Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 583b718c8ab6549a…

MALICIOUS

Office (OOXML) / .XLSM

430.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 360ef1fe164a1baeb3488ae087fe6959 SHA-1: ec77f3c4f314b63f8ae0759264725e7a8c257b45 SHA-256: 583b718c8ab6549a83b0d94077f5409fc27037ec320c31ad0134f67e7bb16823
410 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1204.002 Malicious File T1059.001 PowerShell T1105 Ingress Tool Transfer

The file is an XLSM document containing Excel 4.0 macros, indicated by critical heuristics for OOXML_XLM_MACROSHEET and OOXML_XLM_AUTOOPEN_DEFINEDNAME. The macros utilize dangerous XLM formula APIs like GOTO, EXEC, and HALT, which are known primitives for downloading and executing payloads. The presence of VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress API references further supports the payload execution. The ClamAV detection as 'Xls.Downloader.GreenEnable06210-9869360-0' confirms its downloader functionality.

Heuristics 11

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: GOTO, EXEC, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 4 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
3b0842c3feb9ed67b33a34a48dfc280d3096f5a2c314be3f5faf78e2baa667ed		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1648 bytes
xlm_sheet_01.xml
7d4a55654500227df147871fd9677ba5c24aa7c22083d410272b3fc52dfde2a3		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 1804 bytes
xlm_sheet_02.xml
83e3d47a6c45235934593bf9c8e8c38200b3b0117516d839726b31aeac579c0f		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.xml 2260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.