Office (OOXML) / .XLSM malware analysis — malicious · 590c526905cf29c7

MALICIOUS

Office (OOXML) / .XLSM

33.8 KB Created: 2021-01-25 14:03:43 UTC Authoring application: 16.0300

MD5: fa9a8837f2f4f77c92502c70e637007d SHA-1: e412e89577edc45e5bc46462386b5eb9b8f2457e SHA-256: 590c526905cf29c7ebfa768768a6181598dd0b7da1a3eb4a2d40db1a5b5abf5d

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

This XLSM file contains Excel 4.0 macros, which are known to be used for malicious purposes. The macros utilize the `URLDownloadToFileA` function, indicating an intent to download and execute a second-stage payload from a remote source. The presence of hidden sheets and the use of dangerous XLM formulas further support this malicious intent. No specific family could be identified.

Heuristics 6

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `04653d4f70c19dc08fd54c67134a1aa8916a983c36b98af1cea0988bbde9c11c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3487 bytes
`vbaProject_00.bin` `c3fc58b384befd1a26dd363f471144db14936b4e3707227c92daa227e8a6a321`	vba-project	OOXML VBA project: xl/vbaProject.bin	23040 bytes
`xlm_sheet_00.xml` `e7f433b9b6ff773d85557baf829f63d74cdd398afd824a77b694235dc76c1c2f`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.