Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 357c76fad5daf79e…

MALICIOUS

Office (OOXML) / .XLSX

67.0 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000
MD5: 045ebed775a6dad54d48bfdde47b812b SHA-1: e43cb73a1730ac45bdff6c42047fe8be40ec8eb8 SHA-256: 357c76fad5daf79e95a844b192314705de52d00dbe96457ca7bbe1fba62c0f77
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file identified as containing Excel 4.0 macros. This heuristic firing indicates that the file is likely designed to execute arbitrary commands upon opening. No specific IOCs were extracted, and the macro content was truncated, preventing a more detailed analysis of its specific actions.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
a77c84aa63e5f95f2b8552c05782f8b7b96d43fc211bce504548d7edb7656a7b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 7832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.