Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 53c3edc562587974…

MALICIOUS

Office (OOXML) / .XLSM

37.6 KB Created: 2021-04-07 07:02:41 UTC Authoring application: Microsoft Excel 16.0300
MD5: 53c8724991b2104f154971cef10e3d20 SHA-1: 45d097014c09400346de30873db0aea9576def9d SHA-256: 53c3edc5625879745d8e80d12e6396e82fd28ec11f15283dd33e65443788d4f1
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

The sample is an XLSM file containing VBA macros and an Excel 4.0 macro sheet. The presence of hidden sheets and the critical heuristic firing for XLM macros suggest the intent is to conceal and execute malicious code. The VBA and XLM macros are likely responsible for downloading and executing a second-stage payload, although the specific URLs are not directly indicative of malicious activity.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
10f9340257f4c267d4a69e6c8fc82e9eb0317eb8a3d64a46dce6c041057f9290		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2406 bytes
vbaProject_00.bin
44c0de2e36f6e4280b1deaef9bf220b7cbbd2c9e4f026d1e70392bebdee1b9cf		 vba-project OOXML VBA project: xl/vbaProject.bin 25600 bytes
xlm_sheet_00.xml
c16e4cde2e69a3814f7e22498b8268ba35cc6459c7512f025029178c7ba2c2ba		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 763 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.