Win.Malware.BazarLoader-9875319-0 Office (OOXML) / .XLSX malware analysis — malicious · 7235083a31014473

MALICIOUS

Office (OOXML) / .XLSX

289.2 KB Created: 2021-04-14 18:22:16 UTC Authoring application: Microsoft Excel 16.0300

MD5: 4ec95ca2b0df8475ec8b973ff2fc844a SHA-1: 385a0daa005f5d87911fd1144d1e2f18a1ca8b5a SHA-256: 7235083a31014473c9a538e102efd9b9549ac454f99a5f8b2c36ccfc69045f0c

180 Risk Score

Malware Insights

Win.Malware.BazarLoader-9875319-0 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains critical heuristic firings indicating the presence of Excel 4.0 macros and a reassembled payload. The macro script uses `certutil` to decode and execute a payload, a common technique for downloading and running second-stage malware. The ClamAV signature specifically identifies this as BazarLoader.

Heuristics 3

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOAD

An Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.
ClamAV: Win.Malware.BazarLoader-9875319-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Malware.BazarLoader-9875319-0

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `6637ea2096f6441a3b652571312d4c33ddec27eeef663062634248481fc3b4fa`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	2033 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.