Office (OOXML) / .XLSX malware analysis — malicious · 2fe2babfcc7ea5ad

MALICIOUS

Office (OOXML) / .XLSX

155.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 1019bfebb97de3eb8ec428358587bef1 SHA-1: 964a23bbb0ce3021464518510f1e3df3fef20bc9 SHA-256: 2fe2babfcc7ea5ad682d772d74aee8d1cdbd6e1974274669b262d9a6d4c8aaa3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an XLSX archive containing an Excel 4.0 macro sheet, identified by critical heuristics. While the macro content is truncated and obfuscated, the presence of XLM macros strongly suggests an attempt to execute arbitrary commands. The primary attack pattern involves leveraging these macros for malicious execution, likely as a downloader or initial access vector.

Heuristics 2

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX

OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `ac962eda506b15525c1cccc4208594d06a0effd902f1baf93d026be218f31732`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	114843 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.