MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The file is an Excel 4.0 macro sheet, identified by the OOXML_XLM_MACROSHEET heuristic. The OOXML_XLM_REASSEMBLED_PAYLOAD heuristic indicates that the macro sheet contains reassembled formulas that likely execute a command. The reconstructed command appears to be 'Kernel32WinExecJCJ C:\ C:\', which suggests an attempt to execute a malicious payload. The macro sheet content is heavily obfuscated, but the presence of CHAR() and split formulas points to a downloader or dropper functionality.
Heuristics 2
-
Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
-
XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOADAn Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.bin335f8ebeb10e6ffd6961f8b800103c541aa2c625a7025ca5fdcffdad14b97dd6 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.bin | 1963 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.