MALICIOUS
180
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file contains critical heuristic firings indicating the presence of Excel 4.0 macros and a reassembled payload. The macros appear to be designed to download and execute files from the specified URLs, likely serving as a downloader for a second-stage malicious payload. The specific nature of the payload is not discernible from the provided evidence.
Heuristics 3
-
Excel 4.0 macro sheet (13 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
-
XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOADAn Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.
-
ClamAV: Xls.Downloader.GreenOffice01220-9937699-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Downloader.GreenOffice01220-9937699-0
Extracted artifacts 13
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.bin08b2a21dfd49ba82acc3e98fa2548503ea70375384baae9690f9b9f92ee72a12 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin | 363 bytes |
xlm_sheet_01.bin75486df1e8fdc8dfcfa9347e2efdacc8c653c3f2057c715406ef8db6742ee804 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin | 632 bytes |
xlm_sheet_02.bin62069c771b71f4e449852a9717d0e3ee529ecca6497ff21cb92f7f53c4d1b43c |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.bin | 2766 bytes |
xlm_sheet_03.binae5e83e6d426668a5db416906d420732f1fdd9591d423b86f2b9f1dcd9fa44ac |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin | 1619 bytes |
xlm_sheet_04.bin2cd9dbeea24ca020fd0a4017b931dd97c95e7c0ab519355790f0ba447b4a3039 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet4.bin | 573 bytes |
xlm_sheet_05.bin5009dc8e79faedbbf6d81cc8ab84c37fddbbf642b83acb0a4f501b89844ac3ca |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet5.bin | 618 bytes |
xlm_sheet_06.bincd13478f2e3c7cf4b2507e646c0ceb5fea3e2f93cca4db2727dc940a10700abb |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet6.bin | 766 bytes |
xlm_sheet_07.bind6cbc03e36305aa993ba351dfcc3c9f2613ba6f5108c24fb559e4b12cff76c9e |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet7.bin | 472 bytes |
xlm_sheet_08.binfe33ad0661ee70bb32c1080c3584fa621afd5781d67903179cd30bf602806937 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet8.bin | 423 bytes |
xlm_sheet_09.binff4e973b54b80c00d226e9c4a283940eb8435e9810d5d202ee1f5db363852b06 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet2.bin | 754 bytes |
xlm_sheet_10.bin6136e300f8261bd0e71a47aed8dd19bafdab22d27cb4eaa966ba836779f08b49 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet3.bin | 679 bytes |
xlm_sheet_11.bin46a26398a13684a16d8ede38746c526be4025503508fe8a89a3748973af9a2d3 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet4.bin | 799 bytes |
xlm_sheet_12.bin52cbcb9c330923e6a38883615db2b9d510da997b15c7142598ab08d9f0a99559 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet9.bin | 619 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.