Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 51efa6c85975fc63…

MALICIOUS

Office (OLE) / .XLSX

174.0 KB Created: 2011-01-14 22:18:59 Authoring application: Microsoft Excel
MD5: 45e92d231d72f9ef8050061be8498ee3 SHA-1: 135539700d1a1b7556f4987b4bf361053a1a0a29 SHA-256: 51efa6c85975fc636922203ebdb67a7684b8ee5fd098b472714e350e6eaf320f
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell

The file contains Excel 4.0 (XLM) macro sheets with an Auto_Open defined name, indicating automatic execution upon opening. The heuristics specifically flag the use of dangerous formula APIs, including the RUN function, which is commonly used to execute arbitrary commands. While the exact payload is not visible due to truncation, the presence of these indicators strongly suggests a malicious intent to download and execute a secondary stage. No specific family could be identified.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
0f05b9649fec7d130a1da4bb4caee198823712aaacc668ed935b79edd1fb939c		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 79033 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.