Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 42ee070ac0de1e32…

MALICIOUS

Office (OOXML) / .XLSX

157.2 KB Created: 2021-07-28 15:58:29 UTC Authoring application: Microsoft Excel 16.0300
MD5: ade047b047a762846f7df54eed3dd90a SHA-1: d14e19640dbed65b96ce6a3881261f5fb9335874 SHA-256: 42ee070ac0de1e32e2f436764560c31655f0e81aeb2f842a895cca3405fb2c7f
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.001 PowerShell T1566.001 Spearphishing Attachment

This malicious Excel document contains Excel 4.0 macros, which are known to be used for executing arbitrary code. The presence of a VBA project and a CreateObject call further indicates malicious intent. The XLM macro sheet is likely responsible for the initial execution of the payload, potentially downloading and executing a second-stage payload. The external relationship to 'x.xlsb' is also suspicious.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • External relationship medium OOXML_EXTERNAL_REL
    External target in xl/pivotCache/_rels/pivotCacheDefinition1.bin.rels: x.xlsb

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
af55f240250ed27d2689d35c3bbf1c6e9bad964c594e20967caf2b5a658091c4		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1214 bytes
vbaProject_00.bin
3eeea31e9e61d83002bcae7c9ff14d33ede0a193181bc05c377f18555c43ad93		 vba-project OOXML VBA project: xl/vbaProject.bin 14848 bytes
xlm_sheet_00.bin
4bc10098c8c9c695732a612ced316fa1040da05b87058eccbeedff9933693b69		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 1870 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.