Office (OOXML) / .XLSX malware analysis — malicious · 6e67e32cd54565dc

MALICIOUS

Office (OOXML) / .XLSX

70.4 KB Created: 2021-03-15 18:19:36 UTC Authoring application: Microsoft Excel 16.0300

MD5: 7a681936cd2d1120be10991b89776c65 SHA-1: 99afccb9ef18e909d576364ce201ac965188f8bd SHA-256: 6e67e32cd54565dcf369f52a0617a7c55f0446a4ed1fbf7878f98512e278ccaa

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel spreadsheet containing Excel 4.0 macros, which are known to be used for malicious purposes. The heuristic firing indicates the presence of these macros, suggesting the file is designed to execute arbitrary commands upon opening. The macros are likely used to download and execute a secondary payload, a common technique for malware delivery.

Heuristics 1

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `cb02da0bdffd5b8826410fece42802ffaa2788cc3a67ee80f8cc43f88da42ec1`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	93628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.