Office (OLE) / .XLSX malware analysis — malicious · 52a7c8826548be4b

MALICIOUS

Office (OLE) / .XLSX

36.5 KB Created: 2020-11-27 11:38:06 Authoring application: Microsoft Excel

MD5: 44a41273cf6a9a4d85025fc060783ebc SHA-1: db8d11d15025549b938f73a3d79fc42b9e568364 SHA-256: 52a7c8826548be4baa12c7863c1b162dd8a0ec7742cd1dc117be55db92751a1e

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The critical heuristic OLE_XLM_AUTOOPEN_DEFINEDNAME indicates the presence of an Excel 4.0 Auto_Open macro. This is further supported by the OLE_XLM_DANGEROUS_FN heuristic, which flags the use of dangerous formula APIs like RUN. The presence of an Auto_Open macro suggests the file is designed to execute code automatically upon opening, likely for malicious purposes such as downloading further payloads or establishing persistence.

Heuristics 3

Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME

oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN

Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `6388e6cf98ba7ddc4b62221edfb957e05d1802018153c548696ed3fea0542b50`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	6839 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.