Office (OOXML) / .XLSX malware analysis — malicious · 5499a5b9e59cb76f

MALICIOUS

Office (OOXML) / .XLSX

84.9 KB Created: 2021-03-15 18:19:11 UTC Authoring application: Microsoft Excel 16.0300

MD5: 5c380aada43584cb942a3f3c982420e7 SHA-1: d22c914eb360933f3d51ca3da01178140fecf9e3 SHA-256: 5499a5b9e59cb76f0ff61083dbc75b554bbefa22e886d192bc5d07025e1add51

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an Excel spreadsheet containing embedded Excel 4.0 macros. The heuristics indicate the presence of these macros, which are often used for malicious purposes. The script content is heavily obfuscated and truncated, preventing a detailed analysis of its specific actions, but the presence of macros strongly suggests a download and execution attack pattern. Further analysis of the full macro content would be required to identify the specific payload or C2 infrastructure.

Heuristics 1

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `8256b4eb17a8289dcef04247b68000b42585c7886fa4627de6cb038ece741c73`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	96758 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.