarely used in modern legitimate workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
-
Malformed OOXML package with recoverable local headers low OOXML_MALFORMED_ZIP_LOCAL_HEADERSThe OOXML ZIP central directory is invalid or missing, but local file headers expose a recoverable Office package. This can create parser divergence between tolerant Office/ZIP readers and scanners that rely only on the central directory.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_11.bine1a4ee2616711f4b6aea3573c28b735c42782090d01143157ee35e949e14fc14 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet1.bin | 271635 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.