Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 456d7c03dc42eaec…

MALICIOUS

Office (OLE) / .XLSX

42.0 KB Created: 2020-09-28 00:53:43 Authoring application: Microsoft Excel
MD5: 011ff137c607a956f60a93881eede39d SHA-1: 7b2744fe6d6bb0e9dd7cadad30d216a866496c1b SHA-256: 456d7c03dc42eaecba83b0dd4193dd6074158a1a60bd06e9fa8b763398903c79
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file contains Excel 4.0 (XLM) macros, specifically an Auto_Open defined name, which is a critical finding. The presence of dangerous formula APIs like 'RUN' indicates that the macro is designed to execute external commands. While the exact command or payload is not directly visible in the provided output, the Auto_Open function strongly suggests an initial stage of a malicious execution chain, likely involving downloading and running a second-stage payload. The document body content is largely unreadable, providing no further clues to the specific lure.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
ff4bd77c756a57febbbb8b4c79784034e5c39bab71aece7309a538d4b97c9ece		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.