Office (OOXML) / .XLSX malware analysis — malicious · 50e1c2be61e9f293

MALICIOUS

Office (OOXML) / .XLSX

237.3 KB Created: 2021-06-12 17:50:01 UTC Authoring application: Microsoft Excel 16.0300

MD5: 69cb0132016e82db0198ceb5f527bb43 SHA-1: b571db19a73c7e0f5cffb47cc064d4902a311ee3 SHA-256: 50e1c2be61e9f2937df649868a641e3f3221c7222b8bf5ff75820d51aa8ab34f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

This XLSX file contains Excel 4.0 macros, indicated by the 'OOXML_XLM_MACROSHEET' heuristic. The VBA code includes a 'CreateObject' call, suggesting dynamic execution capabilities. The presence of Excel 4.0 macros strongly implies an attempt to execute arbitrary code, likely to download and run a secondary payload. No specific family could be identified, but the technique is common for initial access.

Heuristics 3

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bbefddadacfee5dd68c5e21e79b04517b878da197b36cd2428d9fef088143446`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	655 bytes
`vbaProject_00.bin` `0cec27606428d2673e7432f553ff56d3c8b40a29ce95e4663b7450db27841434`	vba-project	OOXML VBA project: xl/vbaProject.bin	12288 bytes
`xlm_sheet_00.bin` `630aacd7e79427e3f74ce30a5d504395974ae8a0c6e0880c44fa16b53c5401b1`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	2564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.