Office (OOXML) / .XLSX malware analysis — malicious · 5b0edd0a4ba6f55d

MALICIOUS

Office (OOXML) / .XLSX

96.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: f36ec621441114f266f03aa1388588b1 SHA-1: 5d0d3fa00d8b8dff44992e7d1bbbb03848a7ce56 SHA-256: 5b0edd0a4ba6f55dc9e1d5f47c91028579996ff2b0d51d89065c9a5cc13feeb6

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel spreadsheet containing multiple Excel 4.0 macro sheets. The presence of these macros indicates an attempt to execute arbitrary code upon opening the document. The macros are likely designed to download and execute a secondary payload, a common technique for initial access and further compromise.

Heuristics 1

Excel 4.0 macro sheet (7 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `c3fd41e1553dbc0c85c6191c8880ca8e5ea2fb8b84b0a25910813a334ab55ec8`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.bin	428 bytes
`xlm_sheet_01.bin` `a924b15e477bf4d1a47b51e022ca0c2d2a7b02c1716e7777fe19bfbcf13342ae`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet6.bin	428 bytes
`xlm_sheet_02.bin` `fa2d0734b961bfe0111204b4a4d82ccb36b2d523a20a1258847828d87611cb2a`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet4.bin	428 bytes
`xlm_sheet_03.bin` `0b00fddc0f1a841eb1156267de044fc4c3fcdc2084038541b5a578f42cc54cdd`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	1995 bytes
`xlm_sheet_04.bin` `3f22ecd3b92065ef2e650eb963ec44372ab8b477a7069f8b48cc1aa0b1233b17`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	428 bytes
`xlm_sheet_05.bin` `de48f28ca9c031e534ca9bb26e4d6627ca78f55297e89122f6c4c40ac55f5e49`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet5.bin	428 bytes
`xlm_sheet_06.bin` `7b3fec6d8a07cb1fc45180af2906e58d6d68ade2ab663c2d72d1bbfeb1cad197`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.bin	428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.